LATIDIA · Ciberseguridad

Extracción automatizada de registros de actividades de procesamiento (RoPA) utilizando RAG híbrido y modelos de lenguaje grande implementados localmente

arXiv: 2609.27359v1Tipo de anuncio: Cross Resumen: La Ley de Protección de Datos Personales de Vietnam (Ley N ° 91/2025/QH15) y el Decreto N ° 356/2025/ND-CP, a partir del 1 de enero de 2026, requieren que las organizaciones establezcan y mantengan Re

La noticia

arXiv:2609.27359v1 Announce Type: cross Abstract: Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP, effective January 1, 2026, require organizations to establish and maintain Records of Processing Activities (RoPA). Manual RoPA preparation is labor-intensive, while cloud-hosted large language models (LLMs) may conflict with data-sovereignty requirements. We propose RoPA Manager, a system for automated RoPA information extraction using hybrid retrieval that combines lexical ranking over tsvector, dense-vector search, Reciprocal Rank Fusion (RRF), and locally deployed LLMs. We introduce a Vietnamese RoPA benchmark with 32 organizations, 77 processing activities, 12 field groups, and 4,338 reference values. Evaluation is reported at three distinct levels. The automated scorer, tested on perturbed