Popia compliance implementation support for the national lotteries commission (NLC)

Quantity Total Cost

(Vat

inclusive)

Phase 1 (20% of the work will complete)

1 Assessment, analysis, scoping and project planning Conduct a comprehensive gap analysis to assess the 1

NLC’s level of compliance with POPIA

Map and document all personal information processing

activities undertaken within the NLC, including the

collection, recording, storage, dissemination, retention,

archiving, and destruction of personal information

across all business units and operational processes.

Conduct a comprehensive POPIA compliance audit

and assessment of the NLC’s existing systems,

policies, procedures, controls, governance

mechanisms, and operational processes utilised in the

processing of personal information.

Undertake a privacy impact assessment and

compliance impact analysis to determine whether

adequate safeguards, measures, standards, and

controls are in place to ensure compliance with the

conditions for the lawful processing of personal

information as contemplated in POPIA

Conduct a status risk assessment and information

governance audit to determine the NLC’s level of

compliance with applicable records management,

information governance, cybersecurity, and d

Cost re-imbursed at cost + Mark up not more than 10%

Note: All delivery costs must be included in the bid price, for delivery at the prescribed

destination.

• * “all applicable taxes” includes value- added tax, pay as you earn, income tax,

unemployment insurance fund contributions and skills development levies

awareness and capacity-building programme,

including staff awareness initiatives, induction training

for new employees, periodic refresher training, and

targeted compliance training for all relevant personnel

Phase 3 Phase 1 (100% of the work will complete)

Pricing schedule: appointment of a suitably qualified and experienced service provider to assist in the

1.1. The National Lotteries Commission (“NLC”) is a statutory regulatory authority established in terms of

the Lotteries Act , as amended (“the Lotteries Act”), with the mandate to regulate the National

Lottery, as well as other lotteries and society lotteries within the Republic of South Africa.

1.2. The NLC is enjoined to ensure that funds generated through the National Lottery are distributed in an

equitable, fair, transparent, and expeditious manner throughout the Republic, to advance social

upliftment and socio-economic development within vulnerable and marginalised communities, with

particular emphasis on poverty alleviation and the reduction of inequality, in alignment with the

objectives of the National Development Plan.

1.3. In the execution of its statutory mandate and the discharge of its functions under the Lotteries Act, the

NLC is further obliged to uphold and give effect to the constitutional and administrative law principles

of openness, accountability, transparency, and good governance.

2.1. The National Lotteries Commission hereby invites suitably qualified, experienced, and competent

service providers to submit proposals for the provision of professional services relating to the

embedding, operationalisation, and implementation of the Protection of Personal Information Act (“POPIA”) across the organisation.

2.2. The NLC performs a wide range of statutory and regulatory functions which necessarily entail the

collection, processing, storage, dissemination, and safeguarding of personal information, including,

inter alia, matters pertaining to employment and human resources administration, grant funding and

adjudication processes, stakeholder engagements, as well as the regulation and oversight of lotteries

and sports pools.

2.3. The NLC has undertaken a number of foundational initiatives aimed at facilitating compliance with

POPIA and establishing an appropriate information governance framework. These initiatives include,

but are not limited to, the following:

2.3.1. A POPIA Compliance Risk Management Plan (“CRMP”);

2.3.2. A POPIA Policy;

2.3.3. A draft POPIA Standard Operating Procedure;

2 | P a g e

\\

2.3.4. A Data Management Policy;

2.3.5. An approved Records Management Plan;

2.3.6. An approved File Plan;

2.3.7. An Information Classification Policy; and

2.4. The incorporation of POPIA-related and data protection clauses within its contractual agreements and

operator arrangements.

3.1. The purpose of this Request for Quotation (“RFQ”) is to invite suitably qualified, experienced, and

capable service providers to submit proposals for the provision of professional services relating to the

embedding, operationalisation, and implementation of the Protection of Personal Information Act

(“POPIA”) within the National Lotteries Commission.

4. Objective

4.1. The objective of this Request for Quotations (“RFQ”) is to appoint a suitably qualified and experienced

service provider to, inter alia, undertake a comprehensive gap analysis, develop the requisite

governance, compliance, and implementation frameworks, and facilitate the effective operationalisation

and institutional embedding of the Protection of Personal Information Act (“POPIA”) across

all operational, regulatory, administrative, and governance activities of the National Lotteries

Commission.

5.1. The appointed Service Provider shall, inter alia, be required to render the following services:

a) Conduct a comprehensive gap analysis to assess the National Lotteries Commission’s level of

compliance with the Protection of Personal Information Act (“POPIA”), including the

identification of regulatory, operational, governance, and procedural deficiencies;

b) Map and document all personal information processing activities undertaken within the NLC,

including the collection, recording, storage, dissemination, retention, archiving, and destruction

of personal information across all business units and operational processes;

3 | P a g e

\\

c) Conduct a comprehensive POPIA compliance audit and assessment of the NLC’s existing

systems, policies, procedures, controls, governance mechanisms, and operational processes

utilised in the processing of personal information;

d) Undertake a privacy impact assessment and compliance impact analysis to determine whether

adequate safeguards, measures, standards, and controls are in place to ensure compliance with

the conditions for the lawful processing of personal information as contemplated in POPIA;

e) Conduct a status risk assessment and information governance audit to determine the NLC’s level

of compliance with applicable records management, information governance, cybersecurity, and

data protection requirements;

f) Develop a comprehensive POPIA Implementation Framework, Compliance Roadmap, and

Responsibility Matrix aligned to the readiness and compliance requirements prescribed by the

Information Regulator, including clear accountability mechanisms, implementation timelines,

reporting structures, and compliance monitoring measures;

g) Review, refine, and where necessary enhance the NLC’s existing POPIA Policy and develop a

comprehensive POPIA Procedure Manual governing the management and processing of

personal information within the NLC. The Procedure Manual shall, inter alia, address the

following:

i. Data collection processes, including the nature and categories of data collected, lawful basis for

processing, consent requirements, purpose specification, minimality, and transparency

obligations;

ii. Data access, integrity, and accuracy controls, including measures to ensure that personal

information remains complete, accurate, reliable, and regularly updated;

iii. Data usage limitations and processing restrictions, including lawful processing parameters,

relevance, necessity, authorisation requirements, and purpose limitations;

iv. Data storage and retention practices, including physical storage, off-site storage, electronic

repositories, backup protocols, cloud-based storage environments, and records management

controls;

v. Data security safeguards, including physical, administrative, technical, electronic, network,

4 | P a g e

\\

vi. cybersecurity, password management, access control, and disaster recovery measures;

vii. Disclosure and information-sharing protocols, including lawful disclosure requirements, consent

management, data subject notification procedures, and the handling of requests for access to

information;

viii. Roles, responsibilities, and accountability obligations applicable to executives, senior

management, the Information Officer, Deputy Information Officers, employees processing

personal information, contractors, operators, service providers, and suppliers;

ix. Complaint management and escalation procedures, including reporting, investigation,

transparency, and legal compliance requirements;

x. Records retention and archiving schedules; and

xi. Data destruction and disposal procedures and schedules consistent with applicable legislative

and regulatory requirements.

h) Develop and implement a comprehensive POPIA awareness and capacity-building programme,

including staff awareness initiatives, induction training for new employees, periodic refresher

training, and targeted compliance training for all relevant personnel; and

i) Conduct formal training workshops on the POPIA Compliance Framework and related

governance obligations for all relevant officials and employees of the NLC.

6. Proposal Requirements

6.1. Prospective Service Providers are required to submit a comprehensive proposal which, at a minimum,

shall include the following:

6.1.1. A detailed project implementation plan, clearly outlining the methodology, key activities, deliverables,

milestones, dependencies, governance structure, and realistic timelines for each phase of the

assignment, including commencement and completion dates;

6.1.2. A fully itemised commercial proposal setting out the proposed professional fee structure, including

applicable hourly rates, daily rates, unit rates (where applicable), cost breakdown per deliverable or

workstream, and any other ancillary or disbursement costs, together with a clear indication of value-

added tax (VAT) where applicable; and

5 | P a g e

\\

6.1.3. A minimum of five (5) recent, traceable reference letters from clients for whom similar services have

been rendered, which letters must not be older than six (6) months at the time of submission, and must

confirm the scope of work, period of engagement, and level of satisfaction with services rendered.

7. Reporting requirements

7.1. The Service Provider shall submit detailed monthly progress reports to the National Lotteries

Commission, which shall, inter alia, reflect the status of implementation, key deliverables achieved,

risks identified, mitigation measures undertaken, and any deviations from the approved project plan.

7.2. The Service Provider shall participate in bi-weekly progress review meetings with the duly appointed

representative(s) of the NLC, at which meetings the Service Provider shall present updates on

progress, address queries, report on challenges encountered, and agree on corrective actions and

next steps to ensure successful implementation of the assignment.

8. Duration of the contract

8.1. The expected duration of the contract is six months from the time of commencement date

and may be effective on the date of appointment, the date of signing of a service level

agreement (SLA), or as directed and at the discretion of the NLC. The successful bidder will

be expected to commence work from the date of appointment until the last item has been

delivered, as per the delivery dates to be communicated with the appointed bidder/s on an

as and when required basis.

9. Compulsory briefing session

9.1. No briefing session

Section 2: notice to bidders

1. Terms and conditions of RFQ

1.1 This document may contain confidential information that is the property of the NLC.

1.2 No part of the contents may be used, copied, disclosed, or conveyed in whole or in part to

any party in any manner whatsoever other than for preparing a proposal in response to this

RFP without prior written permission from the NLC.

1.3 All copyright and intellectual property herein vests with the NLC.

6 | P a g e

\\

1.4 Late and incomplete submissions will not be accepted.

1.5 No services must be rendered, or goods delivered before an official NLC Purchase Order

form has been received.

1.6 This RFP will be evaluated in terms of the 80/20 preference point system

1.7 Suppliers are required to register on the Central Supplier Database (CSD) at www.csd.gov.za.

1.8 Suppliers must provide their CSD registration number (and attach a CSD Registration report) and

ensure that tax matters are compliant.

1.9 All questions regarding this RFP must be forwarded to [email protected]. All enquiries

to be responded within 3 days of receiving the enquiry.

2. General rules and instructions

2.1 News and press releases

2.1.1. Bidders or their agents shall not make any news releases concerning this RFP or the awarding of the

same or any resulting agreement(s) without the consent of, and then only in co-ordination with, the

NLC.

2.2 Precedence of documents

2.2.1 This RFP consists of a number of sections. Where there is a contradiction in terms between the

clauses, phrases, words, stipulations, or terms and herein referred to generally as stipulations in this

RFP and the stipulations in any other document attached hereto, or the RFP submitted hereto, the

relevant stipulations in this RFP shall take precedence.

2.2.2 Where this RFP is silent on any matter, the relevant stipulations addressing such matter, and which

appear in section 217 of the constitution of the republic shall take precedence. Bidders shall refrain

from incorporating any additional stipulations in its proposal submitted in terms hereof other than in

the form of a clearly marked recommendation that the NLC may in its sole discretion elect to import

or to ignore. Any such inclusion shall not be used for any purpose of interpretation unless it has been

so imported or acknowledged by the NLC.

7 | P a g e

\\

2.2.3 It remains the exclusive domain and election of the NLC as to which of these stipulations are

applicable and to what extent. Bidders are hereby acknowledging that the decision of the

commission in this regard is final and binding. The onus to enquire and obtain clarity in this regard

rests with the Bidder(s). The Bidder(s) shall take care to restrict its enquiries in this regard to the

most reasonable interpretations required to ensure the necessary consensus.

2.3 Preferential procurement reform

2.3.1 The commission supports B-BBEE as an essential ingredient of its business. In accordance with

government policy, the NLC insists that the private sector demonstrates its commitment and track

record to B-BBEE in the areas of ownership (shareholding), skills transfer, employment equity and

procurement practices (SMME Development) etc.

2.4 National Industrial Participation Programme

2.4.1 The Industrial Participation policy, which was endorsed by Cabinet on 30 April 1997, applies to

contracts that have imported content. The NIP is obligatory and therefore must be complied with.

2.4.2 Bidders are required to sign and submit the Standard Bidding Document (SBD).

2.5 Language

2.5.1 Bids must be in English language.

2.6 Gender

2.6.1 Any word implying any gender shall be interpreted to imply all other genders.

2.7 Headings

2.7.1 Headings are incorporated into this RFP document and submitted in response thereto, for ease of

reference only and shall not form part thereof for any purpose of interpretation or for any other

purpose.

8 | P a g e

\\

2.8 Occupational Injuries and Diseases Act

2.8.1 The Bidder warrants that all its employees (including the employees of any sub-contractor that may

be appointed) are covered in terms of the Compensation for Occupational Injuries and Diseases Act

and that the cover shall remain in force for the duration of the adjudication of this RFP

and/ or subsequent agreement. The commission reserves the right to request the Bidder to submit

documentary proof of the Bidder’s registration and “good standing” with the Compensation Fund, or

similar proof acceptable to the commission.

2.9 Processing of the Bidder’s Personal Information

2.9.1 All Personal Information of the Bidder, its employees, representatives, associates and sub-

contractors (“Bidder Personal Information”) required under this RFP is collected and processed for

the purpose of assessing the content of its tender proposal and awarding the bid. The Bidder is

advised that Bidder Personal Information may be passed on to third parties to whom the commission

is compelled by law to provide such information. For example, where appropriate, the commission is

compelled to submit information to the National Treasury’s Database of Restricted Suppliers.

2.9.2 All Personal Information collected will be processed in accordance with POPIA and with the

commission Data Privacy Policy.

2.9.3 The following persons will have access to the Personal Information collected:

2.9.4 The commission personnel participating in procurement/award procedures;

2.9.5 Members of the public: within seven working days from the time the bid is awarded, the following

information will have to be made available on the National Treasury’s e-Tender portal:

2.9.5.1 contract description and bid number;

2.9.5.2 names of the successful bidder(s) and preference points claimed;

2.9.5.3 the contract price(s) (if possible);

2.9.5.4 contract period;

2.9.5.5 names of directors; and

2.9.5.6 date of completion/award.

2.9.6 The commission will ensure that the rights of the Bidder and of its employees and representatives

(i.e., the right of access and the right to rectify) are effectively guaranteed in accordance with the

procedures as specified in the commission PAIA manual.

2.9.7 In signing this document, the Bidder consents to the use of its Personal Information for the purposes

9 | P a g e

\\

2.9.8 as specified in section 2.9.1 above.

3. Validity Period

3.1 The Commission requires a validity period of 120 Days from date of closing against this RFP.

3.2 Bidders are to note that they may be requested to extend the validity period of their bids, on the same

terms and conditions, if the internal evaluation process is not finalised within the validity period.

4. National Treasury’s Central Supplier Database

4.1 Bidders are required to self-register on National Treasury’s Central Supplier Database (CSD) which

has been established to centrally administer supplier information for all organs of state and facilitate

the verification of certain key supplier information.

4.2 The Commission may not award business to a bidder who has failed to register on the CSD.

4.3 Only foreign suppliers with no local registered entity need not register on the CSD.

4.4 The CSD can be accessed at https://secure.csd.gov.za/

5. Confidentiality

5.1 Bids submitted for this Request for Proposals will not be revealed to any other bidders and will be

treated as contractually binding.

5.2 The Commission reserves all the rights afforded to it by the POPIA in the processing of any of its

information as contained in Bid Proposals.

5.3 The Bidder acknowledges that it will obtain and have access to personal information of The NLC and

5.4 agrees that it shall only process the information disclosed by the NLC in terms of this bid award and

only for the purposes as detailed in this RFP and in accordance with any applicable law.

5.5 The Bidder shall notify the NLC in writing of any unauthorised access to personal information and the

information of a third party, through cybercrimes or suspected cybercrimes, in its knowledge and

report such crimes or suspected crimes to the relevant authorities in accordance with applicable laws,

after becoming aware of such.

10 | P a g e

\\

6. Communication

6.1 Specific queries relating to this RFP should be submitted [email protected], before the closing

date.

6.2 In the interest of fairness and transparency the NLC’s response to such a query may be made

available to other bidders.

6.3 It is prohibited for bidders to attempt, either directly or indirectly, to canvass any officer or employee

of the NLC in respect of this RFP between the closing date and the date of the award of the business.

6.4 Bidders found to be in collusion with one another will be automatically disqualified and restricted

from doing business with organs of state for a specified period.

7. Supplier performance

7.1 The National Lotteries Commission conducts regular performance reviews in accordance

with the requirements for the classification of the contract and or stakeholder by making use of supplier

evaluation forms. The evaluation is conducted against the deliverables or scope of the contract with a

minimum of an annual review done for contracts longer than a year and a review at completion of

contract for those contracts less than a year.

7.3. Ad-hoc performance reviews shall be conducted where non-performance is identified outside the

review period.

7.4. Non-performance will be addressed with at least a formal letter advising specific non-performing

areas and stating remedial action/s required within specific time frames. Non-adherence to remedial

actions shall lead to escalating performance management actions.

7.5. Any party to this agreement may request to participate in a joint performance review where

appropriate and seek continuous improvement opportunities.

Section 3: evaluation criteria

The following evaluation criteria phases will be considered in evaluating the proposals, being:

11 | P a g e

\\

Stage 1: Tender Closing and Opening

1.1. Tender closing details

The closing date for submission is 09 June 2026 Standard South African Time. Submission

of this tender is online via e-tender portal. No emails or physical submission will be accepted.

See link below: https://www.etenders.gov.za/.

The onus remains with the bidder to ensure successful submission of their bids on

the e-tender portal. Any discrepancies must be resolved with the National Treasury

as the custodians of the E-Tenders portal.

1.2. Bid Formats

Bid submissions must be submitted in a PDF format that is protected from any modifications,

deletions, or additions.

Stage 2: Administrative Compliance

All bid respondents must submit the relevant documents that comply with administrative

compliance, which will include the following:

Evaluation Criteria Supporting Document

SBD 1: Invitation to tender Fully Completed Standard Bidding

Document

SBD 6.1: Preference points claim form in terms of Fully Completed Standard Bidding

the preferential procurement regulations 2022 Document

Bidder’s tax compliance confirmation Valid SARS Tax Pin

Whether Bidders is registered on CSD. Only foreign Proof of Central Supplier Database (CSD)

suppliers with no local registered entity need not registration report.

register on the CSD

Original signed consent form in terms of the POPIA Consent Form

Protection of Personal Information Act No.

(Popia)

B-BBEE Certificate in terms of Codes of Good A valid B-BBEE Certificate/Sworn Affidavit.

Practice- Valid Consolidated valid BEE Certificate/Sworn

Affidavit in the case of JV

12 | P a g e

\\

Stage 3: Mandatory Compliance

All bid respondents must submit mandatory documents that comply with the bid requirements. Bids

that do not fully comply with the mandatory requirements will be disqualified and will not be

considered for further evaluation. The Mandatory Compliance Evaluation will include the following:

Evaluation Criteria Supporting Documents

Fully Completed and Signed Standard

1. SBD 4: Bidders must submit a fully completed

Bidding Document

declaration of interest form. Failure to declare

honestly will lead to the bidder being

disqualified.

2. Technical Proposal

Proposal

3. In the event of the bidder being in a joint venture JV Agreement must include the following:

(JV), a signed - A signed Joint Venture Agreement/

Memorandum of Understanding (MoU)

• The authorised representative to sign the

tender documents on behalf of all JV

members

• Company Registration & Statutory

Documents, and including

Bidder must submit price proposal according to the

Fully completed Pricing Schedule with

NLC Pricing Schedule

proposed fees.

See Annexure B

13 | P a g e

\\

Stage 4: Technical Evaluation

4.1 The following rating scale will be used to evaluate bid proposals:

Table 1: Rating Scale

Rating Definition Score

Excellent Exceeds the requirement. Exceptional demonstration by the bidder of the 5

relevant ability, understanding, experience, skills, resource, and quality

measures required to provide the goods / services. Response identifies

factors that will offer potential added value, with supporting evidence.

Good Satisfies the requirement with minor additional benefits. Above average 4

demonstration by the bidder of the relevant ability, understanding,

experience, skills, resource, and quality measures required to provide the

goods / services. Response identifies factors that will offer potential added

value, with supporting evidence.

Acceptable Satisfies the requirement. Demonstration by the bidder of the relevant 3

ability, understanding, experience, skills, resource, and quality measures

required to provide the goods / services, with supporting evidence.

Minor Satisfies the requirement with minor reservations. Some minor reservations 2

Reservations of the supplier’s relevant ability, understanding, experience, skills, resource

and quality measures required to provide the goods / services, with little or

no supporting evidence.

Serious Satisfies the requirement with major reservations. Considerable reservations 1

Reservations of the bidder’s relevant ability, understanding, experience, skills, resource,

and quality measures required to provide the goods / services, with little or

no supporting evidence.

Unacceptable Does not meet the requirement. Does not comply and/or insufficient 0

information provided to demonstrate that the bidder has the ability,

understanding, experience, skills, resource & quality measures required to

provide the goods / services, with little or no supporting evidence.

14 | P a g e

4.2 The evaluation for the Technical and Functional threshold will include the following:

Rating scale of 0 – 5 to be applied.

Ensure that the proposal clearly designates who the proposed team will be for scoring purposes below.

EVALUATION CRITERIA Scoring Matrix % Weight

1. Written reference letters 20%

Bidders must provide reference letters for similar work (POPIA

• 5 Points – 5 or more valid reference letters with

Implementation) that was carried out in the past 5 years from the closing supporting PO, all within the last 5 years

date of the bid.

• 4 Points – 4 valid reference letters with PO, within the

Letters must include the company name, contact name, email address, last 5 years

phone number, duration of the contract, value of the contract, a brief

• 3 Points – 3 valid reference letters with PO, within the

description of the services provided. The reference letters must be on the last 5 years

client’s letterhead and must be dated and signed.

• 2 Points – 2 valid reference letters with PO, within the

last 5 years

N.B. ALL REFERENCE LETTERS MUST BE ACCOMPANIED BY

• 1 Point – 1 valid reference letter with PO, within the

PURCHASE ORDER (PO) last 5 years

• 0 Points – No reference letters submitted, or letters do

Multiple reference letters from the same state entity will be not meet the requirements

regarded as one reference for evaluation purposes.

Only references for similar work completed within the last 5 years

will be accepted.

15 | P a g e

EVALUATION CRITERIA Scoring Matrix % Weight

10% 2. Company experience

Company profile of not more than 5 pages clearly indicating the

• 5 Points - 5 years and above experience in

number of years in business providing the required services implementing POPIA

• 4 Points -Above 4 years and up to and inclusive of

The Bidder must provide details of experience as a service provider 5 years of experience in in implementing POPIA

able to provide the required services by, bidder, experienced in

• 3- Points- Above 3 years and up to and inclusive of

providing POPIA implementation services as specified under scope 4 years' experience in in implementing POPIA

of work of this document

• 2 Points- Above 2 years and up to and inclusive 3

years' experience in in implementing POPIA

Use Annexure A to complete and attach Company Profile (maximum 5

• 0 Points -Less than 2 years' experience in in

pages) implementing POPIA

3. Methodology approach and execution plan 50%

16 | P a g e

EVALUATION CRITERIA Scoring Matrix % Weight

50 %Project Implementation Plan (Project Execution) The Rating Scale of 1 – 5 on Table 1 above to be applied

5 Points - Exceeds the requirement. Exceptional

• Bidders are required to submit the proposed implementation plan demonstration by the bidder of the relevant ability,

to execute the in implementing POPIA understanding, experience, skills, resource, and quality

measures required to provide the goods / services.

Response identifies factors that will offer potential added

value, with supporting evidence.

4 Points - Satisfies the requirement with minor additional

benefits. Above average demonstration by the bidder of the

relevant ability, understanding, experience, skills, resource,

and quality measures required to provide the goods /

services. Response identifies factors that will offer potential

added value, with supporting evidence .

3 Points - Satisfies the requirement. Demonstration by the

bidder of the relevant ability, understanding, experience,

skills, resource, and quality measures required to provide

the goods / services, with supporting evidence.

2 Points - Satisfies the requirement with minor

reservations. Some minor reservations of the supplier’s

relevant ability, understanding, experience, skills, resource

and quality measures required to provide the goods /

services, with little or no supporting evidence.

17 | P a g e

EVALUATION CRITERIA Scoring Matrix % Weight

1 Points - Satisfies the requirement with major

reservations. Considerable reservations of the bidder’s

relevant ability, understanding, experience, skills, resource,

and quality measures required to provide the goods /

services, with little or no supporting evidence.

0 Points - Does not meet the requirement. Does not comply

and/or insufficient information provided to demonstrate that

the bidder has the ability, understanding, experience, skills,

resource & quality measures required to provide the goods

/ services, with little or no supporting evidence.

20%Account Manager’s Experience

The bidder must provide the Account Manager’s updated CV, including

• 5 Points – Above 5 years of relevant POPIA

relevant qualifications and at least three (3) traceable references, Implementation experience

demonstrating experience in managing the implementation of POPIA

• 4 Points – more than 4 years and up 5 years of

relevant POPIA Implementation Experience

• 3 Points – more than 3 years and up 4 years of

relevant POPIA Implementation experience

• 2 Points – more than 2 and up to 3 years of relevant

POPIA Implementation Experience

• 1 Point – 1- up to 2 years of relevant POPIA

Implementation Experience

• 0 Point – Less than 1 years or no CV submitted

18 | P a g e

EVALUATION CRITERIA Scoring Matrix % Weight

Total: 100%

Minimum threshold score 75 %

Only bidders that score above 75% for the functional evaluation criteria will be further considered in the process for further evaluation.

19 | P a g e

Stage 5: Pricing and Specific Goals

Pricing Schedule: Please refer to Annexure B. The evaluation for Pricing and Special goal will include the

following:

Maximum

Sub - points

points for Relevant

Specific Goals for specific

specific Evidence

goals

goals

1. Procurement from entities who are Black Owned Copies of

Tenderer who has 100% black Ownership 8 ID’s/ CIPC

Report CSD

Tenderer who has 51% to 99% black ownership 4 8 Recent

ReportTenderer who has less than 51% black ownership 0

2. Procurement from entities who are Women Owned

Bid response documents must be submitted via below link

The bid document must be submitted via E-TENDER SUBMISSION - https://www.etenders.gov.za/

Bidding procedure enquiries may be directed technical enquiries may be directed to:

CONTACT PERSON Supply Chain CONTACT PERSON Penelope Soyingwa

Management

Telephone number 012 432 1302 telephone number 012 432 1414

Facsimile number facsimile number

E-MAIL ADDRESS E-MAIL ADDRESS [email protected]

Supplier information

Name of bidder

Postal address

Street address

Telephone number code number

Cellphone number

Facsimile number code number

E-mail address

VAT registration

Number

Supplier compliance tax central supplier

STATUS COMPLIANCE DATABASE No:

System pin: maaa

Are you the yes NO yes NO

Accredited are you a foreign based

[If yes encloserepresentative in supplier for the goods

Proof] [if yes, answersouth africa for /services offered? Questionnaire

The goods /services below]

Offered?

Questionnaire to bidding foreign suppliers

Yes NO is the entity a resident of the republic of south africa (RSA)?

Yes NO does the entity have a branch in the RSA?

Yes NO does the entity have a permanent establishment in the RSA?

Yes NO does the entity have any source of income in the RSA?

Yes NO is the entity liable in the RSA for any form of taxation

If the answer is “NO” to all of the above, then IT is not a requirement to register

Fora tax compliance status system pincode from the south african revenue

Service (SARS) and if not register as per 1.3 Below.

Part b

Terms and conditions for bidding

1. Bid submission:

1.1. Bids must be delivered by the stipulated time to the correct address. Late bids will not be

Accepted for consideration.

1.2. All bids must be submitted on the official forms provided (not to be re-typed) or in the

Manner prescribed in the bid document.

1.3. This bid is subject to the preferential procurement policy framework act, 2000 and the

Preferential procurement regulations, the general conditions of contract (gcc) and, if

Applicable, any other special conditions of contract.

1.4. The successful bidder will be required to fill in and sign a written contract form (sbd7).

2. Tax compliance requirements

2.1 Bidders must ensure compliance with their tax obligations.

2.2 Bidders are required to submit their unique personal identification number (pin) issued by SARS to enable

The organ of state to verify the taxpayer’s profile and tax status.

2.3 Application for tax compliance status (tcs) pin may be made via e-filing through the SARS website

Www.SARS.GOV.ZA.

2.4 Bidders may also submit a printed tcs certificate together with the bid.

2.5 In bids where consortia / joint ventures / sub-contractors are involved; each party must submit a

Separate tcs certificate / pin / csd number.

2.6 Where NO tcs pin is available but the bidder is registered on the central supplier database (csd), a csd

Number must be provided.

2.7 NO bids will be considered from persons in the service of the state, companies with directors who

Are persons in the service of the state, or close corporations with members persons in the service

Of the state.”

Nb: failure to provide / or comply with any of the above particulars may render the bid invalid.

Signature of bidder: ...................................................

Capacity under which this bid is signed: ...................................................

(Proof of authority must be submitted e.g. company resolution)

Date: ...................................................

Bidder’s disclosure (sbd 4)

1 purpose of the form

Any person (natural or juristic) may make an offer or offers in terms of this invitation to bid. In line

with the principles of transparency, accountability, impartiality, and ethics as enshrined in the

Constitution of the Republic of South Africa and further expressed in various pieces of legislation,

it is required for the bidder to make this declaration in respect of the details required hereunder.

Where a person/s are listed in the Register for Tender Defaulters and / or the List of Restricted

Suppliers, that person will automatically be disqualified from the bid process.

Bidder’s declaration

1.1 Is the bidder, or any of its directors / trustees / shareholders / members / partners

or any person having a controlling interest1 in the enterprise, employed by the state?

Yes/no

1.1.1 If so, furnish particulars of the names, individual identity numbers, and, if applicable,

state employee numbers of sole proprietor/ directors / trustees / shareholders /

members/ partners or any person having a controlling interest in the enterprise, in table

below.

Full Name Identity Number Name of State

institution

1 the power, by one person or a group of persons holding the majority of the equity of an enterprise, alternatively, the person/s having the

deciding vote or power to influence or to direct the course and decisions of the enterprise.

1.1.2 Do you, or any person connected with the bidder, have a relationship with any person

who is employed by the procuring institution?

Yes/no

1.1.3 If so, furnish particulars:

.............................................................................................

.............................................................................................

1.2 Does the bidder or any of its directors / trustees / shareholders / members / partners or

any person having a controlling interest in the enterprise have any interest in any other

related enterprise whether or not they are bidding for this contract? YES/NO

1.2.1 If so, furnish particulars:............................................................................

.......................................................................................................................

terms and conditions, if the internal evaluation process is not finalised within the validity period.

1.6 This RFP will be evaluated in terms of the 80/20 preference point system

particular emphasis on poverty alleviation and the reduction of inequality, in alignment with the

• 2 Points – more than 2 and up to 3 years of relevant

EVALUATION CRITERIA Scoring Matrix % Weight

Minimum threshold score 75 %

Only bidders that score above 75% for the functional evaluation criteria will be further considered in the process for further evaluation.

Stage 5: Pricing and Specific Goals

Pricing Schedule: Please refer to Annexure B. The evaluation for Pricing and Special goal will include the

Sub - points

points for Relevant

Specific Goals for specific

Total points for specific goals 20

Stage 6: Due Diligence, Contract and Award

The stage is for negotiation after receipt of formal tenders and before the conclusion of contracts with

Section 3: evaluation criteria

The following evaluation criteria phases will be considered in evaluating the proposals, being

Stage 1: Tender Closing and Opening

Stage 2: Administrative Compliance

Evaluation Criteria Supporting Document

SBD 6.1: Preference points claim form in terms of Fully Completed Standard Bidding

Stage 3: Mandatory Compliance

considered for further evaluation. The Mandatory Compliance Evaluation will include the following

Evaluation Criteria Supporting Documents

Stage 4: Technical Evaluation

1.3 All copyright and intellectual property herein vests with the NLC.

6 | P a g e

\\

1.4 Late and incomplete submissions will not be accepted.

1.5 No services must be rendered, or goods delivered before an official NLC Purchase Order

form has been received.

1.6 This RFP will be evaluated in terms of the 80/20 preference point system

1.7 Suppliers are required to register on the Central Supplier Database (CSD) at www.csd.gov.za.

1.8 Suppliers must provide their CSD registration number (and attach a CSD Registration report) and

ensure that tax matters are compliant.

1.9 All questions regarding this RFP must be forwarded to [email protected]. All enquiries

to be responded within 3 days of receiving the enquiry.

relevant stipulations in this RFP shall take precedence.

2.2.2 Where this RFP is silent on any matter, the relevant stipulations addressing such matter, and which

appear in section 217 of the constitution of the republic shall take precedence. Bidders shall refrain

from incorporating any additional stipulations in its proposal submitted in terms hereof other than in

the form of a clearly marked recommendation that the NLC may in its sole discretion elect to import

or to ignore. Any such inclusion shall not be used for any purpose of interpretation unless it has been

so imported or acknowledged by the NLC.

7 | P a g e

\\

2.2.3 It remains the exclusive domain and election of the NLC as to which of these stipulations are

applicable and to what extent. Bidders are hereby acknowledging that the decision of the

commission in this regard is final and binding. The onus to enquire and obtain clarity in this regard

rests with the Bidder(s). The Bidder(s) shall take care to restrict its enquiries in this regard to the

most reasonable interpretations required to ensure the necessary consensus.

2.3 Preferential procurement reform

2.3.1 The commission supports B-BBEE as an essential ingredient of its business. In accordance with

government policy, the NLC insists that the private sector demonstrates its commitment and track

record to B-BBEE in the areas of ownership (shareholding), skills transfer, employment equity and

procurement practices (SMME Development) etc.

2.4 National Industrial Participation Programme

2.4.1 The Industrial Participation policy, which was endorsed by Cabinet on 30 April 1997, applies to

contracts that have imported content. The NIP is obligatory and therefore must be complied with.

2.4.2 Bidders are required to sign and submit the Standard Bidding Document (SBD).

2.5 Language

2.5.1 Bids must be in English language.

2.6 Gender

2.6.1 Any word implying any gender shall be interpreted to imply all other genders.

2.7 Headings

2.7.1 Headings are incorporated into this RFP document and submitted in response thereto, for ease of

reference only and shall not form part thereof for any purpose of interpretation or for any other

purpose.

8 | P a g e

\\

2.8 Occupational Injuries and Diseases Act

2.8.1 The Bidder warrants that all its employees (including the employees of any sub-contractor that may

be appointed) are covered in terms of the Compensation for Occupational Injuries and Diseases Act

and that the cover shall remain in force for the duration of the adjudication of this RFP

and/ or subsequent agreement. The commission reserves the right to request the Bidder to submit

documentary proof of the Bidder’s registration and “good standing” with the Compensation Fund, or

similar proof acceptable to the commission.

2.9 Processing of the Bidder’s Personal Information

2.9.1 All Personal Information of the Bidder, its employees, representatives, associates and sub-

contractors (“Bidder Personal Information”) required under this RFP is collected and processed for

the purpose of assessing the content of its tender proposal and awarding the bid. The Bidder is

advised that Bidder Personal Information may be passed on to third parties to whom the commission

is compelled by law to provide such information. For example, where appropriate, the commission is

compelled to submit information to the National Treasury’s Database of Restricted Suppliers.

2.9.2 All Personal Information collected will be processed in accordance with POPIA and with the

commission Data Privacy Policy.

2.9.3 The following persons will have access to the Personal Information collected:

2.9.4 The commission personnel participating in procurement/award procedures;

2.9.5 Members of the public: within seven working days from the time the bid is awarded, the following

information will have to be made available on the National Treasury’s e-Tender portal:

2.9.5.1 contract description and bid number;

2.9.5.2 names of the successful bidder(s) and preference points claimed;

2.9.5.3 the contract price(s) (if possible);

2.9.5.4 contract period;

2.9.5.5 names of directors; and

2.9.5.6 date of completion/award.

2.9.6 The commission will ensure that the rights of the Bidder and of its employees and representatives

(i.e., the right of access and the right to rectify) are effectively guaranteed in accordance with the

procedures as specified in the commission PAIA manual.

2.9.7 In signing this document, the Bidder consents to the use of its Personal Information for the purposes

9 | P a g e

\\

2.9.8 as specified in section 2.9.1 above.

risks identified, mitigation measures undertaken, and any deviations from the approved project plan.

7.2. The Service Provider shall participate in bi-weekly progress review meetings with the duly appointed

representative(s) of the NLC, at which meetings the Service Provider shall present updates on

progress, address queries, report on challenges encountered, and agree on corrective actions and

next steps to ensure successful implementation of the assignment.

advertised

RFQs Validity Period The validity period of the quotation requested must be 120

days from the closing date.

\\

Section 1: background, overview and scope of requirements

1. Introduction

1.1. The National Lotteries Commission (“NLC”) is a statutory regulatory authority established in terms of

the Lotteries Act , as amended (“the Lotteries Act”), with the mandate to regulate the National

5. Scope of work

5.1. The appointed Service Provider shall, inter alia, be required to render the following services:

a) Conduct a comprehensive gap analysis to assess the National Lotteries Commission’s level of

compliance with the Protection of Personal Information Act (“POPIA”), including the

identification of regulatory, operational, governance, and procedural deficiencies;

b) Map and document all personal information processing activities undertaken within the NLC,

including the collection, recording, storage, dissemination, retention, archiving, and destruction

of personal information across all business units and operational processes;

3 | P a g e

\\

c) Conduct a comprehensive POPIA compliance audit and assessment of the NLC’s existing

systems, policies, procedures, controls, governance mechanisms, and operational processes

utilised in the processing of personal information;

d) Undertake a privacy impact assessment and compliance impact analysis to determine whether

adequate safeguards, measures, standards, and controls are in place to ensure compliance with

the conditions for the lawful processing of personal information as contemplated in POPIA;

e) Conduct a status risk assessment and information governance audit to determine the NLC’s level

of compliance with applicable records management, information governance, cybersecurity, and

data protection requirements;

f) Develop a comprehensive POPIA Implementation Framework, Compliance Roadmap, and

reporting structures, and compliance monitoring measures;

g) Review, refine, and where necessary enhance the NLC’s existing POPIA Policy and develop a

comprehensive POPIA Procedure Manual governing the management and processing of

personal information within the NLC. The Procedure Manual shall, inter alia, address the

following:

i. Data collection processes, including the nature and categories of data collected, lawful basis for

processing, consent requirements, purpose specification, minimality, and transparency

obligations;

ii. Data access, integrity, and accuracy controls, including measures to ensure that personal

information remains complete, accurate, reliable, and regularly updated;

iii. Data usage limitations and processing restrictions, including lawful processing parameters,

relevance, necessity, authorisation requirements, and purpose limitations;

iv. Data storage and retention practices, including physical storage, off-site storage, electronic

repositories, backup protocols, cloud-based storage environments, and records management

controls;

v. Data security safeguards, including physical, administrative, technical, electronic, network,

4 | P a g e

\\

vi. cybersecurity, password management, access control, and disaster recovery measures;

vii. Disclosure and information-sharing protocols, including lawful disclosure requirements, consent

management, data subject notification procedures, and the handling of requests for access to

information;

viii. Roles, responsibilities, and accountability obligations applicable to executives, senior

management, the Information Officer, Deputy Information Officers, employees processing

personal information, contractors, operators, service providers, and suppliers;

ix. Complaint management and escalation procedures, including reporting, investigation,

transparency, and legal compliance requirements;

x. Records retention and archiving schedules; and

xi. Data destruction and disposal procedures and schedules consistent with applicable legislative

and regulatory requirements.

h) Develop and implement a comprehensive POPIA awareness and capacity-building programme,

including staff awareness initiatives, induction training for new employees, periodic refresher

training, and targeted compliance training for all relevant personnel; and

i) Conduct formal training workshops on the POPIA Compliance Framework and related

governance obligations for all relevant officials and employees of the NLC.

3.1 The Commission requires a validity period of 120 Days from date of closing against this RFP.

3.2 Bidders are to note that they may be requested to extend the validity period of their bids, on the same

terms and conditions, if the internal evaluation process is not finalised within the validity period.

4. National Treasury’s Central Supplier Database

4.1 Bidders are required to self-register on National Treasury’s Central Supplier Database (CSD) which

has been established to centrally administer supplier information for all organs of state and facilitate

the verification of certain key supplier information.

4.2 The Commission may not award business to a bidder who has failed to register on the CSD.

4.3 Only foreign suppliers with no local registered entity need not register on the CSD.

4.4 The CSD can be accessed at https://secure.csd.gov.za/

I CERTIFY THAT THE INFORMATION FURNISHED IN PARAGRAPHS 1, 2 and 3 ABOVE IS

regarded as one reference for evaluation purposes.

Only references for similar work completed within the last 5 years

will be accepted.

15 | P a g e

EVALUATION CRITERIA Scoring Matrix % Weight

10% 2. Company experience

Company profile of not more than 5 pages clearly indicating the

• 5 Points - 5 years and above experience in

number of years in business providing the required services implementing POPIA

• 4 Points -Above 4 years and up to and inclusive of

The Bidder must provide details of experience as a service provider 5 years of experience in in implementing POPIA

able to provide the required services by, bidder, experienced in

• 3- Points- Above 3 years and up to and inclusive of

providing POPIA implementation services as specified under scope 4 years' experience in in implementing POPIA

of work of this document

• 2 Points- Above 2 years and up to and inclusive 3

years' experience in in implementing POPIA

Use Annexure A to complete and attach Company Profile (maximum 5

• 0 Points -Less than 2 years' experience in in

pages) implementing POPIA

3. Methodology approach and execution plan 50%

16 | P a g e

EVALUATION CRITERIA Scoring Matrix % Weight

50 %Project Implementation Plan (Project Execution) The Rating Scale of 1 – 5 on Table 1 above to be applied

• Bidders are required to submit the proposed implementation plan demonstration by the bidder of the relevant ability,

to execute the in implementing POPIA understanding, experience, skills, resource, and quality

measures required to provide the goods / services.

of openness, accountability, transparency, and good governance.

2. Background

2.1. The National Lotteries Commission hereby invites suitably qualified, experienced, and competent

service providers to submit proposals for the provision of professional services relating to the

embedding, operationalisation, and implementation of the Protection of Personal Information Act (“POPIA”) across the organisation.

2.2. The NLC performs a wide range of statutory and regulatory functions which necessarily entail the

collection, processing, storage, dissemination, and safeguarding of personal information, including,

inter alia, matters pertaining to employment and human resources administration, grant funding and

adjudication processes, stakeholder engagements, as well as the regulation and oversight of lotteries

and sports pools.

2.3. The NLC has undertaken a number of foundational initiatives aimed at facilitating compliance with

but are not limited to, the following:

2.3.1. A POPIA Compliance Risk Management Plan (“CRMP”);

2.3.2. A POPIA Policy;

2.3.3. A draft POPIA Standard Operating Procedure;

2 | P a g e

\\

2.3.4. A Data Management Policy;

2.3.5. An approved Records Management Plan;

2.3.6. An approved File Plan;

2.3.7. An Information Classification Policy; and

2.4. The incorporation of POPIA-related and data protection clauses within its contractual agreements and

operator arrangements.

3. Purpose

3.1. The purpose of this Request for Quotation (“RFQ”) is to invite suitably qualified, experienced, and

capable service providers to submit proposals for the provision of professional services relating to the

embedding, operationalisation, and implementation of the Protection of Personal Information Act

(“POPIA”) within the National Lotteries Commission.

4.1. The objective of this Request for Quotations (“RFQ”) is to appoint a suitably qualified and experienced

service provider to, inter alia, undertake a comprehensive gap analysis, develop the requisite

governance, compliance, and implementation frameworks, and facilitate the effective operationalisation

and institutional embedding of the Protection of Personal Information Act (“POPIA”) across

all operational, regulatory, administrative, and governance activities of the National Lotteries

Excellent Exceeds the requirement. Exceptional demonstration by the bidder of the 5

relevant ability, understanding, experience, skills, resource, and quality

measures required to provide the goods / services. Response identifies

factors that will offer potential added value, with supporting evidence.

Good Satisfies the requirement with minor additional benefits. Above average 4

demonstration by the bidder of the relevant ability, understanding,

experience, skills, resource, and quality measures required to provide the

goods / services. Response identifies factors that will offer potential added

value, with supporting evidence.

Acceptable Satisfies the requirement. Demonstration by the bidder of the relevant 3

ability, understanding, experience, skills, resource, and quality measures

required to provide the goods / services, with supporting evidence.

Minor Satisfies the requirement with minor reservations. Some minor reservations 2

Reservations of the supplier’s relevant ability, understanding, experience, skills, resource

and quality measures required to provide the goods / services, with little or

no supporting evidence.

Serious Satisfies the requirement with major reservations. Considerable reservations 1

Reservations of the bidder’s relevant ability, understanding, experience, skills, resource,

and quality measures required to provide the goods / services, with little or

no supporting evidence.

Unacceptable Does not meet the requirement. Does not comply and/or insufficient 0

information provided to demonstrate that the bidder has the ability,

understanding, experience, skills, resource & quality measures required to

provide the goods / services, with little or no supporting evidence.

14 | P a g e

4.2 The evaluation for the Technical and Functional threshold will include the following:

Rating scale of 0 – 5 to be applied.

benefits. Above average demonstration by the bidder of the

relevant ability, understanding, experience, skills, resource,

and quality measures required to provide the goods /

services. Response identifies factors that will offer potential

added value, with supporting evidence .

bidder of the relevant ability, understanding, experience,

skills, resource, and quality measures required to provide

the goods / services, with supporting evidence.

reservations. Some minor reservations of the supplier’s

relevant ability, understanding, experience, skills, resource

and quality measures required to provide the goods /

services, with little or no supporting evidence.

17 | P a g e

EVALUATION CRITERIA Scoring Matrix % Weight

reservations. Considerable reservations of the bidder’s

relevant ability, understanding, experience, skills, resource,

and quality measures required to provide the goods /

services, with little or no supporting evidence.

and/or insufficient information provided to demonstrate that

the bidder has the ability, understanding, experience, skills,

resource & quality measures required to provide the goods

/ services, with little or no supporting evidence.

20%Account Manager’s Experience

The bidder must provide the Account Manager’s updated CV, including

• 5 Points – Above 5 years of relevant POPIA

relevant qualifications and at least three (3) traceable references, Implementation experience

demonstrating experience in managing the implementation of POPIA

• 4 Points – more than 4 years and up 5 years of

relevant POPIA Implementation Experience

• 3 Points – more than 3 years and up 4 years of

relevant POPIA Implementation experience

• 2 Points – more than 2 and up to 3 years of relevant

ANNEXURE A: COMPANY EXPERIENCE (to be completed by the bidder)

6.1. Prospective Service Providers are required to submit a comprehensive proposal which, at a minimum,

shall include the following:

6.1.1. A detailed project implementation plan, clearly outlining the methodology, key activities, deliverables,

milestones, dependencies, governance structure, and realistic timelines for each phase of the

assignment, including commencement and completion dates;

6.1.2. A fully itemised commercial proposal setting out the proposed professional fee structure, including

applicable hourly rates, daily rates, unit rates (where applicable), cost breakdown per deliverable or

workstream, and any other ancillary or disbursement costs, together with a clear indication of value-

added tax (VAT) where applicable; and

5 | P a g e

\\

6.1.3. A minimum of five (5) recent, traceable reference letters from clients for whom similar services have

been rendered, which letters must not be older than six (6) months at the time of submission, and must

confirm the scope of work, period of engagement, and level of satisfaction with services rendered.

• 0 Point – Less than 1 years or no CV submitted

18 | P a g e

EVALUATION CRITERIA Scoring Matrix % Weight

Total: 100%

Minimum threshold score 75 %

Only bidders that score above 75% for the functional evaluation criteria will be further considered in the process for further evaluation.

19 | P a g e

Stage 5: Pricing and Specific Goals

Pricing Schedule: Please refer to Annexure B. The evaluation for Pricing and Special goal will include the

following:

ANNEXURE B: PRICING SCHEDULE TEMPLATE (see attached)

Please provide rates (VAT Inclusive) for the rendering of services for the National Lotteries Commission.