Personal Data Protection Existing and Emerging Technologies Technical Advisor for ECA

REQUEST FOR EXPRESSION OF INTEREST (Consulting Services – Individual Selection) Senior Personal Data Protection Existing and Emerging Technologies – Technical Advisor Country Ethiopia

Project Ethiopia Digital ID for Inclusion and Services Project

Project ID P179040

Assignment Title Senior Personal Data Protection Existing and Emerging Technologies – Technical Advisor

Reference No. ET-NIDP-573612-CS-INDV

The Federal Democratic Republic of Ethiopia, Ministry of Finance (MoF), has received financing from the World Bank toward the cost of the Ethiopia Digital ID for Inclusion and Services Project. The National ID Program (NIDP), the ultimate project implementer, intends to apply part of the proceeds to select an individual consultant. The National ID Program is looking for a Senior Personal Data Protection Existing and Emerging Technologies – Technical Advisor located at the Ethiopian Communications Authority (ECA) to support the implementation of the Ethiopia Digital ID for Inclusion and Services Project with respect to providing high-level technical expertise in translating the requirements of the Personal Data Protection Proclamation into practical and technically implementable standards, safeguards, and supervisory mechanisms, among others. The primary objective of the assignment is to provide high-level technical expertise to support ECA in translating the requirements of the Personal Data Protection Proclamation into practical and technically implementable standards, safeguards, and supervisory mechanisms. The Advisor will bridge technology, cybersecurity, data governance and privacy, enabling ECA to assess risks associated with existing and emerging technologies, strengthen technical compliance audits and DPIA assessments, develop appropriate standards and assessment tools, advise on data localization and cross-border data transfers, support breach-response mechanisms, and enhance the Authority’s oversight of digital platforms and data markets. Scope of Service and specific tasks

Scope of Services

The Technical Advisor shall provide specialized technical advisory, assessment, regulatory development, capacity-building, and supervisory support to the Authority in the implementation and enforcement of the Personal Data Protection Proclamation No. 1321/2024 and other applicable legal and regulatory instruments. The scope of services shall include, but not be limited to, the following:

Technology Foresight and Advisory: Advise ECA on the privacy, cybersecurity, and regulatory implications of existing and emerging technologies.

Technical Standards Development: Develop technical standards, guidelines, and security baselines for secure personal data processing, storage, and transfer.

Technical Risk Assessments: Conduct system reviews, security assessments, and DPIAs for high-risk personal data processing activities.

Technical Compliance and Supervision: Develop audit tools and support ECA's inspections and technical compliance assessments of data controllers and processors.

Breach and Incident Response: Develop incident-response procedures and support technical investigations, root-cause analysis, and remediation monitoring.

Capacity Building and Stakeholder Engagement: Develop training materials and deliver technical training and workshops for ECA staff and relevant stakeholders. Technical Coordination and Other Duties: Collaborate with relevant ECA departments and stakeholders and undertake related assignments directed by ECA leadership within the scope of the assignment.

Specific Tasks Based on the above Scope of Service, the Technical Advisor shall perform the following specific tasks: Technology Foresight and Strategic Technical Advisory Development of Technical Standards and Security Baselines Technical Assessments, System Reviews, and DPIAs Technical Compliance Audits and Supervisory Support Personal Data Breach and Security Incident Management Technical Capacity Building and Stakeholder Engagement Reporting, Knowledge Management, and Additional Assignments

Minimum Qualifications and Experience The candidate is required to have the following minimum Qualifications and Experience: A Master's degree or equivalent in Computer Science, Information Technology, Information Systems, Cybersecurity, Data Science, Telecommunications/Communications Engineering or a related field; At least seven (7) years of relevant professional experience in cyber security, technology strategy, digital transformation, data architecture, emerging technologies, technology governance or a related field; Strong knowledge and demonstrated practical understanding of AI, biometrics, digital identity, cloud computing, privacy-enhancing technologies, data technologies and other emerging technologies; Good understanding of personal data protection, privacy by design and by default, and technology-related regulatory requirements; Experience working with digital public infrastructure, telecommunications, financial services or other complex technology environments is an advantage; Experience or knowledge in RegTech and technology-enabled regulatory solutions is desirable; Strong analytical, research, communication and report-writing skills, including the ability to explain complex technical issues to legal, policy and regulatory audiences; Relevant professional certifications in data protection, privacy, cybersecurity, information technology or related fields are an advantage; and Excellent command of written and spoken English and Amharic.

Duration and Location The consultant will be engaged on a full-time basis for an initial period of twelve (12) months, with the possibility of extension subject to satisfactory performance and availability of budget. The position will be based in Addis Ababa, Ethiopian Communication Authority (ECA) The Technical Advisor shall report to the Director General or the designated Deputy Director General/Director responsible for personal data protection, or another designated ECA supe