RFP publication / issuance
RFP issued on 13/07/2026 under Ref. LIC-CO/ERM/CSD/RFP/2026-27/DPDPA_Tools.
Loading
Loading…
Loading…
RFP_Procurement and Implementation of Tools related to DPDP Act 2023 and DPDP Rules 2025
Life Insurance Corporation of India · Mumbai, Maharashtra2026_LIC_844742_1
Written by TenderKart AI from the documents published when it was generated. Check the tender for later corrigenda before you bid.
13 Jul 2026
23 Sept 2026
₹83 Cr
₹83 L
All important dates as they stand after corrigenda: publication, pre-bid/clarification deadline, bid submission deadline, bid opening, and bid validity period.
RFP issued on 13/07/2026 under Ref. LIC-CO/ERM/CSD/RFP/2026-27/DPDPA_Tools.
Pre-bid queries and participant details for the pre-bid meeting are due by 20-07-2026, latest by 03.00 PM, by email to [email protected].
Pre-bid meeting on 22-07-2026, 11:00 am to 1:30 pm at LIC CO Cyber Security Department, 2nd floor, Jeevan Seva-SSS Building, S.V. Road, Santa Cruz (West), Mumbai - 400 054; maximum 2 representatives per eligible bidder.
Last date & time for online bid submission: 10-08-2026, latest by 03:00 PM on www.tenderwizard.com/LIC. Hard-copy sealed bids are additionally required within three working days of eligibility bid opening.
Eligibility bid opening: 10-08-2026 at 03:15 PM. Commercial bid opening date/time/venue will be intimated later to eligible qualified bidders. Online reverse auction follows commercial bid opening of shortlisted bidders.
Bids remain valid for 1 year from the last date of bid submission; shorter validity is non-responsive. LIC may seek written extension, with EMD validity extended accordingly.
Implementation to be completed within 20 weeks of contract signing / as phased from T = Letter of Award; post go-live support for 5 years from go-live. Contract documents: PO receipt 7 days, PBG 15 days, contract/SLA 30 days of intimations; project commencement within 7 days of contract/SLA execution.
Tender value or estimated cost, EMD/bid security (amount, acceptable forms, validity), tender document fees, performance security, and key payment terms.
Non-refundable bid processing fee Rs.11,800/- inclusive of GST (10,000 + 18% GST), payable online to A/c LIC9NETW, IFSC UBIN0996335, A/c holder Life Insurance Corporation of India. MSE/NSIC exemption available with valid certificate.
EMD INR 83,00,000 (Rupees Eighty-Three Lakhs Only) as unconditional irrevocable Bank Guarantee payable at Mumbai from a Nationalized/Scheduled Bank acceptable to LIC (Annexure-VI), valid for one year from last date of tender submission. MSE/NSIC waiver with certificate. No interest. Refunded to successful bidder after PO/contract and PBG; to unsuccessful within 45 days of result publication.
Selected vendor must submit unconditional irrevocable PBG equal to 5% of total Contract Value (Annexure-XI) within 15 days of selection letter; valid 63 months including claim period from submission date; no interest. Late PBG attracts Rs.5,000/day up to Rs.1,00,000; failure beyond 35 days may cancel allotment and offer to L2 at L1 prices.
Contract Value is the successful vendor’s lowest commercial bid in online reverse auction and/or price negotiation. Quotes in INR only, inclusive of all costs excluding GST; taxes/levies reimbursed on actuals with documents. Evaluation uses NPV of multi-year prices at 10% discount. Prices not subject to FX/tax/labour variation after bid close.
No advance or interest. Phase-wise for solutions: 40% on delivery of software/appliances and contract signing; 40% on installation/integration/initial OEM audit/acceptance testing plus 100% of Direct Premium Support Cost with OEMs; 15% after go-live/OEM validation; 5% after training/KT/documentation. Onsite services paid quarterly in arrears against SLA. INR NEFT by ERM-IT-CSD CO; target settlement within 30 days of invoice. Penalties recoverable from payments/PBG.
Every pass/fail eligibility and qualification requirement: experience and past performance, turnover/net worth, registrations and certifications, consortium/JV rules, and debarment or blacklisting conditions.
Bidder must be a system integrator and registered legal entity in India in operation for minimum 5 years preceding RFP date; valid GST and PAN required.
Average annual turnover not less than INR 100 Crores during FY2023-24, FY2024-25 and FY2025-26; operating profit (EBITDA) in each of those three years; positive net worth as on RFP date. Additionally, revenue of at least INR 50 Crore from DPDP-related projects and Services / Cyber Security Projects during each of the last 3 FYs.
Bidder/OEM must have successfully implemented, or be implementing, privacy automation solutions comprising at least consent management, data principal rights management & data discovery for at least two organisations in insurance and/or banking sectors, with PO/completion/reference evidence (Annexure-V).
Bidder & OEM must have Mumbai support centre with 24x7 onsite, telephonic and remote support. Bidder must have minimum 30 Data Privacy / IT Security permanent professionals on payroll with specified certifications (CIPT/CIPP/E/CIPM/DSCI/CISSP/OSCP/CEH/CISA/CISM etc.).
Bidder must hold any 3 of: ISO27001, ISO9001, ISO22301, ISO 20000.
OEM average annual turnover not less than INR 500 Crores last three audited FYs, with positive EBITDA, PAT and Net Worth each year. Privacy automation solution commercially available minimum two years and implemented/under implementation at least three enterprise customers. OEM dedicated implementation team (PM, Solution Architect, Privacy Consultant, Technical Specialists) with minimum five years' experience.
Bidder/OEM must have in-house legal team OR MoU/contract with law firms/privacy consultancies, with at least two legal expert CVs (LLB/LLM; DPDP/BFSI advisory; privacy certs). Integrity Pact (Annexure-XIV), MAF (Annexure-X) and Land Border Agreement (Annexure-XII) mandatory.
Bidder must not be blacklisted by GoI/RBI/SEBI/IRDAI as on RFP date (stay order exception). Confirmation that no connected entity has also bid. Consortium bids are summarily rejected. Make in India guidelines apply. All MEC criteria are pass/fail as on bid submission date.
Technical Criteria as per Annexure XV must be met; non-compliant to any parameter will not be evaluated. Only eligibility-qualified bidders proceed to commercial evaluation / reverse auction.
What is being procured: the work, supplies or services, deliverables and quantities, locations, phases, completion or delivery timelines, applicable standards, and notable exclusions.
Procurement and implementation of DPDP Act 2023 / DPDP Rules 2025 privacy automation tools for LIC for five (5) years, covering privacy, security and governance across applications, processing, data sharing, AI and regulatory readiness.
In-scope modules include: Data Privacy Notice Management; Consent Management Platform; Cookie Consent Management; Data Discovery & Mapping; Data Principal Rights Management (incl. grievance redressal); DPIA; ROPA (automated & integrated to DPIA); Personal Data Breach Management; Third Party Vendor Risk Management; Compliance Reporting & Dashboards; Workflow Management; DPDP Program Management portal. Detailed functional requirements in Annexure XV.
Seven phases: (1) Planning & Designing workshop; (2) Delivery of Hardware; (3) Implementation; (4) UAT; (5) Movement to production; (6) Training & knowledge transfer; (7) Post go-live support. Deliverables include project plan, architecture (HLD/LLD), configuration, deployment certificates, UAT sign-off, training materials, documentation and 5-year support. Activities/deliverables are indicative, not exhaustive.
Entire implementation activity within 20 weeks of signing of contract / phased from LoA to T+20 weeks; post go-live support 5 years from go-live, with LIC option to extend maintenance/support up to 2 additional years (6th & 7th) at mutually agreed rate. On-site support on-premises in Mumbai (LIC CO ERM/CSD); LIC footprint spans CO, 8 ZOs, 113 DOs, 2048 BOs and other offices pan-India.
Hardware/software maintenance, AMC/subscription, upgrades/patches free of charge for five years post go-live; on-site and off-site support. RTO 4 hours and RPO 15 minutes. Comprehensive on-site warranty five years from installation/acceptance. Compliance with LIC IT/IS security policy, DPDP, IRDAI cyber guidelines; Right to Audit by LIC/IRDAI auditors.
Mandatory onsite Project Manager at LIC-CO-ERM/CSD Mumbai for implementation (clause 15 states no separate PM charges) plus minimum 24 onsite resources across modules for full contract duration, subject to LIC interview/approval; 24x7 application & infrastructure support from hardware delivery; all onsite personnel must be vendor payroll employees (no outsourced/third-party personnel).
Vendors must factor maximum 25% scope changes within quoted services cost; beyond 25% via change order. No subcontracting of any portion of scope without prior express LIC consent (assignment/subcontract barred). Scalability note: consider ~10% increase in devices/solutions over 5 years when sizing. Technical non-compliance to any Annexure XV parameter is disqualifying.
The complete checklist of documents to submit — mandatory vs conditional, with any prescribed formats, proformas or annexures — plus how to submit: portal and mode, envelope/cover structure, digital signature requirements, signing and attestation rules, and physical originals with their deadline.
Mandatory online e-tender submission on https://www.tenderwizard.com/LIC (Annexure-XIII). All documents scanned and uploaded. Bidders need portal registration and Digital Signature Certificate from a CCA-notified Certifying Agency. Dual submission: hard-copy sealed bids also required.
Two-bid system: (1) Eligibility envelope + pen drive; (2) Commercial envelope + pen drive; both inside outer BID envelope. Separate sealed envelope for Bid processing fee, EMD and Pre-contract Integrity Pact. Super-scriptions prescribed with RFP ref. Soft and hard content must match exactly. Addressed to THE EXECUTIVE DIRECTOR (ERM); deposit in tender box at activity-schedule address.
Hard copies spirally bound, serially numbered, duly signed and stamped on each page by authorised signatory (except unamended public product literature). Scanned-only hard bid may be rejected. Language English; currency INR. Commercial sheet must retain LIC password protection. Non-compliance to bid-submission instructions attracts Rs.5,000 per violation (cap Rs.10,000) from EMD.
After eligibility, indicative commercial bids opened; qualified bidders (subject to H1 elimination if >5 bidders and >40% above average NPV) participate in online reverse auction. L1 provides line-item breakup within 3 working days else EMD forfeit risk. Single qualified bidder: no RA; LIC may negotiate.
Every corrigendum/addendum in order — what changed (original vs amended value), its impact, and the action for the bidder — ending with the values that finally apply.
The workspace documents contain only the base RFP dated 13/07/2026, cover notice, Integrity Pact, commercial Excel and tech-spec Excel. No corrigendum, addendum or pre-bid reply document is present, so original RFP values apply as published.
Genuine conflicts within and across the documents (original vs corrigenda, clause vs annexure, tender document vs BOQ): both sides with citations, and which value prevails.
Activity Schedule lists mode as Online only, while Instructions require both online upload and hard-copy sealed envelopes (with pen drives) within three working days of eligibility bid opening, deposited in the tender box. Bidders should comply with both channels.
Section-F cl.2 says payment will not be released till completion of in-scope activities, but the same Section-F payment table releases 40%/40%/15%/5% against delivery, installation, go-live and training milestones, plus quarterly onsite arrears. Phase-wise table is the operable payment schedule; cl.2 creates ambiguity and should be clarified.
Section-E cl.15 states no charges will be payable by LIC for the onsite Project Manager, yet Annexure-VIII commercial bid includes a priced line for Service-Delivery Manager (SDM)/Project Manager (Qty 1). Needs pre-bid clarification on whether PM cost must be zero or absorbed elsewhere.
Clause 15 requires PM details within 1 week of PO, while Implementation SLA SN.3 penalises if Service Delivery Manager details are not communicated within 3 weeks of PO. Different clocks for the same obligation.
List of eligibility enclosures includes Commercial Bid (indicative) Annexure-VIII, while instructions require commercial bid in a separate envelope and forbid prices in the eligibility bid. Treat commercial as separate cover; do not put prices inside eligibility documents.
Assignment clause bars subcontracting any portion of scope, and onsite resources must be on vendor payroll only; yet NDA/IPR/BCP and Integrity Pact text refer to subcontractors. Prevailing bid rule is no consortium and no subcontracting without prior express LIC consent—confirm residual OEM/partner roles in pre-bid.
Only critical, tender-specific pre-bid queries that could materially change bid/no-bid, pricing, eligibility or contractual risk. Skip generic or obvious questions the documents already answer clearly.
Ask LIC to confirm exact hard-copy deadline (calendar mapping of ‘within three working days of eligibility bid opening’ on 10-08-2026 03:15 PM), which originals must match online uploads, and whether late hard copy after successful online submission is fatal.
Resolve contradiction between ‘no charges payable for onsite PM’ and commercial line item for SDM/PM; confirm whether 24 onsite resources are billable for full 5 years and if PM is inside or outside the 24 count for commercials/SLA.
MEC Sr.5 allows Bidder/OEM experience for two BFSI privacy-automation implementations. Confirm whether OEM references alone (with MAF) satisfy bidder eligibility, required proof combination, and if ‘in process of implementing’ without completion is acceptable.
Seek written confirmation that 40% is payable on delivery before full go-live, what constitutes acceptable delivery evidence for software licenses, and whether hardware is mandatory on-prem only or cloud/LIC DC options are allowed under ‘Delivery of Hardware’ at T+8.
Clarify how the mandatory 25% scope-change buffer is measured (effort/cost/modules), what is excluded, and whether any ‘No’ in Annexure XV is automatic rejection even for non-critical/value-add features (e.g., all 22 Indian languages, NeGD consent stack integration).
Limitation of liability is capped at total Contract price, but excludes LD and ‘penalties on account of violation of DPDP Act, 2023’, and IPR/confidentiality/misconduct liability is unlimited. Ask whether statutory DPDP penalties imposed on LIC are fully back-to-back to vendor without overall cap.
Commercial, legal and execution risks a bidder should weigh: liquidated damages and penalties, unusual or one-sided clauses, tight timelines, and payment or security risks.
Full implementation in 20 weeks from contract/LoA with hardware by T+8. Delay beyond four consecutive weeks in any phase allows PO cancellation, penalties, PBG recovery and contract termination. Delivery/installation penalties capped at 10% of PO value; cumulative SLA penalty cap 10% of TCO (support penalties can reach 100% of quarterly charges).
About 24 dedicated onsite resources in Mumbai for full contract duration, LIC interview veto, payroll-only staff, background/police verification, 45-day change notice and 21-day overlap. Early exit before 1 year attracts escalating % of annual onsite charges; absence can draw double proportionate deduction.
Large EMD (Rs.83 lakh BG for 1 year) plus PBG 5% of TCO for 63 months; multiple forfeiture/invocation events including bid-format mistakes (password, binding). No advance; 40% tied to delivery evidence and another 40% to installation/OEM audit; quarterly onsite arrears with SLA deductions.
Bidder must price up to 25% scope change inside base cost. LIC may terminate for performance issues on 90 days’ notice, insolvency on 30 days, or corruption anytime; transition support up to 6 months. Unlimited liability for IPR/confidentiality/misconduct; DPDP penalty exposure carved out of cap. Arbitration venue Mumbai.
Any Annexure XV non-compliance is not evaluated—requirements include NeGD consent-stack alignment, 22-language notices, SOAR collaboration, encryption, etc. Evaluation is eligibility then reverse auction (H1 elimination possible), not QCBS—race to L1 after meeting high bars. Significant reduction in expert/OEM/manpower costs during RA discouraged and may be challenged.
Integrity Pact on stamp paper of Rs.500 or more is submission-critical. Fraud/corrupt practice finding can forfeit EMD/PBG and bar participation in LIC RFPs for two years. False statements can lead to debarment and BG invocation.
The inviting authority and relevant contacts: office, person, designation, address, phone and email — and which address receives physical submissions, if any.
Life Insurance Corporation of India, Central Office, ERM/CSD (Cyber Security) Department. Sealed bids addressed to THE EXECUTIVE DIRECTOR (ERM).
LIC of India, 2nd Floor, Meeting Room, Cybersecurity Department, Jeevan Seva-SSS Building, Santacruz (W), Mumbai - 400054 — address for communication/submission for pre-bid meeting/opening of bids and tender-box deposit per activity schedule.
Contact email for queries and correspondence: [email protected] (pre-bid email size ≤1MB). Official tender updates: https://licindia.in (Tender Section). E-procurement portal: https://www.tenderwizard.com/LIC. Telephone clarifications not entertained.
LIC statutory Central Office: “Yogakshema”, Jeevan Bima Marg, Mumbai – 400021 (also used on Integrity Pact / some annexure addresses).
IEMs: (1) Shri Sanjay Kumar Srivastava, IAS (Retd.), C-II, 2475, Vasant Kunj, New Delhi - 110 070, [email protected]; (2) Shri Jose T Mathews, IFS (Retd.), House No. 37/930, Ebrahim Pillai Lane, Via – Kakkanad, Thrikkakara, Ernakulam, Kerala 682021, [email protected].
RFP body does not publish a dedicated LIC officer mobile/landline for this bid beyond email [email protected]; e-tender portal helpdesk contacts appear in Annexure-XIII online guidelines if needed for portal issues.