Automated Extraction of Records of Processing Activities (RoPA) Using Hybrid RAG and Locally Deployed Large Language Models
Researchers built RoPA Manager to extract Vietnam data-protection records using hybrid RAG and local LLMs.
Vietnam's Personal Data Protection Law and Decree 356/2025, effective January 1, 2026, require organizations to maintain Records of Processing Activities. RoPA Manager automates extraction with lexical tsvector ranking, dense-vector search, Reciprocal Rank Fusion, and locally deployed LLMs. A Vietnamese benchmark covers 32 organizations, 77 activities, and 4,338 reference values, with end-to-end token coverage of 50.04-55.25%. On a 24 GB GPU, Qwen3.5-27B-GPTQ-Int4 showed no significant difference from DeepSeek-V4-Flash, while Gemma-4-31B was significantly worse.
- Vietnam's data-protection law requires RoPA from January 1, 2026.
- Hybrid retrieval combines tsvector, dense vectors, and Reciprocal Rank Fusion.
- End-to-end token coverage was 50.04-55.25% across 4,338 reference values.
- Local Qwen3.5-27B matched DeepSeek-V4-Flash; Gemma-4-31B performed worse.
Full article207 words · extracted from arxiv.org · click to collapse
Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP, effective January 1, 2026, require organizations to establish and maintain Records of Processing Activities (RoPA). Manual RoPA preparation is labor-intensive, while cloud-hosted large language models (LLMs) may conflict with data-sovereignty requirements. We propose RoPA Manager, a system for automated RoPA information extraction using hybrid retrieval that combines lexical ranking over tsvector, dense-vector search, Reciprocal Rank Fusion (RRF), and locally deployed LLMs. We introduce a Vietnamese RoPA benchmark with 32 organizations, 77 processing activities, 12 field groups, and 4,338 reference values. Evaluation is reported at three distinct levels. The automated scorer, tested on perturbed data without invoking an LLM, achieved F1 = 0.9493 [0.9436, 0.9548]; this measures scorer robustness rather than end-to-end extraction accuracy. End-to-end extraction achieved token coverage of 50.04-55.25% against the reference labels. Two independent experts reviewed 1,558 reference values (35.9% of the benchmark), found no incorrect values, and achieved 99.68% agreement with PABAK = 0.9936. Value-level precision was not measured. Across 32 paired scenarios on a 24 GB GPU, locally deployed Qwen3.5-27B-GPTQ-Int4 showed no statistically significant difference from cloud-based DeepSeek-V4-Flash (difference 0.20 percentage points in favor of DeepSeek, 95% CI [-0.93, 1.32], p = 0.72), while Gemma-4-31B performed significantly worse (p < 0.01).
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.27359