Consultancy Title: Data Protection Consultant
VA Category: Research, Planning Monitoring and Evaluation
Section/Division/Duty Station: CDO/Data Governance Section/ DAPM NYHQ (remote-based)
Duration: 11 months (15 May 2024 – 15 April 2025)
BACKGROUND
UNICEF has issued a Policy for Personal Data Protection in 2020 (the “Policy”) which applies to any personal data processing by or on behalf of UNICEF. This involves the data of the children who UNICEF serves, its staff, its individual donors, and others. The goal of the policy is to ensure that UNICEF uses personal data in line with individual’s rights and freedoms and without exposing them to inappropriate risks.
Purpose of Activity/Assignment:
The Chief Data Office (CDO) is tasked to support offices and divisions with the implementation of the Policy. For that purpose, it is centrally developing a data protection programme, a set of tools, guidance, central records and training/awareness measures, to enable the organization to process personal data in compliance with the Policy and in respect of individuals’ rights to privacy. In addition, it is committed to promoting the responsible use of other sensitive data for children in line with the “Responsible Data for Children” principles and toolkit.
Scope of Work:
The Information Security team is responsible for establishing, maintaining, and continually improving UNICEFs cybersecurity program, to ensure the confidentiality, integrity, and availability of UNICEF’s digital assets. In order to fully design and support the roll-out of the UNICEF data protection programme, including responsible standards for the handling of sensitive non-personal data, and address the related elements of UNICEFs cybersecurity program, UNICEF CDO and UNICEF Information Security need to hire a data protection and privacy technology expert with strong experience on the intersection of data protection, information security and technology.
Terms of Reference / Deliverables
The consultant is expected to support the implementation of the Policy worldwide, with specific focus on the development of the tools, systems and guidance developed as part of the data protection programme by UNICEF CDO in collaboration with ICTD Information Security. To carry out this work, the Chief Data Office is seeking out the support of a consultant with the following objectives:
Note: While the deliverables include an estimated number of days, these numbers are a rough estimate, the payments will be made based on the satisfactory completion of each deliverable in their entirety, and receipt of invoice, and will not be based on the number of days worked.
Deliverable 1: Enabling UNICEF to conduct Data Protection Impact Assessments (DPIAs)
In collaboration with ICTD,
Deliverables/Outputs:
a. Provide:
Deliverable deadline: 15 June 2024
b. Provide:
Deliverable deadline: 30 June 2024
Deliverable deadline: 30 June 2024
Deliverable deadline: 31 December 2024 (depends on when LTA/contract is in place)
Deliverable deadline: 31 December 2024 (depends on when LTA/contract is in place)
Deliverable deadline: 31 August 2024
Deliverable 2: Central registries
Please quote separately for these two alternative items:
Alternative 1)
Design an approach for UNICEF offices to maintain a registry of processing activities (ROPA), including guiding their use of such registries; Note: this activity applies to both new processing activities (for which a go-forward approach is required) as well as existing processing activities (for which a retroactive approach is required).
Alternative 2)
Jointly with a UNICEF vendor contracted for the ROPA based data mapping and in consultation with relevant UNICEF stakeholders, develop a risk-based plan (risk focus, sequence of offices).Accompany the UNICEF vendor conducting the personal data mapping and populating the ROPA based on the vendor’s tool with a CO and an HQ division and develop a guide for offices and divisions on the ROPA, its purpose and use and how to maintain it going forward when the backward looking ROPA has been completed.
Analyse the data, and its gaps, from a risk perspective with a goal to advise UNICEF on its exposure to harm data subjects.
Deliverables/Outputs:
Please quote separately for these two alternative items:
Alternative 1):
Deliverable deadline: 15 June 2024
Alternative 2)
Deliverable deadline: 31 October 2024
Deliverable deadline: 30 September 2024
Deliverable deadline: 30 January 2025
Deliverable deadline: 30 January 2025
Deliverable 3: Review and align the currently being revised personal data breach procedure with the security incident procedure
Deliverables/Outputs: Based on consultations with ICTD, legal office and CDO, provide written mark-up how to amend the personal data breach procedure and/or the security incident procedure; and provide a final draft following consultation and comments with ICTD and CDO.
Delivery deadline: 31 December 2024
Deliverable 4: – Data harvesting technology – Support the coordination by CDO of the cross-functional process to come up with a UNICEF position on data harvesting technologies for UNICEF programmes and administration including a list of measures to address the issue.
Deliverables/Outputs: Based on input from relevant UNICEF stakeholders provide a first draft of the following documents, as well as, after input of ICTD and CDO, a final draft considering such input
Delivery deadline: 31 January 2025
Deliverable 5: Contracts
In collaboration with ICTD and the legal office, review the UNICEF standard security measures to be added to contracts with NGOs in high-risk / low-capacity contexts and private sector partners.
Deliverables/Outputs: Provide written standard security measures to be added to contracts and/or agreements based on the type of partners, e.g., NGOs in high-risk / low-capacity contexts, private sector partners, government partners etc. The written security measures shall include input from the legal office and ICTD. A final draft shall be provided following consultation with legal office, ICTD and CDO.
Delivery deadline: 28 February 2025
Deliverable 6: Standards and guidelines
Develop internal standards and guidance notes, in close collaboration with ICTD and other CDO team members, cross-referencing the UNICEF digital resilience model.
Deliverables/Outputs: Develop and submit for review internal standards and guidance notes, on each of the following topics based on the input of ICTD and CDO; provide a final draft following comments/consultation of the initial draft:
Delivery deadline:15 April 2025
For all deliverables, even if not expressly mentioned in the above, the consultant shall provide a first draft and, following written comments and/or an oral consultation, a final version of all deliverables.
No travel is envisaged for this consultancy.
Qualifications
Education
Work experience
At least 7 (seven) years of working experience in privacy technology or personal data protection and privacy with a strong expertise in information security and technology in practice and training
Competencies
Requirements:
Health Insurance:The Consultant is fully responsible for arranging at their own expense, such as life, health, and other forms of insurance covering the term of the Contract as he or she considers appropriate. The Consultant is not eligible to participate in the life or health insurance schemes available to UNICEF and United Nations staff members.
For every Child, you demonstrate…
UNICEF’s values of Care, Respect, Integrity, Trust, Accountability, and Sustainability (CRITAS).
To view our competency framework, please visit here.
UNICEF is here to serve the world’s most disadvantaged children and our global workforce must reflect the diversity of those children. The UNICEF family is committed to include everyone, irrespective of their race/ethnicity, age, disability, gender identity, sexual orientation, religion, nationality, socio-economic background, or any other personal characteristic.
UNICEF offers reasonable accommodation for consultants/individual contractors with disabilities. This may include, for example, accessible software, travel assistance for missions or personal attendants. We encourage you to disclose your disability during your application in case you need reasonable accommodation during the selection process and afterwards in your assignment.
UNICEF has a zero-tolerance policy on conduct that is incompatible with the aims and objectives of the United Nations and UNICEF, including sexual exploitation and abuse, sexual harassment, abuse of authority and discrimination. UNICEF also adheres to strict child safeguarding principles. All selected candidates will be expected to adhere to these standards and principles and will therefore undergo rigorous reference and background checks. Background checks will include the verification of academic credential(s) and employment history. Selected candidates may be required to provide additional information to conduct a background check.
Remarks: Only shortlisted candidates will be contacted and advance to the next stage of the selection process.
Individuals engaged under a consultancy or individual contract will not be considered “staff members” under the Staff Regulations and Rules of the United Nations and UNICEF’s policies and procedures, and will not be entitled to benefits provided therein (such as leave entitlements and medical insurance coverage). Their conditions of service will be governed by their contract and the General Conditions of Contracts for the Services of Consultants and Individual Contractors. Consultants and individual contractors are responsible for determining their tax liabilities and for the payment of any taxes and/or duties, in accordance with local or other applicable laws.
The selected candidate is solely responsible to ensure that the visa (applicable) and health insurance required to perform the duties of the contract are valid for the entire period of the contract. Selected candidates are subject to confirmation of fully-vaccinated status against SARS-CoV-2 (Covid-19) with a World Health Organization (WHO)-endorsed vaccine, which must be met prior to taking up the assignment. It does not apply to consultants who will work remotely and are not expected to work on or visit UNICEF premises, programme delivery locations or directly interact with communities UNICEF works with, nor to travel to perform functions for UNICEF for the duration of their consultancy contracts.
Advertised: Eastern Daylight Time
Deadline: Eastern Daylight Time
Apply now
To help us track our recruitment effort, please specify on the application form/indicate in your cover letter where (embasssyjobs.net) you saw this job posting.
Job title: Senior Research Assistant Company Northumbria University Job description Job Description:ABOUT THE ROLEThis thirty-two…
Job title: Postdoctoral Research Associate in Machine Learning Knots Company University of Edinburgh Job description…
Job title: Occupational Therapist - Day Hospital - Mental Health & Addictions Company IWK Health…
Job title: Professor in Law - Law and Criminology Company Aberystwyth University Job description Weekly…
Job title: Aircraft Fueler YYC Company Menzies Aviation Job description Description :Do you have a…
Job title: Apprentice Workshop Coordinator Company Severn Trent Water Job description APPRENTICE WORKSHOP COORDINATORLET'S CUT…