Automated Extraction of Records of Processing Activities (RoPA) Using Hybrid RAG and Locally Deployed Large Language Models
Researchers built RoPA Manager to extract Vietnam data-protection records using hybrid RAG and local LLMs.
Vietnam's Personal Data Protection Law and Decree 356/2025, effective January 1, 2026, require organizations to maintain Records of Processing Activities. RoPA Manager automates extraction with lexical tsvector ranking, dense-vector search, Reciprocal Rank Fusion, and locally deployed LLMs. A Vietnamese benchmark covers 32 organizations, 77 activities, and 4,338 reference values, with end-to-end token coverage of 50.04-55.25%. On a 24 GB GPU, Qwen3.5-27B-GPTQ-Int4 showed no significant difference from DeepSeek-V4-Flash, while Gemma-4-31B was significantly worse.
- Vietnam's data-protection law requires RoPA from January 1, 2026.
- Hybrid retrieval combines tsvector, dense vectors, and Reciprocal Rank Fusion.
- End-to-end token coverage was 50.04-55.25% across 4,338 reference values.
- Local Qwen3.5-27B matched DeepSeek-V4-Flash; Gemma-4-31B performed worse.
- Products
- RoPA Manager
- Countries
- Vietnam
From the original article
1 min read at arxiv.orgVietnam's Personal Data Protection Law (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP, effective January 1, 2026, require organizations to establish and maintain Records of Processing Activities (RoPA).
By To Duy Hinh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.