Awarded Tender: Road accident fund gauteng request for quotation

Tender source analysis

What the tender required and what the award supports

Source material and existing AI analysis appear first. Supplier conclusions remain qualified by the evidence Tenders-SA holds.

Summary

The road accident fund (raf) seeks a service provider to deliver personal verification services over a 12-month period, with strict adherence to popia and robust security measures. The tender is open to suppliers capable of ensuring data protection, physical security, and cybersecurity compliance.

AI Document AnalysisMethodology5 documents

Document being processed

Review in progress

The information shown on this card is preliminary. Our procurement team is currently finalising the submission guidelines, evaluation criteria, technical specifications, financial requirements, and compliance sections so you have a clean, bid-ready summary to work from. Documents being finalised: SBD 6.1 IN TERMS OF PPR2022.docx, Standard Bidding Document (SDB) 4.doc, Annexure B - Bidders Client Reference.odt and 2 more. You don’t need to refresh — this page will pick up the updated review automatically.

DocumentSBD 6.1 IN TERMS OF PPR2022.docxCompliance review in progress

What the buyer was looking for

1Mandatory requirement

- Full compliance with the Protection of Personal Information Act (POPIA) for all verification services. - Secure facility with controlled access, surveillance, alarms, and fire suppression systems. - Strong access control, authentication, and regular permission reviews. - Robust cybersecurity measures including firewalls, encryption, and intrusion detection. - Documented incident response plan with prompt breach reporting to RAF. - Subcontractors must meet the same POPIA and security standards, with provider liability. - RAF may conduct security vetting of directors and assigned personnel.

Why it matters: The source identifies this as a mandatory or eligibility condition for a compliant bid.

No source document identifier is stored for this item.

Source: AI key requirements · requirements

Known supplier evidence

An award confirms appointment. It does not prove why a supplier was selected, that every qualification remains current, or that delivery was completed successfully.

DocumentAnnexure A - Security Measures.pdfCompliance review in progress

Description

Source: Annexure A - Security Measures.pdf

provisions of the Protection of Personal Information Act, .

The Service

Technical Specifications

Source: Annexure A - Security Measures.pdf

The service provider must comply with the Protection of Personal Information Act (POPIA) for all personal verification services. Key technical and operational requirements include:

Physical security: Secure facility with controlled access points, surveillance cameras, 24/7 monitoring, secure doors/locks/alarms, and fire suppression systems (e.g., CO2 fire extinguishers).
Access control: Grant access on a need-to-know basis, use strong authentication, and regularly review/update permissions.
Data protection: Handle and process personal/sensitive data in compliance with POPIA, implement safeguards against unauthorised access/disclosure/alteration/destruction, and immediately report breaches to the RAF.
Cybersecurity: Implement robust measures (firewalls, intrusion detection, encryption for data in transit/at rest), regularly update/patch systems, and use industry-standard encryption protocols.
Incident response: Maintain a documented incident response plan and report security incidents or breaches to the RAF promptly.
Subcontractors/third parties: Ensure subcontractors adhere to the same data protection and cybersecurity standards; the service provider remains responsible for their compliance.
Audit and monitoring: Cooperate with RAF audits/assessments to evaluate compliance with data protection and cybersecurity standards.
Vetting: RAF reserves the right to conduct security screening/vetting of company directors and resources provided.

Compliance Requirements

Source: Annexure A - Security Measures.pdf

Compliance with the Protection of Personal Information Act (POPIA) is mandatory. Additional requirements include:

Physical security measures for document storage (controlled access, surveillance, alarms, fire suppression).
Data protection obligations: Confidentiality of personal/confidential/sensitive data, including imposing obligations on agents/subcontractors/third parties.
Third-party vetting: Service providers handling PII must be screened/vetted for data protection policies and required to sign a data protection agreement.
RAF may conduct security screening/vetting of company directors and assigned resources.

Health & Safety

Source: Annexure A - Security Measures.pdf

the Service Provider should have policies and procedures in place to ensure that access is

controlled and monitored.

1.2.5 Fire Suppression

The Service Provider’s premises should have a fire suppression system or similar in place,

fire extinguishers with carbon dioxide, to prevent damage or loss of documents and records in

the event of a fire.

1.3 Security including secure facility.

The Service Provider ’s premises should have a secure perimeter with controlled access and

or surveillance systems. The premises should have secure doors, locks, and alarms to

prevent unauthorised access.

1.3.1 Physical Security

Contractual Terms

Source: Annexure A - Security Measures.pdf

security of the documents, including controlled access points, surveillance cameras, and or

24/7 security monitoring. The Service Provider must always ensure the physical security of

records in their possession. All document storage facilities must be adequately protected

against unauthorised access. Should there be any real, attempted, or suspected breach of

physical security the Service Provider will be obliged to inform the RAF and provide any

place, such as firewalls, intrusion detection, and encryption, to protect against unauthorised

access or attacks.

1.3.5 Access Control

Grant access on a need-to-know basis.
Use strong authentication methods to control access to systems and data.
Regularly review and update access permissions.

1.3.6 Data Protection Obligations

The Service Provider must handle and process personal and sensitive data in

compliance with applicable data protection laws and regulations.

Implement measures to safeguard data against unauthorised access, disclosure,

alteration, and destruction.

Inform the RAF immediately of any data breaches or incidents that may impact the

security of the information.

The Service Provider shall implement appropriate measures designed to ensure

the confidentiality of personal, confidential and sensitive date, including by

imposing confidentiality obligations on any of its agents or subcontractors, or any

third party who has received records.

processing of personal information.

Third-party service providers that handle PII on behalf of the organization should

be screening or vetted for their data protection policies and procedures and should

be required to sign a data protection agreement.

Raf reserve the right to conduct security screening or vetting for company directors

and resources provided.

1.3.7 Cybersecurity Standards:

The Service Provider is required to implement robust cybersecurity measures to

protect against cyber threats, including but not limited to malware, phishing, and

unauthorised access.

Use encryption for data in transit and at rest to ensure the confidentiality of

sensitive information. Utilise encryption protocols and algorithms that comply with

industry standards.

Regularly update and patch systems, software, and applications to address

security vulnerabilities.

1.3.8 Incident Reporting and Response:

The Service Provider must have a documented incident response plan to address

and mitigate data breaches promptly.

The Service Provider must report any security incidents or data breaches to RAF in

a timely manner.

1.3.9 Subcontractors and Third-Party Oversight

If subcontractors are engaged, the Service Provider must ensure that they also

adhere to the same data protection and cybersecurity standards outlined in this

policy.

The Service Provider is responsible for the actions and compliance of any sub-

contractors or third parties engaged in providing services to the RAF.

1.3.10 Audit and Monitoring

The RAF reserves the right to audit and monitor the Service Provider ’s compliance

with this policy.

The Service Provider must cooperate with any audits or assessments conducted

by RAF to evaluate compliance with data protection and cybersecurity standards.

Contract Awarded

Award Information

Winning Supplier

The road accident fund (raf) wishes to appoint a suitable service provider to provide personal verification services as and when required for a period of twelve (12) months

Award Details

Road Accident Fund

Organization Directors

Awards Won: MANAGED INTEGRITY EVALUATION

View Supplier Intelligence

What the tender required and what the award supports

PREFERENCE POINTS CLAIM FORM IN TERMS OF THE PREFERENTIAL PROCUREMENT REGULATIONS 2022

Returnable Documents: Submit all required forms as specified in the tender. Ensure completeness to avoid disqualification.

Preference Points Claim Form required in terms of the Preferential Procurement Regulations 2022.

Returnable Documents: Submit all required bid documents as specified in the tender. Failure to include mandatory documents may result in disqualification.

Bidders are requested to provide the required information in instances where you are currently or have previously rendered the required services:

Submit all returnable documents as specified in the tender. Failure to include required documents may result in disqualification.

Bidders must provide details of past or current experience in delivering Personal Verification Services. Include: client references, project scope, duration, and outcomes.

Service providers/suppliers should ensure that RFQ responses are emailed to the correct email address;

Submit RFQ responses via email to the correct email address. Ensure all returnable documents are included as specified in the RFQ.

Service providers must email RFQ responses to the designated email address. Ensure accuracy and completeness of submission.

provisions of the Protection of Personal Information Act, .

The Service

security of the documents, including controlled access points, surveillance cameras, and or

24/7 security monitoring. The Service Provider must always ensure the physical security of

records in their possession. All document storage facilities must be adequately protected

against unauthorised access. Should there be any real, attempted, or suspected breach of

physical security the Service Provider will be obliged to inform the RAF and provide any

place, such as firewalls, intrusion detection, and encryption, to protect against unauthorised

access or attacks.

3.5 Access Control

Grant access on a need-to-know basis.

Use strong authentication methods to control access to systems and data.

Regularly review and update access permissions.

3.6 Data Protection Obligations

The Service Provider must handle and process personal and sensitive data in

compliance with applicable data protection laws and regulations.

Implement measures to safeguard data against unauthorised access, disclosure,

alteration, and destruction.

Inform the RAF immediately of any data breaches or incidents that may impact the

security of the information.

The Service Provider shall implement appropriate measures designed to ensure

the confidentiality of personal, confidential and sensitive date, including by

imposing confidentiality obligations on any of its agents or subcontractors, or any

third party who has received records.

processing of personal information.

Third-party service providers that handle PII on behalf of the organization should

be screening or vetted for their data protection policies and procedures and should

be required to sign a data protection agreement.

Raf reserve the right to conduct security screening or vetting for company directors

and resources provided.

3.7 Cybersecurity Standards:

The Service Provider is required to implement robust cybersecurity measures to

protect against cyber threats, including but not limited to malware, phishing, and

unauthorised access.

Use encryption for data in transit and at rest to ensure the confidentiality of

sensitive information. Utilise encryption protocols and algorithms that comply with

industry standards.

Regularly update and patch systems, software, and applications to address

security vulnerabilities.

3.8 Incident Reporting and Response:

The Service Provider must have a documented incident response plan to address

and mitigate data breaches promptly.

The Service Provider must report any security incidents or data breaches to RAF in

a timely manner.

3.9 Subcontractors and Third-Party Oversight

If subcontractors are engaged, the Service Provider must ensure that they also

adhere to the same data protection and cybersecurity standards outlined in this

policy.

The Service Provider is responsible for the actions and compliance of any sub-

contractors or third parties engaged in providing services to the RAF.

3.10 Audit and Monitoring

The RAF reserves the right to audit and monitor the Service Provider ’s compliance

with this policy.

The Service Provider must cooperate with any audits or assessments conducted

by RAF to evaluate compliance with data protection and cybersecurity standards.

the Service Provider should have policies and procedures in place to ensure that access is

controlled and monitored.

2.5 Fire Suppression

The Service Provider’s premises should have a fire suppression system or similar in place,

fire extinguishers with carbon dioxide, to prevent damage or loss of documents and records in