Appointment of a service provider for a 12-Month insurance claims administrator learnership programme with strict security and data protection requirements

Closing date and time: 08 July 2026 at 11:00. RFQ validity period: 30 days from closing date. Expected service start: 12-month agreement begins from the date of the last signatory. Compulsory briefing/session: Not applicable.

Enquiries: Email [email protected] or contact Tshilidzi Lithole at 012 429 5886. Submission email: [email protected]. RAF reception hours: 07h45 to 16h00, Monday to Friday (for deliveries, if applicable).

Submit RFQ responses via email to: [email protected]. Late submissions will not be accepted. All Annexures (Standard Bidding Documents and Mandatory Evaluation documents) must be completed and signed. Collusive bidding or multiple submissions from entities with common directors/shareholders will result in disqualification. Suppliers with disabilities must provide a valid medical certificate. Only CSD-registered suppliers will be considered. If not contacted within 14 working days, consider the proposal unsuccessful. Prohibition of gifts/hospitality: Do not offer any gifts, hospitality, or benefits to RAF officials. Report any solicitation to the RAF fraud line at 0800 005919 or risk being restricted from conducting business with Organs of State.

Scope: Conduct a 12-month Insurance Claims Administrator Learnership Programme. Delivery: Fully online via MS Teams. Class times: 08:00–16:00. Number of learners: 12. Service Provider must: Roll out the programme online with learner support for those unfamiliar with online learning/MS Teams. Upload learners on QCTO systems (Learnership Agreement), assist with logbook completion, upload results, and ensure verification/submission of Statements of Results (SORs). Submit a Learnership rollout plan and meet with RAF’s Skills Development Facilitator (SDF) or Business Unit representatives to discuss and sign a Service Level Agreement (SLA). Commit to monthly progress reports for each learner and provide learner support as per SLA. Accreditation: Must be QCTO-accredited to offer the Insurance Claims Administrator Learnership (NQF Level 4, SAQA ID 96668, Learnership Code 32Q320085191314). Valid proof of accreditation must be submitted by closing date.

Pricing: All prices must be VAT-inclusive (if VAT-registered) and quoted in ZAR. VAT vendors must include VAT; failure to do so means the quoted price is deemed all-inclusive. Non-VAT-registered suppliers charging VAT will be disqualified. Only prices completed in the provided table will be accepted; missing prices lead to disqualification. No price changes allowed after Award Letter/PO issuance. Payments: Made per an agreed payment plan after meeting specified milestones. Final payment issued upon receipt of QCTO certificates.

Mandatory: CSD registration required. Tax compliance: Must be in order with SARS. B-BBEE: Points claimed for Preferential Procurement Specific Goals will be verified via CSD. Disability: Suppliers with disabilities must provide a valid medical certificate. Collusive behaviour or multiple submissions from linked entities will result in disqualification. Standard Bidding Documents: SBD 4 (Bidders Disclosure) and SBD 6.1 (PPR 2022) must be completed. Annexure A: Security Measures must be submitted.

Returnable Documents: The bidder must complete and submit the SBD 4 Bidder's Disclosure form. This is a mandatory returnable document.

Bidders are automatically disqualified if listed on the Register for Tender Defaulters or the List of Restricted Suppliers. Eligibility is contingent on truthful disclosure regarding state employment, conflicts of interest, and independent bidding. The bidder and all connected persons must not be involved in collusive activities or have improperly influenced the tender specifications.

Any person (natural or juristic) may make an offer or offers in terms of this invitation to bid. In line with the principles of transparency, accountability, impartiality, and ethics as enshrined in the Constitution of the Republic of South Africa and further expressed in various pieces of legislation, it is required for the bidder to make this declaration in respect of the details required hereunder.

No specific requirements found

The service provider must implement technical and organisational security measures to protect RAF’s confidential, private, personal, or sensitive information (files, data, or documents). This includes:

• Compliance with the Protection of Personal Information Act (POPIA).
• Secure handling, transportation, and storage of documents, including lockable containers and secure transportation systems.
• Maintaining accurate records of document locations, access history, and retention schedules.
• Secure retrieval protocols, including identity verification of requesters.
• Physical security measures: lockable cabinets, controlled access, fire suppression systems (e.g., CO2 fire extinguishers), and secure premises with surveillance, alarms, and 24/7 monitoring.
• Access control: Restrict document handling, viewing, or transport to authorised personnel only, with monitoring and logging of all access.
• Network security: Firewalls, intrusion detection, encryption, and regular system updates to protect digital storage systems.
• Data protection obligations: Safeguard against unauthorised access, disclosure, alteration, or destruction; report breaches to RAF immediately; impose confidentiality obligations on agents, subcontractors, or third parties.
• Cybersecurity standards: Robust measures against malware, phishing, and unauthorised access; encryption for data in transit and at rest; regular patching of systems.
• Incident reporting: Documented incident response plan; timely reporting of security incidents or breaches to RAF.
• Subcontractor oversight: Ensure subcontractors adhere to the same security and data protection standards; service provider remains responsible for their compliance.
• Audit and monitoring: RAF reserves the right to audit compliance; service provider must cooperate with assessments.

The service provider must comply with the following:

• Protection of Personal Information Act (POPIA) for handling personal and sensitive data.
• Data protection laws and regulations applicable to the processing of personal information.
• RAF’s security screening or vetting requirements for company directors and resources provided.
• Third-party service providers handling PII must be vetted for data protection policies and required to sign a data protection agreement.
• Maintain confidentiality obligations for all agents, subcontractors, or third parties with access to records.

Health and safety requirements for the service provider’s premises include:

• Installing a fire suppression system (e.g., CO2 fire extinguishers) to prevent damage or loss of documents and records in the event of a fire.
• Ensuring secure premises with a secure perimeter, controlled access, surveillance systems, secure doors, locks, and alarms to prevent unauthorised access.
• Implementing physical security measures to protect document storage facilities.

Contractual obligations include:

• Ensuring the physical security of all RAF records in possession, with controlled access points, surveillance cameras, and 24/7 monitoring.
• Protecting document storage facilities against unauthorised access.
• Reporting any real, attempted, or suspected physical security breaches to RAF, including providing CCTV footage, police reports, and alarm system records.
• Implementing network security measures such as firewalls, intrusion detection, and encryption to prevent unauthorised access or attacks.
• Access control: Grant access on a need-to-know basis; use strong authentication methods; regularly review and update access permissions.
• Data protection obligations: Handle and process personal/sensitive data in compliance with applicable laws; safeguard against unauthorised access, disclosure, alteration, or destruction; report data breaches to RAF immediately; ensure confidentiality for all agents, subcontractors, or third parties.
• Processing personal information in compliance with legislative and regulatory frameworks.
• Vetting third-party service providers handling PII for data protection policies and requiring signed data protection agreements.
• RAF reserves the right to conduct security screening or vetting of company directors and resources.
• Implementing robust cybersecurity measures (e.g., encryption for data in transit/at rest, regular system updates) to protect against cyber threats.
• Maintaining a documented incident response plan for data breaches and reporting incidents to RAF promptly.
• Ensuring subcontractors adhere to the same data protection and cybersecurity standards; service provider remains responsible for their compliance.
• Cooperating with RAF audits or assessments to evaluate compliance with data protection and cybersecurity standards.

Network security:

• Implement technical security measures such as firewalls, intrusion detection, and encryption to protect digital document storage systems.