Terms of Reference (ToR) for Consultancy to Develop Data Protection and Privacy Compliance Documents for Edify Rwanda

Terms of Reference (ToR)

Consultancy to create Data Protection and Privacy Compliance Documents for Edify Rwanda

1. Background

Edify Rwanda is committed to strengthening its data protection and privacy compliance framework in line with the Rwanda Data Protection and Privacy Law and the requirements of the National Cyber Security Authority (NCSA). To enhance compliance, Edify Rwanda seeks to engage a qualified consultant with expertise in data protection law and regulatory compliance to create and/or evaluate key legal and operational documents.

2. Objective

The objective of this consultancy is to create a comprehensive set of data protection compliance documents that meet the requirements of the Rwanda Data Protection and Privacy Law and international best practices.

3. Scope of Work

The consultant will create the following documents:

• NCSA Registration Application 
• Data Protection Focal Point (DPFP) Appointment Letter 
• Data Protection Focal Point (DPFP) Terms of Reference 
• Edify Rwanda Data Protection Policy 
• Privacy Notices – Staff & Partners 
• Updated Standard Consent Forms 
• NCSA Cross-Border Transfer Authorization 
• Standard Contractual Clauses (SCCs) with Edify Global 
• Rwanda-Compliant Breach Response SOP 
• Record of Processing Activities (ROPA) 
• Data Retention & Disposal Schedule 
• Rwanda-Compliant DPA Template for Vendors 
• Kinyarwanda Privacy Notices – Beneficiaries

The consultant shall make sure that all documents are legally compliant, practical for implementation, and aligned with the applicable regulatory requirements in Rwanda.

4. Deliverables

The consultant will submit:

• Final versions of all seven documents in editable Microsoft Word format.
• A brief implementation guide or recommendations where applicable.
• One evaluate session to present the documents and respond to comments from Edify Rwanda.

5. Consultant Qualifications

The consultant should demonstrate:

• Proven experience in data protection and privacy law.
• Strong knowledge of the Rwanda Data Protection and Privacy Law and NCSA requirements.
• Experience drafting legal and compliance documentation.
• Excellent legal writing and communication skills.
• Previous experience working with NGOs or international organizations is an added advantage.

6. Proposal Requirements

Interested consultants are requested to submit:

Technical Proposal

• Understanding of the assignment.
• Proposed methodology and approach.
• Work plan and proposed timeline.
• Relevant experience and similar assignments completed.
• Consultant's profile/CV.

Financial Proposal

• Detailed quotation indicating professional fees and any applicable taxes.
• Breakdown of costs where applicable.

7. Submission

Interested consultants should submit both the Technical and Financial Proposals by 15th September 2026 via email to cuwimbabazi@edify.org, with copies to ckayigamba@edify.org and cmukahigiro@edify.org

For further information or clarification regarding this consultancy, interested consultants may contact:

+250 786 553 319, or +250 788 846 876. Only shortlisted consultants will be contacted