Popia compliance implementation support for the national lotteries commission (NLC)

Closing date: 09 June 2026 at 11:00 AM (SAST). Validity period: 120 days from closing date. Bidders may be requested to extend validity if evaluation is not finalised. No compulsory briefing session.

Technical and bidding enquiries: Penelope Soyingwa. Email: [email protected]. Supply Chain Management phone: 012 432 1302. Technical enquiries phone: 012 432 1414. All enquiries must be submitted before the closing date and will be responded to within 3 days.

Submit bids online only via the e-Tender portal: https://www.etenders.gov.za/. No emails or physical submissions accepted. Bids must be in PDF format, protected from modifications, deletions, or additions. Late or incomplete submissions will be rejected. Ensure successful submission; resolve discrepancies with National Treasury as portal custodians. Required returnable documents: VAT Registration, Supplier Compliance Tax Central Supplier Database (CSD) Registration Report, Valid SARS Tax Compliance Status (TCS) PIN, Proof of Compensation for Occupational Injuries and Diseases Act (COIDA) registration and 'good standing' with the Compensation Fund. Joint Ventures (JVs) must submit a signed JV Agreement/MoU, including authorised representative details and company registration documents. Failure to submit mandatory documents will result in disqualification.

Evaluation follows the 80/20 preference point system (80 points for price, 20 for preference). Minimum threshold: 75% for functional criteria to proceed. Stages: 1) Tender Closing and Opening, 2) Administrative Compliance (SBD 1, SBD 6.1, Tax Compliance, CSD Registration, POPIA Consent Form, B-BBEE Certificate), 3) Mandatory Compliance (SBD 4, Technical Proposal, JV Agreement if applicable, Pricing Schedule), 4) Technical Evaluation (scored 0-5 per criterion). Technical/Functional criteria: Written Reference Letters (20%): 5+ valid references with POs (5 pts) to none (0 pts). Company Experience (10%): 5+ years POPIA implementation (5 pts) to <2 years (0 pts). Methodology & Execution Plan (50%): Scored 5 (exceeds) to 0 (unacceptable). Account Manager’s Experience (20%): >5 years (5 pts) to <1 year/no CV (0 pts). Stage 5: Pricing and Specific Goals (20 points total): Black Ownership (100% = 8 pts, 51-99% = 4 pts, <51% = 0 pts), Women Ownership (100% = 4 pts, 30-99% = 2 pts, <30% = 0 pts), Youth Ownership (100% = 4 pts, 30-99% = 2 pts, <30% = 0 pts), Disability Ownership (20%+ = 4 pts, 10-19% = 2 pts, <10% = 0 pts).

Scope: Appoint a service provider to embed and implement POPIA compliance within the NLC. Key deliverables: a) Comprehensive gap analysis of NLC’s POPIA compliance, including regulatory, operational, governance, and procedural deficiencies. b) Map and document all personal information processing activities (collection, storage, dissemination, retention, archiving, destruction) across all business units. c) Conduct POPIA compliance audit of existing systems, policies, procedures, controls, and governance mechanisms. d) Privacy impact assessment and compliance analysis for lawful processing of personal information. e) Status risk assessment and information governance audit (records management, cybersecurity, data protection). f) Develop POPIA Implementation Framework, Compliance Roadmap, and Responsibility Matrix with timelines, reporting structures, and monitoring measures. g) Review/refine NLC’s POPIA Policy and develop a Procedure Manual covering: data collection, access/integrity controls, usage limitations, storage/retention, security safeguards, disclosure protocols, roles/responsibilities, complaint management, records retention, and data destruction. h) Develop and implement POPIA awareness and capacity-building programme (staff training, induction, refresher courses). i) Conduct formal training workshops on POPIA Compliance Framework for NLC officials. Contract duration: 6 months from appointment. Reporting: Monthly progress reports and bi-weekly review meetings with NLC representatives.

Bidders must submit a detailed project implementation plan outlining the methodology, key activities, deliverables, milestones, dependencies, governance structure, and realistic timelines for each phase of the assignment. The plan must include commencement and completion dates. The methodology and execution plan will be evaluated on a scale of 0-5, with 5 being 'Exceeds the requirement' and 0 being 'Unacceptable'.

Bidders must demonstrate experience in providing POPIA implementation services. Company Experience (10% of technical evaluation): 5+ years (5 pts), 4-5 years (4 pts), 3-4 years (3 pts), 2-3 years (2 pts), <2 years (0 pts). Account Manager’s Experience (20% of technical evaluation): >5 years (5 pts), 4-5 years (4 pts), 3-4 years (3 pts), 2-3 years (2 pts), 1-2 years (1 pt), <1 year/no CV (0 pts). Bidders must provide a company profile (max 5 pages) and the Account Manager’s updated CV with at least three traceable references.

The Service Provider must submit detailed monthly progress reports to the NLC, reflecting implementation status, key deliverables achieved, risks identified, mitigation measures, and deviations from the project plan. The Service Provider must participate in bi-weekly progress review meetings with NLC representatives to present updates, address queries, report challenges, and agree on corrective actions and next steps.

Bidders must submit a fully itemised commercial proposal with a professional fee structure, including hourly/daily/unit rates, cost breakdown per deliverable or workstream, and any ancillary or disbursement costs. VAT must be clearly indicated. Pricing must be VAT-inclusive as per Annexure B. The pricing schedule will be evaluated as part of the 80/20 preference point system.

Submit a fully itemised commercial proposal with: professional fee structure (hourly/daily/unit rates), cost breakdown per deliverable/workstream, ancillary/disbursement costs, and VAT indication. Pricing Schedule: Refer to Annexure B (VAT-inclusive rates). Validity period: 120 days from closing date, extendable if requested. Payment terms and bonds/guarantees not explicitly stated in the document.

Mandatory: CSD registration (foreign suppliers with no local entity exempt). Submit CSD Registration Report and number. Tax Compliance: Valid SARS TCS PIN (apply via e-Filing at www.sars.gov.za). Submit TCS certificate or CSD number if PIN unavailable. COIDA: Proof of registration and 'good standing' with the Compensation Fund for all employees (including subcontractors). B-BBEE: Valid B-BBEE Certificate or Sworn Affidavit (consolidated for JVs). POPIA: Signed consent form for processing personal information. Standard Bidding Documents: SBD 1 (Invitation to Tender), SBD 4 (Declaration of Interest), SBD 6.1 (Preference Points Claim Form). Joint Ventures: Signed JV Agreement/MoU, authorised representative details, and company registration documents. Additional: No bids from state employees, directors/members in state service, or entities listed in the Register for Tender Defaulters/Restricted Suppliers.

All copyright and intellectual property vests with the NLC. Late and incomplete submissions will not be accepted. No services may be rendered or goods delivered before an official NLC Purchase Order is received. The RFQ is evaluated under the 80/20 preference point system. Suppliers must register on the Central Supplier Database (CSD) and provide their CSD registration number and report. Tax compliance is mandatory. All queries must be directed to [email protected] and will be responded to within 3 days. The NLC’s decision on stipulations is final and binding. Bidders must comply with B-BBEE requirements and the National Industrial Participation Programme (NIP) if applicable. Bids must be in English. Headings are for reference only. All employees (including subcontractors) must be covered under COIDA. Bidder’s personal information will be processed in accordance with POPIA and the NLC’s Data Privacy Policy. Successful bidder details will be published on the National Treasury’s e-Tender portal within 7 working days of award.

Evaluation follows the 80/20 preference point system. Minimum threshold: 75% for functional criteria to proceed. Stages: 1) Tender Closing and Opening, 2) Administrative Compliance (SBD 1, SBD 6.1, Tax Compliance, CSD Registration, POPIA Consent Form, B-BBEE Certificate), 3) Mandatory Compliance (SBD 4, Technical Proposal, JV Agreement if applicable, Pricing Schedule), 4) Technical Evaluation (scored 0-5 per criterion). Technical/Functional criteria: Written Reference Letters (20%), Company Experience (10%), Methodology & Execution Plan (50%), Account Manager’s Experience (20%). Stage 5: Pricing and Specific Goals (20 points total for B-BBEE ownership categories). Only bidders scoring above 75% for functional criteria proceed to further evaluation.