Terms of Reference
Data Protection & Cyber Security
1. BACKGROUND:
An International non-governmental, and non-profit organization which has no political association working in various fields of humanitarian relief and development. was established in early 2013 and obtained licenses in multiple countries under the name|
Association Internationale D’aide Humanitaire –
International Humanitarian Relief Association –
Uluslararasi Insani Yardimlaşma Derneği –
2. PURPOSE OF THE ASSIGNMENT:
The overall objective of the training to is to enhance participants’ understanding of data protection principles and cybersecurity best practices.
The training will help staff prevent, identify, and respond to data security incidents, ensuring that personal and organizational data are processed responsibly and securely. And to ensure compliance with international data protection standards (such as GDPR) and to strengthen the information security practices within the organization, this training aims to build staff capacity on both the ethical and technical aspects of data security.
The training is part of the organization’s ongoing effort to safeguard sensitive information, protect the privacy of beneficiaries and partners, and reduce risks related to data misuse or cyberattacks.
3. SCOPE OF WORK
The service provider will deliver a Four-days training in data protection and cybersecurity. The training should be practical, participatory, and contextualized for NGO and humanitarian work. The topics will include but not be limited to:
– Data protection and privacy.
– lawful and ethical data processing.
– Cyber threats.
– Practical cybersecurity measures.
3.1. The training is aimed to achieve following objectives:
1- Understand the concepts and importance of data protection and privacy.
2- Recognize different types of personal and sensitive data in humanitarian contexts.
3- Apply the key principles of lawful and ethical data processing.
4- Identify cyber threats (phishing, ransomware, malware, social engineering).
5- Implement practical cybersecurity measures for personal and organizational data.
6- Apply secure communication, password management, and data storage practices.
7- Respond effectively to data breaches and cybersecurity incidents.
8- Strengthen organizational compliance with internal data protection policies
3.2. METHODOLOGY:
1- Deliver using a blended learning approach and might comprises of presentations, interactive sessions of practical exercise and group works.
2- Practical sessions using case, individual or group exercises will be given to participants after each session to make sure that they can apply what they have learnt into practice immediately.
3- Participatory training methods such as brainstorming, simulation, group discussion and case analysis.
3.3. KEY DELIVERABLES:
1- Following deliverables are expected from the training provider:
3.3.1.1. Trainer will prepare agenda/contents/sessions of the training and submit these at least one week before start of the training.
3.3.1.2. Trainer shall conduct pre-test from all participants of the training.
3.3.1.3. Trainer will also share complete package of training material that may be provided to the participants.
3.3.1.4. Trainer will facilitate preparation of training follow up and action plan
3.3.1.5. After the completion of the training, the trainer will share comprehensive training report on the agreed format within 10 days after the completion of the training.
3.4. LOCATION:
1- The location will be in Idlib, at IYD office, and many employees will join for live session.
3.5. TIMEFRAME
1- This is a short-term assignment for Firms/ consultants based in Syria for a period of 4 days training within 09 to 12 -12 -2025.
3.6. DUITES & RESPONSIBILITIES:
1- The trainer/consultant/resource person will:
3.6.1.1. Sign with IYD a consultancy agreement and work as a resource person for the days training event.
3.6.1.2. Discuss and agree with IYD on the final training package, content and deliverables.
3.6.1.3. Design an appropriate process of the training leading to the desired results.
3.6.1.4. Propose on the most appropriate training methodology for effective delivery of the assignment.
3.6.1.5. Device the tools required for each session of the training.
3.6.1.6. Satisfactorily facilitate the training sessions and ensuring active engagement of all the participants.
3.6.1.7. Share relevant training materials and provide any resource materials for further reading and reference by IYD staff.
3.6.1.8. Design a questionnaire for pre and post-test (to be used before and after the workshop) for workshops to gauge the level of understanding of the participants about the topics discussed in the training workshop.
3.6.1.9. Compile and submit quality training report (one soft copy)
4. TECHINCAL PROPOSAL:
1- The technical proposal should include but not limited to the following information:
4.1.1.1. A brief outline of recent experience and client references in carrying out assignments of similar nature (Max. 1 pages)
4.1.1.2. Detailed description of how the consultant/firms understands and will respond to the ToR including time frame and number of persons involved in and comments on the ToR (Max 2 pages)
4.1.1.3. Training agenda
4.1.1.4. Training plan
4.1.1.5. CV/Resume of Trainer
2- The resource person/consultant should possess following qualifications and expertise:
5.2.1.1. Proven experience of conducting similar trainings.
5.2.1.2. A university degree in one or more of the following fields: Information Technology, Computer Science, or Cybersecurity, Data Science or Information Systems.
5.2.1.3. Strong communication, analytical and drafting skills.
5.2.1.4. Practical work experience in data protection, information security, or cybersecurity — preferably within NGOs, development organizations, or international institutions
5.2.1.5. Fluency in Arabic and English is mandatory.
6. FINANCIAL PROPOSAL:
6.2.1. The financial proposal must contain overall quotation in USD for all the services to be provided and must follows the following:
6.2.1.1. An all-inclusive day rate who will take place in assignment
6.2.1.2. Summary of the total costs for the services proposed
6.2.1.3. Any taxes applicable
6.2.1.4. Bank account
7. PROPOSED PAYMENT SCHEDULE:
7.2.1. 100% of the payment will be released to the trainer on week after completing the training.
How to apply
https://forms.gle/8wdBxZzG9oKAquad9