Objectives

The primary objective of this tender is to source, implement, and operationalise a comprehensive Data Masking solution for the Companies and Intellectual Property Commission (CIPC). The solution aims to ensure full compliance with the Protection of Personal Information Act (POPIA) by safeguarding personally identifiable information (PII) across all external and internal systems, including legacy environments. It supports the mitigation of risks such as unauthorised disclosures, identity theft, corporate hijacking, and legal liabilities, while enabling lawful access and transparency in corporate disclosures.

Additionally, the initiative aligns with legislative mandates, enhances data privacy posture, and strengthens operational security and compliance through a phased deployment of an enterprise-grade Data Masking system.

Scope

The scope encompasses:

• Design, sourcing, implementation, maintenance, and support of a Data Masking solution across all relevant data environments.
• Phased deployment addressing three core areas:
  • Masking all PII in electronic disclosures, public registers, and legacy systems.
  • Implementing dynamic masking for live environments and exceptions for law enforcement agencies.
  • Ensuring role-based access, data retention, and disposal policies.
• Integration with existing CIPC systems, databases (SQL, Oracle, Informix), and support for on-premises and cloud workloads.
• Development of policies, protocols, and incident response plans related to data breaches and security.
• Training, testing, validation, and support services to ensure operational readiness and ongoing compliance.

Technical Requirements

The solution must meet the following technical specifications:

• Full interoperability with SQL, Informix, Oracle, and current CIPC application stack.
• Support for both on-premises and cloud environments.
• Encryption of PII at rest and in transit using industry-standard algorithms.
• Support reversible tokenisation/masking for operational needs.
• Ability to process large volumes of data without performance degradation, supporting scalability across distributed systems.
• Security controls including encryption, access management, audit logging, and continuous activity monitoring.
• Support for dynamic data masking, role-based access, exception handling, and audit trails.
• Compatibility with Windows and Linux servers, virtualization hypervisors, and support for 750+ workstations/laptops and 20+ servers.
• Integration capabilities with existing data pipelines, governance frameworks, and incident response protocols.

Skills and Skills Requirements

The project team must possess:

• Subject matter expertise in Data Masking solutions, with prior experience in similar projects.
• Proven implementation experience of enterprise-grade Data Masking systems.
• Strong project management skills, preferably with certifications such as PMP, PRINCE2, or Agile methodologies.
• Expertise in data privacy laws (POPIA, POPIA), data security, and compliance standards.
• Technical proficiency in database management, encryption, tokenisation, and interoperability across diverse platforms.
• Experience in system integration, testing, validation, and support within regulated environments.
• Ability to develop policies, incident response plans, and conduct staff training.
• Knowledge of international best practices in data privacy and security, including emerging AI and machine learning capabilities.

All project staff must provide resumes demonstrating relevant experience, and the team must be available for on-site work at CIPC offices in Pretoria.