Personal Data Protection Compliance & Audit Advisor for ECA

REQUEST FOR EXPRESSION OF INTEREST (Consulting Services – Individual Selection) Senior Personal Data Protection Compliance & Audit Advisor Country Ethiopia

Project Ethiopia Digital ID for Inclusion and Services Project

Project ID P179040

Assignment Title Senior Personal Data Protection Compliance & Audit Advisor

Reference No. ET-NIDP-573615-CS-INDV

Required No. 1 (one)

Organization Ethiopian Communications Authority (ECA)

Duty Station Ethiopian Communications Authority (ECA), Addis Ababa, Ethiopia

Employment Type Contract

Duration 12 months, with possibility of extension subject to satisfactory performance and availability of budget

The Federal Democratic Republic of Ethiopia, Ministry of Finance (MoF), has received financing from the World Bank toward the cost of the Ethiopia Digital ID for Inclusion and Services Project . The National ID Program (NIDP), the ultimate project implementer, intends to apply part of the proceeds for selecting an individual consultant. The National ID Program is seeking a Senior Personal Data Protection Compliance & Audit Advisor to support the Ethiopian Communications Authority (ECA) in strengthening ECA’s personal data protection compliance, audit, inspection, risk assessment, and regulatory supervision functions under Personal Data Protection Proclamation No. 1321/2024 and applicable subsidiary legislation, directives, standards, and guidelines.

1. Background

The Government of Ethiopia has established a comprehensive legal framework for the protection of personal data through Personal Data Protection Proclamation No. 1321/2024 . The Proclamation designates the Ethiopian Communications Authority (ECA) as the national authority responsible for regulating and enforcing personal data protection. ECA’s mandate includes, among others, registration and supervision of data controllers and processors, compliance monitoring, investigation of violations and complaints, development of regulatory instruments, and enforcement of personal data protection requirements. The Proclamation establishes obligations concerning lawful and fair processing, purpose limitation, storage limitation, security and confidentiality, data-subject rights, registration of controllers and processors, Data Protection Officers, technical and organizational measures, breach notification, Data Protection Impact Assessments (DPIAs), and privacy by design. The implementation of these requirements requires ECA to develop a risk-based, systematic and evidence-based compliance and audit capability capable of assessing whether public and private sector organizations are effectively complying with the Proclamation and applicable subsidiary legislation, directives, standards and guidelines. This is further reinforced by Digital Ethiopia 2030 , which assigns ECA an expanded role in implementing personal data protection and exercising proactive oversight of digital platforms and data markets.

2. Objective of the Assignment

The overall purpose of the assignment is to provide senior-level professional expertise to strengthen ECA’s personal data protection compliance, audit, inspection and supervisory functions. The Advisor will support ECA in developing and implementing a risk-based compliance and audit framework for data controllers and processors; conducting compliance assessments and audits; identifying systemic and sector-specific privacy risks; assessing technical and organizational measures; supporting DPIA and high-risk processing assessments; developing audit tools and methodologies; monitoring corrective actions; and providing evidence-based recommendations for regulatory intervention and enforcement. The Advisor shall also support ECA in translating the personal data protection objectives of Digital Ethiopia 2030 into practical supervisory mechanisms for digital platforms, data-driven businesses, emerging technologies and data markets.

3. Scope of Services / Key Responsibilities

The Advisor will:

Establish risk-based frameworks, indicators, maturity models, and annual plans for supervisory inspections, audits, desk reviews, and regulatory follow-ups. Plan and lead audits to assess compliance with Proclamation No. 1321/2024 and other applicable laws and directives, evaluating entities’ governance structures, DPO arrangements, policy enforcement, registration accuracy, and data-subject rights implementation. Evaluate the adequacy of technical controls, including access management, encryption, logging, backup, physical security, data localization, cloud arrangements, and cross-border transfer safeguards. Review Data Protection Impact Assessments (DPIAs) and assess risks linked to high-risk processing, digital platforms, data monetization, and emerging technologies, including AI, biometrics, digital ID, cloud, IoT and fintech. Assess breach preparedness, investigate root causes and control failures in reported incidents, review notification compliance, and oversee remedial action plans. Provide technical evidence, risk ratings, and recommendations to support ECA’s regulatory inquiries, enforcement actions, corrective orders, and administrative sanctions. Formulate standardized supervisory toolkits, including audit manuals, inspection checklists, sector guidelines, DPIA/breach assessment templates, and compliance dashboards. Deliver technical training, develop audit materials, mentor ECA inspection teams, and facilitate awareness workshops with controllers, processors, and peer data protection authorities. Execute any additional assignments directed by ECA leadership to support ECA’s mandate.

4. Minimum Qualifications and Professional Experience

The candidate should have:

A minimum of a Master’s degree in Information Technology; Computer Science; Cybersecurity; Information Security; Information Systems; Data Science/Data Engineering; Computer Engineering; Telecommunications Engineering; Digital Transformation; Privacy/Data Protection; Risk Management; or another closely related discipline. A