Request for Proposal - Data Protection Consultancy Services

Request for Proposal

Data Protection Consultancy Services

RFP/BEY/22/09

FOR

DANISH REFUGEE COUNCIL (LEBANON)

The Danish Refugee Council assists refugees and internally displaced persons across the globe: we provide emergency aid, fight for their rights, and strengthen their opportunity for a brighter future. We work in conflict-affected areas, along the displacement routes, and in the countries where refugees settle. In cooperation with local communities, we strive for responsible and sustainable solutions. We work toward successful integration and whenever possible – for the fulfilment of the wish to return home.  

The Danish Refugee Council was founded in Denmark in 1956, and has since grown to become an international humanitarian organization with more than 7,000 staff and 8,000 volunteers. Our vision is a dignified life for all displaced. All of our efforts are based on our value compass: humanity, respect, independence and neutrality, participation, and honesty and transparency.

Operating since 2004 in Lebanon, DRC has addressed the needs and rights of vulnerable populations, working initially with Palestinian refugees (since 2004), Iraqi refugees (2007-2010), Lebanese IDPs (during the 2006 conflict), migrant domestic workers (since 2009), responding to the Syrian refugee crisis (since 2011) and to Lebanese crisis (since 2019).

DRC Lebanon is currently delivering programming in protection, livelihoods, and community development interventions. This myriad programming seeks to address the immediate needs of displaced populations and concurrently support vulnerable host populations. DRC has three offices spread throughout Lebanon in, Beirut, the Bekaa and North. 

Some of the Danish Refugee Council’s interventions are designed to improve protection and effectiveness of the humanitarian response in Lebanon by enhanced coordination through joint analysis, planning and response. DRC Lebanon manages and collects data using different methods in paper format or in digital forms such as excel, online systems. DRC Lebanon has developed a beneficiary centric integrated system for three main sectors Protection, Economic Recovery, a Referral Information Management System “RIMS” that serves as humanitarian common platform to manage referrals between partners in Lebanon along with internal information management systems for MEAL and Safety departments. The Referral Information Management System ”RIMS” has the capacity to generate two categories of valuable data that can be used to improve humanitarian response: 1) information on the effectiveness and timeliness of referral processes and 2) gaps in service provision across sectors. To that end, DRC analyses aggregated information from RIMS partners to produce analysis on relevant trends and gaps. DRC Lebanon has developed Memorandum of Understanding, draft Data protection policy for RIMS with embedded basic Data Sharing Agreement to regulate the relation between different RIMS users who are Local NGOs, International NGOs, and UN Agencies. 

For further information about DRC, please refer to our website: https://drc.ngo/

Objectives:

DRC in Lebanon is in the initial stages of a global General Data Protection Regulation (GDPR) compliance initiative, which will see the entire global operation come into full alignment with the high standards of data protection laid out in the GDPR. DRC Lebanon has long been a leader within DRC on data protection specifically, and information management more broadly, and is therefore striving to pave the way on structuring this compliance process in complex, non-European environments. 

DRC must also take seriously it’s position within the legal contexts that it operates around the world, and ensure that it’s legal compliance responsibilities as a Danish organisation are balanced with its legal compliance responsibilities within the countries it operates.  

DRC Lebanon wishes to engage the expertise of a consultant in the area of reviewing existing data protection policy, current tools and practices for data protection, reviewing the compliance of the existing information management system with the Lebanese law related to data protection, privacy, GDPR and associated topics, and to provide a detailed overview over the application of DRC’s Information Management System and Lebanese legal framework, and give recommendations on the intersections between Lebanese law and the GDPR. 

DRC is seeking to appoint a Data Protection Consultant for the following:

Review existing data protection policy, current tools and practices, including data sharing agreements, lead on the production of a Data Asset Registry, and associated products, for DRC Lebanon, which will inform the upcoming GDPR compliance process through the below:

Responsibilities:

• Reviews and enhances current data protection policy in alignment with GDPR and Lebanese law 
• Conducts data ecosystem map and data asset registry for DRC Lebanon programme sectors Protection, Economic Recovery, and for the information management system RIMS
• Conducts one Data Sensitivity Matrix for DRC Lebanon operations
• Drafts Information Sharing Protocol and Data & Information Sensitivity Classification between DRC and external stakeholders such implementing partners, and DRC led consortium members.
• Advises on Data Sharing Agreements templates and forms with external stakeholders
• Conducts a comprehensive Individual Data Protection Impact Assessments for Protection, Economic Recovery sectors, and for RIMS
• Liaises with DRC’s Information and Cyber Security focal points on reviewing and including Information Security Policies including Data incident management into the national data protection policy
• Drafts user-friendly data protection communication materials to raise awareness among DRC staff around Data Protection
• Other duties as agreed with the PDQ Manager and/or Information Management Coordinator in line with objectives above and weekly work plans.

RFP Issuing date: 23 of September 2022

Online technical meeting: 28th of September 2022 at: 10:00 am Via Teams

RFP Closure Date:  7th of October 2022 at 2:00 pm (Beirut time)