Terms Of Reference (ToR) For Development of a Data Protection and Privacy Policy tender job at Forum for African Women Educationalists (FAWE) Uganda

1.  Background
The Forum for African Women Educationalists (FAWE) Uganda Chapter was launched in February 1997 as part of a network of 34 FAWE National Chapters across Africa. FAWE was founded by five visionary African women Ministers of Education who sought to address the persistent gender gaps in education and promote equal learning opportunities for girls and women.

FAWE Uganda’s vision is “A Uganda in which girls and women lead dignified lives,” and the mission is “To enhance opportunities for girls to attain quality education and skills through sponsorship, social protection, institutional strengthening, and advocacy.”

To achieve this mission, FAWE Uganda collects and processes a wide range of data including personal, programmatic, institutional, and financial information used for program implementation, monitoring, reporting, and partnership management. As data increasingly drives organizational efficiency and decision-making, ensuring its confidentiality, integrity, and lawful use is critical.

Uganda’s Data Protection and Privacy Act (2019) and its attendant regulations require organizations that handle personal data to adopt appropriate measures and safeguards to ensure compliance and protect the rights of data subjects. As FAWE Uganda continues to expand datadriven operations, we recognize the urgent need to establish a Data Protection and Privacy Policy that provides clear guidance on lawful data management, defines staff responsibilities, and minimizes data-related risks.

FAWE Uganda seeks a consultant or consultancy firm to develop a comprehensive Data

Protection and Privacy Policy for FAWE Uganda that ensures compliance with the Data Protection and Privacy Act, 2019; promotes ethical handling of data; strengthens governance and security of personal information; and builds a culture of data protection across the organization.

2.  Scope of Work
The consultant/firm will:

1. Review relevant FAWE Uganda documents, including existing IT policy, HR manual, and operational procedures related to data handling.
2. Conduct stakeholder consultations with FAWE Uganda management, staff and external partners to understand data flows and privacy needs.
3. Benchmark FAWE Uganda’s practices against national and international data protection standards (e.g., Data Protection and Privacy Act, 2019; GDPR principles; and AU Convention on Cyber Security and Personal Data Protection).
4. Draft a Data Protection and Privacy Policy covering, but not limited to:
   • Lawful bases for data collection and processing
   • Data subject rights and consent management
   • Data classification, access control, and security
   • Data sharing, transfer, and third-party handling
   • Retention and disposal procedures
   • Data breach response and reporting
   • Governance and compliance monitoring mechanisms
5. Present the draft policy to FAWE Uganda management and incorporate feedback.
6. Develop a final, user-friendly and implementable Data Protection and Privacy Policy document.
7. Provide recommendations for staff capacity building and policy dissemination.

3.  Expected Deliverables
The consultant/firm will deliver:

1. Inception report outlining understanding of the assignment, methodology, and work plan.
2. Data assessment report summarizing findings from the review and consultations.
3. Draft Data Protection and Privacy Policy for FAWE Uganda’s review.
4. Validation meeting to present and refine the draft policy with FAWE Uganda management.
5. Final policy document incorporating all feedback, submitted in editable Word and PDF formats.
6. Implementation roadmap highlighting steps for policy roll-out, training, and compliance monitoring.

4.  Duration of the Assignment
The consultancy is expected to take approximately 30 working days spread over a period of four (6) weeks, commencing upon signing of the contract.

5.  Required Qualifications and Experience
For Individual Consultants:

• A bachelor’s degree in information technology, Computer Science, or related field (Master’s degree preferred).
• At least 5 years of experience in IT policy development, data governance, or cybersecurity.
• Strong understanding of Uganda’s Data Protection and Privacy Act (2019) and related regulations.
• Proven experience in developing similar data protection or IT-related policies.
• Excellent writing, facilitation, and analytical skills.

For Consultancy Firms:

• Registered entity with demonstrated expertise in IT governance, data protection, and policy development.
• A qualified team with diverse skills in IT, data protection laws, and information security.
• Evidence of at least three similar assignments completed in the past five years.

6.  Reporting and Supervision
The consultant/firm will report directly to the Executive Director or her designate.

Technical oversight and coordination will be provided by the Human Resource & Administration Manager and the IT Support staff.

7.  Application Requirements

Interested applicants should submit a technical proposal detailing understanding of the assignment, methodology, and work plan, a financial proposal, CV(s) of proposed consultant(s) or team members and at least two relevant references or samples of previous work by 5:00 pm, Monday, 3rd November 2025.

Hand deliver your proposal to the address below;

The Chairperson – Procurement Committee,
Forum for African Women Educationalists (FAWE) Uganda Chapter,
Plot 328, Magulu Close, Bukoto, Kampala, Uganda

OR