Training service provider needed for popia and paia compliance in kwazulu-natal

The purpose is to appoint a service provider to deliver in-house training on POPIA and PAIA to the Information Officer, Deputy Information Officers, and legal department of the Ports Regulator at their Durban offices. The training is essential to: Ensure legal compliance; Mitigate financial and reputational risks of non-compliance; Enable effective management and processing of personal information; Facilitate efficient processing of PAIA requests.

Closing date: 26 June 2026 at 12h00 (midday). Training session (1 day): July 2026.

All enquiries and submissions must be sent via email to: [email protected]

Submit your quotation via email to [email protected] before or on 26 June 2026 at 12h00 (midday). Late or incomplete submissions will be disqualified. Required returnable documents: Quotation on company letterhead; Completed and signed Declaration of Interest (SBD 4); Copy of CSD Report or MAAA Number; Completed and signed SBD 6.1 with valid B-BBEE Certificate or Sworn Affidavit; POPIA Consent form. Quotations must remain open for acceptance for 90 days from the closing date. The Ports Regulator bears no liability for bidder costs. No quotation is accepted until a formal contract/letter of award/order form is executed.

Evaluation occurs in 4 phases: Phase 1 (SCM Administrative): Mandatory requirements - Proof of CSD/MAAA registration; Valid Tax Clearance Certificate or Tax PIN; Completed and signed SBD 4 and SBD 6.1 forms; POPIA Consent Form; Valid B-BBEE Certificate or Sworn Affidavit. Failure to submit any mandatory document disqualifies the bid. Phase 2 (Functionality): Minimum 28/40 points required to proceed. Criteria: Company experience (reference letters for POPIA/PAIA training): 5+ letters = 20 points, 3-4 = 10 points, 1-2 = 5 points, none = 0 points. Lead facilitator qualifications: Legal/compliance + POPIA/PAIA certification = 20 points, legal/compliance only = 15 points, general training only = 10 points, none = 0 points. Phase 3 (Pricing): Itemized pricing schedule for training 8 people, inclusive of VAT. Total price weighs 80 points. Phase 4 (Specific Goals): B-BBEE status Level 1 = 20 points. All B-BBEE levels considered with proportional points. Failure to submit SBD 6.1 and B-BBEE Certificate/Affidavit results in 0 points for this phase.

Provide in-house training on POPIA and PAIA to the Information Officer, Deputy Information Officers, and legal department of the Ports Regulator at their Durban offices. Training must cover: PAIA: Objectives; Requestable information and timing; Decision-makers; Responsibilities of Information/Deputy Information Officers; Request processing timeframes; Request transfers; Relationship with other legislation; Grounds for refusal; Public interest and exemptions; Non-compliance implications; Recent court cases; PAIA Manual requirements; Important forms (provide templates). POPIA: Objectives; Relationship with other legislation (e.g., PAIA); Importance of protecting personal information; Conditions for processing personal information; Non-compliance implications; Registration process for Information/Deputy Information Officers; Duties of Information/Deputy Information Officers; Information submission requirements to the Information Regulator; Important organizational forms (provide templates). The service provider must supply training material in electronic format and issue certificates of attendance.

Bidders must demonstrate: Company experience: Submit reference letters (on client letterhead, stamped, signed) proving experience in facilitating POPIA and PAIA training. Scoring: 5+ letters = 20 points, 3-4 = 10 points, 1-2 = 5 points, none = 0 points. Lead personnel qualifications: Submit CV and qualifications of the proposed facilitator. Scoring: Legal/compliance + POPIA/PAIA certification = 20 points, legal/compliance only = 15 points, general training only = 10 points, none = 0 points. Minimum 28/40 points required to proceed to Phase 3 (Pricing).

Quotation must include an itemized pricing schedule for training 8 people, with subtotal, VAT, and total amounts clearly stated. Pricing must be inclusive of all applicable taxes (including VAT).

Mandatory compliance documents: Proof of registration on CSD (Central Supplier Database) or SARS PIN; Valid Tax Clearance Certificate or Tax PIN; Valid B-BBEE Certificate or Sworn Affidavit; Completed and signed SBD 4 (Declaration of Interest) and SBD 6.1 (Preference Points Claim Form); POPIA Consent form. Tax status will be verified on CSD or SARS E-Filing prior to award. Non-compliance may result in disqualification. Failure to submit both SBD 6.1 and B-BBEE Certificate/Affidavit results in 0 points for specific goals.

Submit SBD 6.1 preference points claim form and a valid B-BBEE Certificate or Sworn Affidavit. Specific goal: B-BBEE Level 1 = 20 points. All B-BBEE levels are considered, with points allocated proportionally. Failure to submit both SBD 6.1 and B-BBEE Certificate/Affidavit results in 0 points for specific goals.

No quotation is accepted until a formal contract/letter of award/order form is executed. Quotations must remain open for acceptance for 90 days from the closing date. The Ports Regulator bears no liability for bidder costs associated with preparation and submission of the RFQ.

For POPIA-related complaints or objections, contact the Information Regulator:

• Email: [email protected]
• Website: https://www.justice.gov.za/inforeg/ (navigate to 'Contact Us' > 'Complaints')

Submit the following returnable documents as part of your response:

• Signed Supplier Declaration Form with POPIA consent.
• Legal Name of Supplier.
• Company Registration Number or ID Number of Respondent/Supplier.
• Name of Authorised Representative.
• Signature of Respondent’s authorised representative.
• Date of Signature.

Additional submission requirements:

• Respondent must consent to the processing of personal information for vendor registration, payment facilitation, and contract execution.
• Respondent must confirm awareness of rights under Section 5 of POPIA.
• Respondent must declare that all submitted personal information is complete, accurate, and up to date.
• Respondent must indemnify the Ports Regulator against any claims arising from the processing of personal information submitted.

Required returnable documents:

• Legal Name of Supplier.
• Company Registration Number or ID Number of Respondent/Supplier.
• Name of Authorised Representative.
• Signature of Respondent’s authorised representative.
• Date of Signature.

Evaluation will consider the following:

• Legal: Respondents must be legally registered entities (company registration number or ID number required). Authorized representative must sign the declaration and consent forms.
• Compliance: Must demonstrate capability to comply with POPIA and PAIA. Must have policies and systems in place to secure personal information.
• Experience: Implied requirement for experience in delivering training on data protection laws (POPIA/PAIA).

Compliance with the Protection of Personal Information Act (POPIA) is mandatory. Requirements include:

• Registration and verification on the Central Supplier Database (CSD) for all organs of state.
• Adherence to POPIA principles: Accountability, Processing Limitation, Purpose Specification, Further Processing Limitation, Information Quality, Openness, Security Safeguards, and Data Subject Participation.
• Respondent must obtain and provide all necessary consents for personal information of other data subjects included in the submission.
• Respondent must indemnify the Ports Regulator against any civil, criminal, or administrative penalties arising from non-compliance with POPIA.
• Both parties must maintain sufficient measures, policies, and systems to secure information against all risks (physical, electronic, or otherwise).
• Ports Regulator must notify the Respondent of any unauthorised access, cybercrimes, or suspected cybercrimes and report such incidents to relevant authorities.
• Respondent must take remedial steps to mitigate loss or compromise of personal information and restore its integrity.

Contractual terms related to POPIA compliance:

• The Ports Regulator is the Responsible Party; the Respondent is the Data Subject.
• Ports Regulator will process personal information only with the Respondent’s knowledge and authorisation, treating it as confidential unless required by law or POPIA exceptions apply.
• Respondent must comply with all POPIA prescripts regarding information concerning the Ports Regulator.
• Ports Regulator will not modify, amend, or disclose Respondent’s personal data without prior written consent, except as permitted by law.
• Respondent must process any personal information disclosed by the Ports Regulator in the same manner as the Ports Regulator processes the Respondent’s data.
• Both parties must maintain sufficient measures, policies, and systems to secure information against all risks (physical, electronic, or otherwise).
• Ports Regulator must notify the Respondent of any unauthorised access, cybercrimes, or suspected cybercrimes and report such incidents to relevant authorities.
• Respondent must take remedial steps to mitigate loss or compromise of personal information and restore its integrity.
• Respondent may request confirmation, access, correction, deletion, or destruction of their personal information held by the Ports Regulator, using Form 2 of the POPIA Regulations (excluding critical/mandatory or evaluation information).
• Respondent must indemnify the Ports Regulator against any claims arising from the processing of personal information submitted.

Special conditions for POPIA compliance:

• Ports Regulator will process all information in accordance with Section 4(1) of POPIA, adhering to principles of Accountability, Processing Limitation, Purpose Specification, Further Processing Limitation, Information Quality, Openness, Security Safeguards, and Data Subject Participation.
• Ports Regulator will only process Respondent’s personal information for the purpose of vendor registration, payment facilitation, and contract execution, as well as risk assessment, vendor management, auditing, legal opinions, investigations, document storage, destruction, de-identification, and publishing as required by law.
• Respondent’s personal information will not be disclosed to third parties without prior written consent, except as required by law or POPIA exceptions.
• Both parties must ensure compliance with applicable laws and maintain measures to secure information against all risks.

Submit the SBD 6.1 Preference Points Claim Form as part of your tender. Include all required proof or documentation for specific goals (e.g., B-BBEE certificate). Failure to submit these will result in no preference points being awarded for those goals. The organ of state may require substantiation of any preference claims before or after adjudication.

Submit the SBD 6.1 Preference Points Claim Form and all required proof/documentation for specific goals (e.g., B-BBEE certificate). Failure to submit these will result in no preference points being awarded.

Evaluation uses the 80/20 preference point system: 80 points for price, 20 points for specific goals (B-BBEE status). Points for price are calculated using the formula: Ps = 80(1 - (Pt - Pmin)/Pmin), where Ps = points scored, Pt = tender price, Pmin = lowest acceptable tender price. B-BBEE points are allocated as follows: Level 1: 20, Level 2: 18, Level 3: 14, Level 4: 12, Level 5: 8, Level 6: 6, Level 7: 4, Level 8: 2, Non-compliant: 0. Tenderers must be registered legal entities (e.g., Pty Ltd, CC, Partnership). Fraudulent claims or non-compliance may lead to disqualification or legal consequences.

Price must include all applicable taxes and exclude unconditional discounts. The rand value of the contract is the total estimated value, including all taxes, calculated at bid invitation time. The 80/20 system applies for contracts up to R50,000,000. The organ of state reserves the right to verify pricing claims.

Submit proof of B-BBEE status level to claim preference points. Provide company registration details and type (e.g., Partnership, (Pty) Ltd, Close Corporation). The tenderer must certify that the information provided is true and correct via a signed declaration. The contractor may be required to furnish documentary proof of B-BBEE status and preference points claimed if requested by the organ of state. Penalties for fraudulent claims or non-compliance include: disqualification from the tender process, recovery of costs/losses/damages, contract cancellation with damages claimed, restriction from obtaining business from any organ of state for up to 10 years, and potential criminal prosecution.

B-BBEE status is critical for scoring specific goal points. Points are allocated as follows: Level 1: 20, Level 2: 18, Level 3: 14, Level 4: 12, Level 5: 8, Level 6: 6, Level 7: 4, Level 8: 2, Non-compliant: 0. Tenderers must submit proof of B-BBEE status to claim these points.

The contractor must furnish documentary proof of B-BBEE status and preference points claimed if requested by the organ of state. Penalties for fraudulent claims or non-compliance include: disqualification from the tender process, recovery of costs/losses/damages, contract cancellation with damages claimed, restriction from obtaining business from any organ of state for up to 10 years, and potential criminal prosecution. The tenderer must sign a declaration confirming the accuracy of the information and claims.

Evaluation uses the 80/20 preference point system: 80 points for price, 20 points for specific goals (B-BBEE). Price points are calculated using the formula: Ps = 80(1 - (Pt - Pmin)/Pmin), where Pt = tender price, Pmin = lowest acceptable tender price. The organ of state may use the lowest acceptable tender to confirm the applicable system.