Objectives

The primary objective of this tender is to appoint a qualified and experienced operator to deliver a secure, scalable, and high-availability managed data processing and Personally Identifiable Information (PII) mining service. This service aims to support the Bank’s operational, analytical, and regulatory obligations, particularly in response to a recent data security incident. The operator will manage data ingestion, processing, analysis, and reporting to facilitate compliance with POPIA and assist Data Subject Access Requests (DSARs), ensuring secure handling and accurate identification of PII.

Scope

The scope includes:

• End-to-end data ingestion and processing of structured (excluding database files) and unstructured data from the Bank or designated sources.
• Data preparation, deduplication, normalization, and forensic analysis to ensure data integrity.
• Identification, classification, and quantification of PII within datasets.
• Generation of detailed PII reports for regulatory, risk, and remediation purposes.
• Secure and compliant data handling, including encryption, access control, and audit logging.
• Execution of Data Subject Access Requests (DSARs) with statutory compliance.
• Provision of measurable service levels with transparent, unit-based pricing.

Technical Requirements

The technical requirements specify that the operator must:

• Implement secure data ingestion and processing pipelines for both structured and unstructured data.
• Perform forensic analysis such as file signature analysis to ensure data completeness and integrity.
• Identify and classify PII, producing detailed reports indicating categories, occurrences, and high-risk files.
• Maintain end-to-end data security, including encryption and controlled access, in compliance with POPIA and industry standards.
• Support ad-hoc DSAR execution with accurate and timely responses.
• Provide auditable processes, logs, and documentation for oversight and compliance.
• Deliver services with measurable performance levels and transparent costing.

Skills Requirements

The successful bidder must demonstrate:

• Expertise in secure data processing, forensic analysis, and PII identification.
• Experience in managing large-scale data ingestion and normalization processes.
• Knowledge of POPIA, industry best practices for data privacy, and regulatory compliance.
• Capability to execute DSARs accurately and within statutory timelines.
• Proficiency in providing auditable security and operational controls.
• Ability to deliver transparent, measurable services with clear reporting and pricing.