Location: Maseru, Lesotho
Job Identification: 23566
Date Posted: 5 November 2026
Closing Date: 13 November 2026 at 16:00
Contract Type: Consultancy (Up to 11 months)
Initial Contract Duration: 3 Months
Organisational Unit: Country Office
Vacancy Type: Consultancy
Recruiting Type: Consultant
Grade: UG (Ungraded)
INTRODUCTION
Established in 1951, the International Organization for Migration (IOM) is a Related Organization of the United Nations and the leading UN agency in the field of migration. Working closely with governmental, intergovernmental and non-governmental partners, IOM promotes humane and orderly migration for the benefit of all. It saves lives and protects people on the move, drives solutions to displacement, and facilitates pathways for regular migration, while providing services and advice to governments and migrants.
IOM is committed to fostering a respectful, inclusive and supportive workplace where all employees can thrive professionally and feel valued. By creating such an environment, IOM aims to better harness the full potential of migration and strengthen its support to people on the move.
IOM invites candidates from diverse backgrounds to apply and provides reasonable accommodation throughout the recruitment process when required.
PROJECT CONTEXT AND SCOPE
The International Organization for Migration (IOM) is supporting the Government of the Kingdom of Lesotho in the modernization of border and migration management systems through the deployment of the Migration Information and Data Analysis System (MIDAS). MIDAS is IOM’s flagship Border Management Information System (BMIS), designed to facilitate the electronic collection, storage, processing, sharing, and analysis of traveller information at border crossing points.
The MIDAS deployment project in Lesotho aims to strengthen border governance, improve migration management, enhance national security, facilitate legitimate cross-border movement, and strengthen the generation and analysis of migration data for evidence-based decision-making. The project includes technical and legal assessments as foundational requirements to guide the implementation, configuration, and long-term sustainability of the system.
The project documentation specifically foresees a legal assessment to review legislative and regulatory frameworks relevant to border management, migration governance, automated border control procedures, data protection, and data privacy.
A comprehensive review of the legal, regulatory, institutional, and policy environment is therefore required to determine whether existing legislation adequately supports the collection, processing, retention, sharing, and protection of traveller information and biometric data and to identify any legal, regulatory or operational gaps that could affect implementation, in compliance with national legislation, international obligations, human rights standards, and recognised principles of data protection and privacy.
Particular attention shall be given to legal provisions governing data sharing, cross-border transfers of personal information, the processing of sensitive personal information and biometric data, and safeguards necessary to ensure compliance with applicable data protection requirements.
IOM therefore seeks the services of a qualified legal expert to undertake a comprehensive legal assessment to inform the development and strengthening of the legal and institutional framework governing border management data in Lesotho, including recommendations and a roadmap for its implementation.
OBJECTIVE OF THE CONSULTANCY
The overall objective of the consultancy is to conduct a comprehensive legal assessment of the legislative, regulatory, policy, and institutional framework governing border and migration management, personal data protection and privacy, biometric data processing, information management and information-sharing arrangements, and interoperability between government information systems in Lesotho, in order to determine the legal basis for the deployment and operation of MIDAS in Lesotho.
The assessment shall examine the extent to which existing national legislation, including the Data Protection Act, 2011 (Act No. 5 of 2012) and applicable immigration and border management legislation, supports the lawful collection, processing, retention, sharing, and protection of personal and biometric data within MIDAS.
The assessment shall further evaluate compliance with applicable regional and international obligations, international human rights standards, and internationally recognized data protection principles, and provide practical recommendations to address identified legal, institutional, operational, and policy gaps necessary for the sustainable implementation and operation of MIDAS in Lesotho.
SPECIFIC OBJECTIVES
The consultant shall:
- Review the legal and institutional framework governing border management and migration governance in Lesotho.
- Assess the adequacy of the legal basis for the collection, processing, storage, retention, transmission, sharing, protection and lawful use of personal and biometric data for border management purposes, including in the context of MIDAS.
- Evaluate the alignment of the national framework with applicable constitutional protections, international human rights obligations, regional commitments and international data protection principles.
- Assess the legal, regulatory and institutional arrangements governing interoperability and information-sharing between relevant national systems and institutions.
- Identify legal, regulatory, policy, and institutional gaps that may affect the effective governance of border management data and the sustainable deployment of MIDAS.
- Develop recommendations and a roadmap to strengthen the legal, regulatory and institutional framework governing border management data, including measures required to support the sustainable deployment and operation of MIDAS.
SCOPE OF WORK
The consultant shall conduct a legal and institutional assessment of the national framework governing border management data in Lesotho. The assessment shall focus on the collection, processing, storage, retention, sharing, protection, transfer and governance of border management data, including personal and biometric data, and shall identify gaps and recommendations necessary to strengthen the national framework in line with national legislation and applicable regional and international standards.
The consultant shall include the following components:
1. Review of the Legal and Regulatory Framework
Conduct a detailed review of relevant constitutional, legislative, regulatory, and policy instruments governing border management, migration management, identity management, data protection, privacy, information management, cybersecurity, and related areas.
The review shall assess the extent to which the existing framework provides an adequate legal basis for the collection, processing, storage, retention, sharing, protection and lawful use of border management data by competent authorities.
The review shall also examine the legal mandates and powers of competent authorities involved in border management, migration governance, identity management, law enforcement, and national security, insofar as these relate to the collection, access, use, and sharing of border management data.
This includes, but is not limited to:
- Immigration Act and Regulations.
- Passport and citizenship legislation.
- Refugee and asylum legislation.
- Human trafficking and transnational organised crime legislation.
- Border management policies, strategies and operational frameworks.
- National migration policies and strategies.
- Civil registration framework.
- National identity management framework.
- Population registry systems.
- Foundational identification systems.
- Constitutional privacy protections.
- Data protection laws and regulations.
- ICT legislation.
- Cybersecurity frameworks.
- Evidence and electronic transactions legislation.
2. Stakeholder Consultations
Undertake consultations with relevant governmental and non-governmental stakeholders involved in border management, migration governance, identity management, data protection, information and communications technology, law enforcement and national security.
This may include, as appropriate, the following actors: Ministry of Home Affairs and Police; Department of Immigration Services; Ministry of Justice; national ICT authorities; National Identity Management Agencies; Civil Registration Authorities; Lesotho Mounted Police Service; national security stakeholders; border agencies operating at Points of Entry; development partners; and technical stakeholders.
The consultations shall seek to map institutional mandates and responsibilities, identify existing practices relating to border management data governance, assess institutional coordination and oversight mechanisms, identify challenges, gaps, and priority needs, and validate preliminary findings and recommendations.
3. Assessment of Institutional Arrangements and Data Governance Frameworks
Examine the mandates, functions and responsibilities of institutions involved in the collection, management, sharing, protection and oversight of border management data.
The assessment shall analyse:
- Institutional roles and responsibilities.
- Coordination and accountability mechanisms.
- Data governance and oversight arrangements.
- Safeguards governing access to, use, disclosure and sharing of border management data.
- Institutional capacities and challenges affecting effective data governance.
4. Assessment of Information Sharing, Interoperability and Cross-Border Data Exchange
Assess the legal, regulatory and institutional arrangements governing the exchange of border management data within and between competent national authorities and with external partners.
This may include legal provisions governing data exchange between immigration systems, national ID systems, passport systems, civil registration systems, law enforcement systems, and international systems (e.g. INTERPOL).
Particular attention shall be given to:
- Inter-agency information-sharing mechanisms.
- Interoperability between border management, identity management, civil registration and law enforcement systems.
- Legal safeguards governing data exchange.
- Cross-border sharing of personal and biometric data.
- Applicable requirements, limitations and safeguards relating to international data transfers.
5. Assessment of Data Protection and Privacy Safeguards
Assess the adequacy of existing legal and institutional safeguards relating to the protection of personal and biometric data processed for border management purposes.
The assessment shall consider:
- Lawfulness of processing.
- Data protection principles.
- Processing of sensitive personal information and biometric data.
- Purpose limitation and data minimization requirements.
- Rights of data subjects.
- Retention and disposal requirements.
- Security and confidentiality safeguards.
- Oversight and accountability mechanisms.
- Remedies and redress mechanisms.
6. Analysis Against Regional and International Instruments
Assess the alignment of the national framework with applicable regional, continental and international obligations, standards and good practices, including where relevant:
- ICAO standards and recommended practices.
- African Union legal instruments relating to migration and border governance.
- The SADC Model Law on Data Protection and relevant regional data protection frameworks.
- Relevant SADC protocols and regional cooperation frameworks related to migration, border management and information sharing.
- Relevant international human rights instruments.
- Refugee and migration-related conventions ratified by Lesotho.
- Internationally recognized principles and standards relating to privacy, data protection and biometric data processing.
7. Gap Analysis and Recommendations
Identify legal, regulatory, institutional and operational gaps affecting effective border management data governance and provide recommendations to strengthen the national framework.
Recommendations should include:
- Legislative and regulatory reforms.
- Institutional strengthening measures.
- Governance and accountability mechanisms.
- Information-sharing and interoperability arrangements.
- Data protection and privacy safeguards.
- Standard operating procedures and cooperation frameworks.
- Priority implementation actions.
The recommendations shall include a roadmap for the implementation of the recommendations, including immediate actions, medium-term legal, policy, and operational reforms, long-term legislative and institutional strengthening measures, as well as a draft framework for data-sharing agreements and institutional protocols.
The assessment is not intended to constitute a technical, operational, cybersecurity or compliance audit of any specific border management information system. Any reference to existing or planned information systems, including MIDAS, shall be made solely for the purpose of assessing the broader legal, regulatory and institutional framework governing border management data. The assessment shall focus on the national framework for border management data governance rather than on the performance or compliance of any particular system.
ORGANIZATIONAL DEPARTMENT / UNIT TO WHICH THE CONSULTANT IS CONTRIBUTING
Enhancing Border and Migration Management in Lesotho through the Deployment of the Migration Information and Data Analysis System (MIDAS).
WBL: IB0581:1:2:2:001
DELIVERABLES
The consultancy is expected to produce the following deliverables:
- Inception Report: Including the proposed methodology, stakeholder mapping, work plan and approach to conducting the assessment. To be submitted within two weeks after contract signature.
- Draft Legal Assessment Report: Including findings, legal and institutional analysis, gap assessment and preliminary recommendations. To be submitted within six weeks after commencement.
- Validation Workshop: Presentation of the draft findings and recommendations to relevant stakeholders for feedback and validation.
- Final Legal Assessment Report: Incorporating feedback from the validation process and presenting the final findings and recommendations. To be submitted within two weeks after the validation workshop.
- Action Plan and Recommendations Matrix: A practical roadmap outlining recommended actions, priorities and implementation measures, to be submitted together with the final report.
EVALUATION CRITERIA
Applications will be assessed based on the following criteria:
| Evaluation criterion | Weight |
|---|---|
| Education | 15% |
| Legal assessment experience | 25% |
| Experience in border management and migration | 20% |
| Data protection and privacy experience | 15% |
| Proposed methodology | 15% |
| Regional/SADC experience | 10% |
| Total | 100% |
Only candidates obtaining at least 70% of the technical score shall proceed to financial evaluation.
QUALIFICATIONS AND EXPERIENCE
Education
Advanced university degree (Master’s degree or equivalent) in:
- Law.
- International Law.
- Public Law.
- Human Rights Law.
- Information Technology Law.
- Data Protection Law.
- Related field.
Experience
The consultant must possess:
- Minimum 7 years of professional experience in legal and regulatory analysis.
- Experience conducting legal assessments for government institutions.
- Demonstrated knowledge of migration governance and border management.
- Experience in data protection, privacy, cybersecurity or ICT regulation.
- Experience working with international organizations or development agencies.
- Experience in Southern Africa or the SADC region is highly desirable.
- Knowledge of biometric identification systems, border management information systems, or digital identity systems is an advantage.
SKILLS
Technical Competencies
- Strong legal drafting skills.
- Analytical ability.
- Policy analysis expertise.
- Research skills.
- Knowledge of data protection principles.
- Knowledge of migration governance frameworks.
Core Competencies
- Professionalism.
- Integrity.
- Accountability.
- Teamwork.
- Effective communication.
- Cultural sensitivity.
LANGUAGES
For this consultancy, proficiency in English, the required language(s), will be specifically evaluated during the selection process, which may include written and/or oral assessments.
REQUIRED COMPETENCIES
IOM’s competency framework can be found on the IOM website. Competencies will be assessed during the selection process.
Values
All IOM staff members must abide by and demonstrate these values:
- Inclusion and respect for diversity: Respects and promotes individual and cultural differences. Encourages diversity and inclusion.
- Integrity and transparency: Maintains high ethical standards and acts in a manner consistent with organizational principles, rules and standards of conduct.
NOTES
IOM covers Consultants against occupational accidents and illnesses under the Compensation Plan (CP), free of charge, for the duration of the consultancy. IOM does not provide evacuation or medical insurance for reasons related to non-occupational accidents and illnesses. Consultants are responsible for their own medical insurance for non-occupational accident or illness and will be required to provide written proof of such coverage before commencing work.
Any offer made to the candidate in relation to this vacancy notice is subject to funding confirmation.
Appointment will be subject to certification that the candidate is medically fit for appointment, accreditation, any residency or visa requirements, and security clearances.
IOM has a zero-tolerance policy on conduct that is incompatible with the aims and objectives of the United Nations and IOM, including sexual exploitation and abuse, sexual harassment, abuse of authority and discrimination based on gender, nationality, age, race, sexual orientation, religious or ethnic background or disabilities.
IOM does not charge a fee at any stage of its recruitment process (application, interview, processing, training or other fee). IOM does not request any information related to bank accounts.
IOM only accepts duly completed applications submitted through the IOM e-Recruitment system. The online tool also allows candidates to track the status of their application.
No late applications will be accepted. Only shortlisted candidates will be contacted.
REQUIRED SKILLS
- Professionalism.
- Strong legal drafting skills.
- Knowledge of data protection principles.
- Knowledge of migration governance frameworks.
- Policy analysis expertise.
- Research skills.
HOW TO APPLY
Interested candidates are invited to submit their applications through the official IOM e-Recruitment portal using the link below:
Apply Here – National/International Legal Consultant – MIDAS Legal Assessment
Closing Date: 13 November 2026 at 16:00.
Only duly completed applications submitted through the IOM e-Recruitment system will be accepted. No late applications will be considered. Only shortlisted candidates will be contacted.