Data Protection Consultant

About WeProtect Global Alliance

WeProtect Global Alliance brings together experts from government, the private sector and civil society to protect children from sexual exploitation and abuse online. Together, we generate political commitment and practical approaches to make the digital world safe and positive for children, preventing sexual abuse and long-term harm.

The Alliance currently consists of 105 governments, 89 private sector companies, 164 civil society organisations and 10 intergovernmental organisations.

WPGA is now progressing its new strategy which is built around three core pillars:

§ Convening focuses on bringing stakeholders together through targeted, regional, and thematic engagements to share solutions and strengthen collaboration.

§ Knowledge positions the Alliance as a leading source of evidence and insight, providing high-quality tools and data to inform policy and practice.

§ Impact ensures that this knowledge translates into measurable change, supporting members to drive tangible outcomes in preventing child sexual exploitation and abuse.

About the project

WeProtect Global Alliance is seeking external expertise to assess its current data protection arrangements and support the development of an organisation-wide data protection framework.

The Alliance processes personal information relating to employees, consultants, suppliers, partners, donors, members and other stakeholders. Data is held across multiple business functions, including internal operations and membership services.

The purpose of this project is to:

§ Assess the Alliance's current data protection maturity and compliance position;

§ Identify strengths, risks and gaps in existing policies, procedures and practices;

§ Review organisational governance arrangements relating to data protection;

§ Support the development of a practical and proportionate Data Protection Policy and governance framework;

§ Provide a prioritised implementation roadmap to strengthen organisational compliance and accountability.

The successful consultant will be expected to engage with staff across multiple departments and work collaboratively to understand organisational processes, systems and data flows.

Scope of Work

The consultant will be expected to undertake activities including, but not limited to:

Discovery and Assessment

§ Project inception and planning meeting

§ Stakeholder interviews across relevant departments

§ Review of existing policies, procedures and guidance

§ Review of data storage and management practices

§ Review of supplier and third-party arrangements where relevant

§ Mapping of personal data processing activities

§ Assessment of organisational compliance with applicable data protection legislation and good practice

§ Identification of risks, gaps and opportunities for improvement

Framework Development

§ Development of an updated Data Protection Policy

§ Recommendations regarding governance, accountability and ownership

§ Clarification of roles and responsibilities relating to data protection

§ Development of a practical implementation roadmap

§ Presentation of findings and recommendations to senior leadership

Deliverables

Deliverables should include (but are not limited to):

Discovery and Assessment

§ Inception plan

§ Current-state assessment report

§ Gap analysis

§ Risk register

Framework Design

§ Draft Data Protection Policy

§ Data protection governance framework

§ Roles and responsibilities matrix

§ Prioritised implementation roadmap

§ Recommendations report

Final Outputs

§ Final approved versions of all documentation

§ Presentation of findings and recommendations to SMT and/or Board representatives

§ Handover session and knowledge transfer

All deliverables should be provided in editable formats.