Consultancy/Training – Data Protection

Background to the consultancy

Danish Refugee Council (DRC) has been operational in Myanmar since 2012, focusing on protection, economic recovery, CCCM and humanitarian disarmament and peacebuilding assistance for conflict affected communities in Kachin, Rakhine and NSS. DRC Myanmar has some established data protection practices however there is a need to document and strengthen these practices to ensure the safe, ethical and effective management of personal data.

Objectives of the consultancy

The objective of the consultancy is to lead on the development, and strengthening, of data protection practices within the DRC Myanmar country program. The consultancy will map data flows and identify, evaluate and address the risks arising from the processing of personal data within the program. . This will include developing a data protection protocol that outlines data protection practices DRC Myanmar should be adhering too and building knowledge of data protection principles and practices amongst DRC staff through trainings.

The consultant will utilize global guidance including but not limited to the Handbook on Data Protection in Humanitarian Action, the IASC Operational Guidance on Data Responsibility in Humanitarian Action and resources from the PIM initiative as well as global DRC guidance on data protection to guide the consultancy.

Expected Deliverables:

• Deliver four remote training sessions on data protection and protection information management (PIM) principles (2 days)
• Conduct a data protection impact assessment (DPIA) for the Myanmar program and produce a DPIA report including general and sector specific recommendations (10 days)
• Conduct a DPIA report validation meeting (1 day)
• Implementation of recommendations from the DPIA (following the DPIA, the specific recommendations to be implemented within the timeframe/scope of the consultancy to be agreed upon in coordination with DRC Myanmar consultancy team) (8 days)
• Development of a DRC Myanmar data protection protocol (2 days)
• Development of operationalisation plan for data protection protocol (1 day)
• Develop specific additional data protection guidance for the following activities (4 days)
  • Protection case management
  • GBV case management
  • CP case management
  • Individual Protection Assistance
• Deliver remote training to relevant staff on data protection protocol (6 days)

Time Frame:

The consultancy is expected to take a maximum of 33 days

Profile of the Consultant

• A degree in law, information management, social sciences or a related field is required
• A minimum of four years (4) progressively responsible professional experience in law, information security, data protection or a related field is required.
• At least one year experience in the protection sector is required
• Knowledge of protection information management is required
• Ability to work with minimum supervision is required
• Demonstrated understanding of the work proposed in the TOR is required
• A good working knowledge of domestic and international privacy laws, regulations and industry best practices is highly desirable.
• Experience addressing data protection concerns involving children is desirable
• Excellent communication and writing skills in English is required
• Communication and writing skills in Myanmar language is desired