越南学者用本地部署 LLM 与混合 RAG 自动生成数据处理活动记录
Automated Extraction of Records of Processing Activities (RoPA) Using Hybrid RAG and Locally Deployed Large Language Models
越南 PDPD 合规催生的实用论文：本地跑 Qwen3.5-27B 配混合 RAG，效果追平云端 DeepSeek-V4-Flash，还公开了越南语 RoPA 基准。
越南《个人数据保护法》（Law No. 91/2025/QH15）及 Decree No. 356/2025/ND-CP 将于 2026 年 1 月 1 日生效，要求企业维护数据处理活动记录（RoPA）。论文提出 RoPA Manager 系统，结合 tsvector 词法检索、稠密向量搜索与 Reciprocal Rank Fusion（RRF）混合检索，并使用本地部署的 LLM 提取信息，以规避云端模型与数据主权要求的冲突。基准涵盖 32 家组织、77 项处理活动、12 个字段组和 4,338 个参考值。端到端提取的 token 覆盖率为 50.04-55.25%；在 24 GB GPU 上，本地部署的 Qwen3.5-27B-GPTQ-Int4 与云端 DeepSeek-V4-Flash 无统计学显著差异（差 0.20 个百分点，p = 0.72），Gemma-4-31B 则明显更差（p < 0.01）。
Automated Extraction of Records of Processing Activities (RoPA) Using Hybrid RAG and Locally Deployed Large Language Models
Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP, effective January 1, 2026, require organizations to establish and maintain Records of Processing Activities (RoPA). Manual RoPA preparation is labor-intensive, while cloud-hosted large language models (LLMs) may conflict with data-sovereignty requirements. We propose RoPA Manager, a system for automated RoPA information extraction using hybrid retrieval that combines lexical ranking over tsvector, dense-vector search, Reciprocal Rank Fusion (RRF), and locally deployed LLMs. We introduce a Vietnamese RoPA benchmark with 32 organizations, 77 processing activities, 12 field groups, and 4,338 reference values. Evaluation is reported at three distinct levels. The automated scorer, tested on perturbed data without invoking an LLM, achieved F1 = 0.9493 [0.9436, 0.9548]; this measures scorer robustness rather than end-to-end extraction accuracy. End-to-end extraction achieved token coverage of 50.04-55.25% against the reference labels. Two independent experts reviewed 1,558 reference values (35.9% of the benchmark), found no incorrect values, and achieved 99.68% agreement with PABAK = 0.9936. Value-level precision was not measured. Across 32 paired scenarios on a 24 GB GPU, locally deployed Qwen3.5-27B-GPTQ-Int4 showed no statistically significant difference from cloud-based DeepSeek-V4-Flash (difference 0.20 percentage points in favor of DeepSeek, 95% CI [-0.93, 1.32], p = 0.72), while Gemma-4-31B performed significantly worse (p < 0.01).
