|
Tenders are invited for Consultancy for Data Protection Audit and Filling with the Nigeria Data Protection Commission Date Added: February 4, 2026 Deadline: 17/02/2026 Category: Consultancy Action Against Hunger tackles the causes and effects of hunger and diseases that threaten the lives of vulnerable children, women and men. Established in France in 1979, Action Against Hunger are a non-governmental, non-political, non-religious, non-profit organization. The purpose of this agreement is for the Auditor to perform a data protection audit to evaluate and examine the Coordinators compliance status as relating to data protection. The Auditors objective is to conduct these procedures, and provide a report of factual findings to the Coordinator. This is an assurance engagement; therefore, the Auditor is expected to provide an audit opinion or express assurance. The Coordinator must submit a Data Protection Audit Report, prepared by an external auditor (DPCO), to the Nigerian Data Protection Commission. The NDPC requires this report to validate the Coordinators compliance status with the NDPA. Geographical scope coverage Borno State, Sokoto State and Yobe State, Nigeria. Responsibilities of the Parties to the Engagement Coordinators Responsibilities: The Coordinator is responsible for sharing all documents, reports and information relating to data protection. These documents, reports and information must align with the Nigerian Data Protection Act/Regulations. The Coordinator must also provide sufficient data protection and non-data protection information to support the audit process and granting the Auditor full access to staff, databases, and relevant records, enabling the Auditor to perform the required procedures effectively. Auditors Responsibilities: The Auditor, a data protection compliance organization (DPCO) engaged for this purpose, is tasked with performing the agreed-upon procedures specified in these ToR. The Auditor must provide a report of factual findings to the Coordinator. The Auditor can refer to the engagement partner or other team members responsible for the process. The Auditor confirms they meet at least one of the following conditions: NDPC License: The Auditor or firm is licensed by the Nigerian Data Protection Commission. NDPA Compliance: The Auditor or firm fully understands and is knowledgeable on the requirements of the Nigerian Data Protection Act. EU GDPR Compliance: The Auditor or firm fully understands and is knowledgeable on the requirements of the European Unions General Data Protection Regulations Standards and Ethics The Auditor will conduct this engagement according to: NDPA 2023: Nigeria Data Protection Regulation of 2023, related to agreed-upon procedures for data protection compliance. ISO/IEC 27001 Standards: The Auditor will adhere to the ISO/IEC 27001 Standards for Professionals which outlines principles regarding integrity, objectivity, independence, professional competence, confidentiality, and technical standards in ensuring data security and avoiding data breaches. Procedures, Evidence, and Documentation The Auditor will plan and execute the audit, following the procedures listed in Annex 1 and guidelines in Annex 2. The evidence gathered will support the report of factual findings, ensuring the work aligns with NDPA 2023 and this ToR. Profile of the consultant (Qualification and Experience) The consultant must be a qualified Data Protection Auditor with the following minimum requirements: Professional certification in Data Protection such as NDPR DPCO Certification, ISO 27001 Lead Auditor, or equivalent Minimum of 35 years practical experience in data protection compliance, auditing, or information security Proficiency in preparing the mandatory annual filings required by NDPC for high-level data controllers/processors under GAID 2025 Demonstrated experience conducting NDPR audits for organizations in Nigeria Skilled in conducting and preparing Compliance Audit Returns (CAR) as required for Data Controllers/Processors of Major Importance under NDPC guidelines Strong understanding of Nigeria Data Protection Act (NDPA 2023), NDPR 2019, and global data protection standards (GDPR, ISO 27001) Excellent report-writing, communication, and analytical skills Ability to advise organizations on compliance measures, including data subject rights, consent management, and risk mitigation Experience with information management, data lifecycle governance, and confidentiality/integrity controls. Knowledge of cybersecurity fundamentals aligned with NDPC approved skill areas such as cyber law and information security. Ability to provide actionable recommendations and support remediation efforts Annex 1 Listing of specific procedures to be performed Annex 2 Guidelines for specific procedures to be performed All interested consultants should send Expression of Interest electronically from Wednesday 4th February 2026 by 12noon till 17th February, 2026. to: supply@ng-actionagainsthunger.org with subject CONSULTANCY FOR DATA PROTECTION AUDIT AND FILLING WITH THE NIGERIA DATA PROTECTION COMMISSION. in order to receive the full ToR. Tender Link : https://etenders.com.ng/action-against-hunger-invitation-to-tender-for-consultancy-for-data-protection-audit-and-filling-with-the-nigeria-data-protection-commission/
|
