An outsourcing RFP, or request for proposal, is the document you issue to prospective providers setting out what you need and inviting structured bids you can compare on equal terms. Done well, it turns vendor selection from a sales-led conversation into an evidence-based decision. This guide explains what to put in the RFP, the questions to ask on capability, security and compliance, how to evaluate responses, and the service level basics to lock down before you sign. It is written with Kenya engagements in mind for UK and US buyers. See our outsourcing to Kenya overview for context.
Key Facts
| Item | Position |
|---|---|
| RFP purpose | Compare providers on a common, scored basis |
| Kenya time zone | GMT+3, no daylight saving |
| UK working-day overlap | 5-6 hours |
| Kenya data law | Data Protection Act 2019, enforced by the ODPC |
| ODPC registration | Mandatory above thresholds (turnover > KES 5m, or >10 employees, or sensitive data / 10,000+ data subjects) |
| Breach notification | Within 72 hours |
| UK transfer tool | IDTA plus Transfer Risk Assessment (no UK adequacy for Kenya) |
| Security standards | Treat ISO 27001 / HIPAA as aligned controls, not certification claims |
| Legal system | Common Law, contracts broadly familiar to UK firms |
| EOR fee | USD 199-770 per employee per month (most 300-600) |
Key terms
- RFP
- Request for proposal: a structured invitation to bid that lets you compare providers on the same criteria.
- Service level (SLA)
- A measurable performance commitment with a defined measurement method, reporting cadence and consequences.
- Aligned controls
- Security practices that follow the structure of a recognised standard without an external certification claim.
Set the objectives and scope
Answer: Open the RFP with clear objectives, scope and volumes, because bidders can only price and design well against a precise brief.
State what you are outsourcing, the outcomes you want, the volumes, and the working hours required. For a Kenya engagement, note the GMT+3 time zone and the 5-6 hour UK overlap if live coverage matters. Specify whether you need a customer support, finance or other function, and whether you expect the provider to recruit, employ and manage staff or simply deliver outputs. Define what success looks like in measurable terms, as these become your service levels later. A vague brief produces vague, hard-to-compare bids.
Ask the right capability questions
Answer: Probe track record, staffing, and how the provider will actually deliver, not just whether they can.
Ask for relevant experience, references, the qualifications of the team, and how the provider sources and retains people, given the market sees roughly 15-20% attrition in some roles. Kenya offers a strong base to draw from: 123,366 university graduates in 2024 and over 40,000 ICPAK-qualified accountants. Ask how work is supervised, how quality is assured, and how the provider handles ramp-up and continuity if a key person leaves. Request a sample delivery plan so you can see their method rather than their pitch. Continuity and supervision separate durable providers from cheap ones.
Ask the security and compliance questions
Answer: Make security and compliance a scored section, covering Kenya’s data law, breach handling and cross-border transfers.
This section is where many RFPs are too thin. Ask how the provider complies with Kenya’s Data Protection Act 2019, whether they are registered with the Office of the Data Protection Commissioner where the thresholds apply (turnover above KES 5m, more than 10 employees, or sensitive data or 10,000+ data subjects), and how they meet the 72-hour breach notification rule. For UK buyers, ask how they support the IDTA and a Transfer Risk Assessment, since Kenya has no UK adequacy decision and remote access to UK personal data is a restricted transfer. Ask about technical and organisational controls, and treat any reference to ISO 27001 or HIPAA as a claim of aligned controls to verify, not certification. US buyers should confirm contractual handling of state-law obligations.
Evaluate with a weighted matrix
Answer: Score every bid against the same weighted criteria so the decision rests on evidence rather than impression.
Build a matrix with weighted categories. A workable starting set:
| Criterion | What you are assessing |
|---|---|
| Capability and track record | Relevant experience, references, method |
| Security and compliance | Data law, transfers, controls, breach handling |
| Commercial terms | Total cost, structure, transparency |
| Service levels | Measurability and ambition of commitments |
| Fit | Time-zone overlap, communication, culture |
| Continuity | Staffing stability, business continuity, exit |
Score each bidder, document the reasoning, and shortlist for interview. On cost, compare like with like: a fully-loaded Kenyan seat runs roughly USD 870-1,160 per month, and EOR fees USD 199-770 per employee per month. Our costs overview helps you sense-check pricing.
Lock down the service levels
Answer: Agree a small number of measurable service levels tied to your outcomes, each with a defined measurement method and consequences.
Resist the urge to over-engineer service levels. Pick the few that genuinely matter, such as quality, turnaround or response time, and availability. For each, define exactly how it is measured, how often it is reported, what counts as a breach, and what happens on sustained underperformance. Include data protection obligations, confidentiality and intellectual property terms, and exit provisions. Kenya’s Common Law system makes well-drafted commercial contracts broadly familiar to UK firms, and the compliance framework should be annexed where personal data is involved. Take professional advice on the final contract.
Key Takeaways
- A precise objectives-and-scope section is what makes bids comparable.
- Probe capability through method, supervision and continuity, not just claims.
- Make security and compliance a scored section covering the DPA, breach rules and UK transfers.
- Use a weighted matrix and a small set of measurable service levels tied to outcomes.
Looking for a Kenya outsourcing partner?
A serious provider will answer your security and compliance questions in detail and commit to service levels you can measure.
Find a Kenya Outsourcing Partner →
Frequently Asked Questions
What should an outsourcing RFP include?
An outsourcing RFP should set out your objectives, scope and volumes, the questions you want answered on capability, security and compliance, the commercial information you need, and the evaluation criteria you will score against. It should also state required service levels and the timeline for selection.
What security and compliance questions should I ask a Kenya vendor?
Ask how they comply with Kenya’s Data Protection Act 2019, whether they are registered with the ODPC where thresholds apply, how they handle breach notification within 72 hours, and how they support UK cross-border transfers using the IDTA and a Transfer Risk Assessment. Ask about their security controls and any aligned standards.
How should I evaluate outsourcing vendors?
Score against weighted criteria covering capability and track record, security and compliance, commercial terms, service levels, cultural and time-zone fit, and continuity. A weighted matrix keeps the decision objective and lets you compare bidders on the same basis.
What service levels matter most in an outsourcing contract?
Focus on the few service levels that map to your outcomes, such as quality, turnaround or response time, and availability. Each should be measurable, with a defined method, reporting cadence, and consequences for sustained underperformance.
Sources & References
- Office of the Data Protection Commissioner (Kenya), “Data Protection Act, 2019,” accessed 2026-06-13. https://www.odpc.go.ke/
- UK Information Commissioner’s Office, “International transfers,” accessed 2026-06-13. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
- KenInvest, “Why Invest in Kenya,” accessed 2026-06-13. https://www.investkenya.go.ke/
- Kenya National Bureau of Statistics, accessed 2026-06-13. https://www.knbs.or.ke/
Published by Outsourcing.ke.
Further Reading
- Compliance Overview — the four pillars to assess in a bid
- Kenya Data Protection Act — the law your vendor must meet
- Costs Overview — how to sense-check vendor pricing
- Employer of Record Kenya — EOR services for firms entering Kenya