# migrations

dir: embeddings_queue
filename: 00001-embeddings.sqlite.sql
hash: d3755dfd232be8e8301f4d7fcfb3a486
sql:
CREATE TABLE embeddings_queue (
    seq_id INTEGER PRIMARY KEY,
    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    operation INTEGER NOT NULL,
    topic TEXT NOT NULL,
    id TEXT NOT NULL,
    vector BLOB,
    encoding TEXT,
    metadata TEXT
);


dir: sysdb
filename: 00001-collections.sqlite.sql
hash: 38352d725ad1c16074fac420b22b4633
sql:
CREATE TABLE collections (
    id TEXT PRIMARY KEY,
    name TEXT NOT NULL,
    topic TEXT NOT NULL,
    UNIQUE (name)
);

CREATE TABLE collection_metadata (
    collection_id TEXT REFERENCES collections(id) ON DELETE CASCADE,
    key TEXT NOT NULL,
    str_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (collection_id, key)
);


dir: sysdb
filename: 00002-segments.sqlite.sql
hash: 2913cb6a503055a95f625448037e8912
sql:
CREATE TABLE segments (
    id TEXT PRIMARY KEY,
    type TEXT NOT NULL,
    scope TEXT NOT NULL,
    topic TEXT,
    collection TEXT REFERENCES collection(id)
);

CREATE TABLE segment_metadata (
    segment_id TEXT  REFERENCES segments(id) ON DELETE CASCADE,
    key TEXT NOT NULL,
    str_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (segment_id, key)
);


dir: sysdb
filename: 00004-tenants-databases.sqlite.sql
hash: 048867ce8fcdefe4023c7110e4433591
sql:
CREATE TABLE IF NOT EXISTS tenants (
    id TEXT PRIMARY KEY,
    UNIQUE (id)
);

CREATE TABLE IF NOT EXISTS databases (
    id TEXT PRIMARY KEY, -- unique globally
    name TEXT NOT NULL, -- unique per tenant
    tenant_id TEXT NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
    UNIQUE (tenant_id, name) -- Ensure that a tenant has only one database with a given name
);

CREATE TABLE IF NOT EXISTS collections_tmp (
    id TEXT PRIMARY KEY, -- unique globally
    name TEXT NOT NULL, -- unique per database
    topic TEXT NOT NULL,
    dimension INTEGER,
    database_id TEXT NOT NULL REFERENCES databases(id) ON DELETE CASCADE,
    UNIQUE (name, database_id)
);

-- Create default tenant and database
INSERT OR REPLACE INTO tenants (id) VALUES ('default_tenant'); -- The default tenant id is 'default_tenant' others are UUIDs
INSERT OR REPLACE INTO databases (id, name, tenant_id) VALUES ('00000000-0000-0000-0000-000000000000', 'default_database', 'default_tenant');

INSERT OR REPLACE INTO collections_tmp (id, name, topic, dimension, database_id)
    SELECT id, name, topic, dimension, '00000000-0000-0000-0000-000000000000' FROM collections;
DROP TABLE collections;
ALTER TABLE collections_tmp RENAME TO collections;


dir: sysdb
filename: 00005-remove-topic.sqlite.sql
hash: b1367c826b8fba5f96f27befdc1d42d2
sql:
-- Remove the topic column from the Collections and Segments tables

ALTER TABLE collections DROP COLUMN topic;
ALTER TABLE segments DROP COLUMN topic;


dir: sysdb
filename: 00006-collection-segment-metadata.sqlite.sql
hash: 4eea7468935bf25d4604a0fed2366116
sql:
-- SQLite does not support adding check with alter table, as a result, adding a check
-- involve creating a new table and copying the data over. It is over kill with adding
-- a boolean type column. The application write to the table needs to ensure the data
-- integrity.
ALTER TABLE collection_metadata ADD COLUMN bool_value INTEGER;
ALTER TABLE segment_metadata ADD COLUMN bool_value INTEGER;


dir: sysdb
filename: 00007-collection-config.sqlite.sql
hash: 1c7e63bba346a42a18b6ab7f1c989bed
sql:
-- Stores collection configuration dictionaries.
ALTER TABLE collections ADD COLUMN config_json_str TEXT;


dir: sysdb
filename: 00008-maintenance-log.sqlite.sql
hash: 0a0e7e93111a01789addf64961c6127c
sql:
-- Records when database maintenance operations are performed.
-- At time of creation, this table is only used to record vacuum operations.
CREATE TABLE maintenance_log (
  id INT PRIMARY KEY,
  timestamp INT NOT NULL,
  operation TEXT NOT NULL
);


dir: sysdb
filename: 00009-segment-collection-not-null.sqlite.sql
hash: 054355aef9e63702bf54ea29e61563f1
sql:
-- This makes segments.collection non-nullable.
CREATE TABLE segments_temp (
    id TEXT PRIMARY KEY,
    type TEXT NOT NULL,
    scope TEXT NOT NULL,
    collection TEXT REFERENCES collection(id) NOT NULL
);

INSERT INTO segments_temp SELECT * FROM segments;
DROP TABLE segments;
ALTER TABLE segments_temp RENAME TO segments;


dir: metadb
filename: 00001-embedding-metadata.sqlite.sql
hash: 2b4cf52c4bb2676e21d6860a4409f856
sql:
CREATE TABLE embeddings (
    id INTEGER PRIMARY KEY,
    segment_id TEXT NOT NULL,
    embedding_id TEXT NOT NULL,
    seq_id BLOB NOT NULL,
    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    UNIQUE (segment_id, embedding_id)
);

CREATE TABLE embedding_metadata (
    id INTEGER REFERENCES embeddings(id),
    key TEXT NOT NULL,
    string_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (id, key)
);

CREATE TABLE max_seq_id (
    segment_id TEXT PRIMARY KEY,
    seq_id BLOB NOT NULL
);

CREATE VIRTUAL TABLE embedding_fulltext USING fts5(id, string_value);


dir: metadb
filename: 00002-embedding-metadata.sqlite.sql
hash: 12a570f7121b3a8ce750a2a7c36da20f
sql:
-- SQLite does not support adding check with alter table, as a result, adding a check
-- involve creating a new table and copying the data over. It is over kill with adding
-- a boolean type column. The application write to the table needs to ensure the data
-- integrity.
ALTER TABLE embedding_metadata ADD COLUMN bool_value INTEGER


dir: metadb
filename: 00003-full-text-tokenize.sqlite.sql
hash: f97ad6334aeaa8f419f01110b648b97a
sql:
CREATE VIRTUAL TABLE embedding_fulltext_search USING fts5(string_value, tokenize='trigram');
INSERT INTO embedding_fulltext_search (rowid, string_value) SELECT rowid, string_value FROM embedding_metadata;
DROP TABLE embedding_fulltext;


dir: metadb
filename: 00004-metadata-indices.sqlite.sql
hash: fb36603a45ee2cd0254cef3ef86585e8
sql:
CREATE INDEX IF NOT EXISTS embedding_metadata_int_value ON embedding_metadata (key, int_value) WHERE int_value IS NOT NULL;
CREATE INDEX IF NOT EXISTS embedding_metadata_float_value ON embedding_metadata (key, float_value) WHERE float_value IS NOT NULL;
CREATE INDEX IF NOT EXISTS embedding_metadata_string_value ON embedding_metadata (key, string_value) WHERE string_value IS NOT NULL;


# embeddings_queue

created_at: 2025-02-25 13:22:55
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b9201424-efdc-406d-916b-8e60c2ce6fb0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-001", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Conduct training for all staff involved in Privacy Policy creation and update process, such as product managers, developers, and QA personnel, to ensure they understand Privacy Policy and correctly implement any new changes."}


created_at: 2025-02-25 13:22:57
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cb703f2a-6375-427a-878a-0f9840279f3c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-002", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Develop training programs for all personnel involved, including but not limited to product managers, developers, and QA, on the format, content, and deployment strategies for non-Privacy Policy notifications or consents (such as pop-ups). Ensure these team members are fully aware of the requirements and implement them effectively."}


created_at: 2025-02-25 13:22:59
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9cb1a941-78a8-4cc9-a853-12993a9d23b7
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-003", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Conduct regular training for all staff involved, on the standard operating procedures for setting up and managing cookie consent banners to ensure collection and processing of cookies are consistent with Cookie Policy."}


created_at: 2025-02-25 13:23:01
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9138dc44-534c-40bd-a7b9-1941724cb178
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-001", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Establish guidelines for display of Privacy Policy, specifying the wording, user interface (UI), and display timing, to ensure that data subjects are provided with data collection notices before data is collected."}


created_at: 2025-02-25 13:23:03
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8a1e3222-8419-4a76-81b1-78246c5864e1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-002", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Establish guidelines for non-Privacy Policy notifications, such as in-app pop-ups. The guidelines should include:  UIUX Requirements: Provide options for notifying formats, such as text, videos, or graphics, to enhance readability and efficiently convey essential information to users.Content Requirements: define the timing and content of notifications or consents. Ensure that the actual collection and processing align with the scope and purpose stated in the notification or consent."}


created_at: 2025-02-25 13:23:05
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 57f1bd2e-b4ab-4eba-b944-951751962a7b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-003", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Establish Cookie guidelines to align cookie banner practices with the Cookie Policy, specifying consent and withdrawal procedures for cookies, as well as consistency checking rules. This ensures that the collection and processing of cookies match user consent."}


created_at: 2025-02-25 13:23:07
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4ad8417d-d2c5-4d56-bd23-eb4b9cce548b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-001", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Set up a Privacy Policy management process to handle changes (including content, format, UIUX changes). This should cover change initiation, approval, and operational procedures to ensure correct Privacy Policy for right users (such as disabled users and young users) and regions."}


created_at: 2025-02-25 13:23:09
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8418c563-742d-42bf-b78b-fab5cb8cfb4a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-002", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Establish the trigger conditions and review process for user notification updates, clarify the application, approval, operation and verification process, in order to fulfill the annual update activity and significant update activity notification requirements of specific regional supervision (such as US GPRA)."}


created_at: 2025-02-25 13:23:11
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: a5bf5438-d054-47b8-9ad1-bed3b7c0ea86
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-003", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Set up a management process for non-Privacy Policy notification, to handle changes (including content, format, UIUX changes). This should cover change initiation, approval, and operational procedures to ensure accuracy. "}


created_at: 2025-02-25 13:23:13
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: a1f7681d-83e1-487f-b6e8-ae417fbcc7ae
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-004", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Set up a management process for Cookie Policy and Cookie banner UIUX configuration, specifying change initiation, approval, and operational procedures to ensure collection and processing of cookies are consistent with Cookie Policy."}


created_at: 2025-02-25 13:23:15
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 874cac7e-f27f-4f89-b5ca-775026142602
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-001", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Build technology to verify that Privacy Policy display properly when users register or first open the app (e.g. proper content display, functional links, and right UI)."}


created_at: 2025-02-25 13:23:17
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 877548c3-f412-40ad-bba4-6542d2beeb8c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-002", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Set up technical capability to support the display of pop-up (such as in-app notification related to the data collection/processing)."}


created_at: 2025-02-25 13:23:19
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 3348a6a6-8625-4890-ab8e-b103916a15d0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-003", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Build technology to verify that data collection and usage activities (e.g. data type, usage scenario) align with the commitments made to users in notifications (e.g. Privacy Policy, in-app pop up)."}


created_at: 2025-02-25 13:23:21
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b33e3fb6-290d-41fd-a212-ab6ebf34087f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-004", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Build technical tools for recording, monitoring, and managing the status of Privacy Policies and user consent status, to ensure subsequent data collection and processing are consistent with user authorization. For personal information collected based on user consent, provide the ability to manage and withdraw, and synchronize the status with third-party controllers or processors. For example, when a user withdraws consent, it is necessary to stop processing and notify the third parties."}


created_at: 2025-02-25 13:23:23
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 92218271-de12-4705-9961-9c36578676e0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-005", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Build technology to verify that Cookie Policy and Cookie banner display align with the regional compliance requirement, e.g. proper content display, functional links, and right UI. As well as other similar tracking technology."}


created_at: 2025-02-25 13:23:25
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f93c08e6-981e-4438-a00b-862f8fd056f5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-006", "po": "transparency", "subdomain": "notice, consent & purpose specification", "chroma:document": "Provide the opt-in and opt-out functions for Cookies that require users' consent. Build technology to manage and monitor opt-in and opt-out status to ensure data collection and usage activities align with our committment. "}


created_at: 2025-02-25 13:23:27
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 03a48914-f6ed-4795-afc8-4e3eb7b76d57
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-086", "po": "transparency", "subdomain": "user education", "chroma:document": "Build a user education knowledge center to centralize manage the information related to the data subject right and user notice/consent, to help user can easily get those information such as submit the request, report or appeal, ensure the transparency. "}


created_at: 2025-02-25 13:23:29
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 51edf7e0-4fcf-4458-bbf4-e055e3f6ea10
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-087", "po": "transparency", "subdomain": "user education", "chroma:document": "Build notification capability to notify the users (e.g. what kind of law enforcement request)  when their personal information need to be accessed or shared to meet the regulator requirement. "}


created_at: 2025-02-25 13:23:31
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 52153739-0433-4192-b6b6-ef054ca8af14
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-016", "po": "privacy by design", "subdomain": "product & process review policy", "chroma:document": "Conduct PbD guideline training for affected employees, to ensure employees understand PbD principles, review and verification standards, and compliance solutions for general/special scenario. "}


created_at: 2025-02-25 13:23:34
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c5ba516d-710c-45be-b7ea-19a21768b712
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-017", "po": "privacy by design", "subdomain": "product & process review policy", "chroma:document": "Conduct training for affected employees on PbD and problem response and disposal process, to ensure that employees knows the process nodes, review/verification/disposal methods, timeline and POC."}


created_at: 2025-02-25 13:23:36
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4779c45d-eeb5-4103-b6af-5a91ad02826a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-022", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Provide training courses for all affected employees regarding DPIA Guideline and related processes, retain training courseware and training records, and ensure that the training recipients understand DPIA's trigger conditions, compliance significance, process timeline, and relevant parties before designing products and features."}


created_at: 2025-02-25 13:23:38
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 11a23ca5-90d3-4885-9771-f355cb61d2ec
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-031", "po": "privacy by design", "subdomain": "product & process review policy", "chroma:document": "Establish PbD guideline to clarify meaning, goals, and implementation methods of PbD. Provide compliance solutions and rules in general/special scenarios throughout the product and feature life cycle (e.g. design, development, test, release, operation, and offline), including but not limited to feature design principle, system design principle, code standard, data management, dark pattern etc."}


created_at: 2025-02-25 13:23:40
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6c79513d-90de-44b9-8727-90dc19d6e222
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-051", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Establish DPIA Guideline to clarify the definition of DPIA, the different requirements of DPIA in various jurisdictions, the impact and objectives of DPIA, the paradigm of DPIA, etc."}


created_at: 2025-02-25 13:23:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cd4ff1b1-54cc-4f72-b819-8cbe89bdbcda
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-065", "po": "privacy by design", "subdomain": "product & process review policy", "chroma:document": "Set up a platform to support PbD process and problem response and disposal process, providing online management capabilities throughout the product and feature life cycle (e.g. design, development, test, release, operation, and offline) . Its functions include process management, information recording and displaying, change and exception notification, permission control, etc."}


created_at: 2025-02-25 13:23:44
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ddb93882-f50c-4b9b-a4ea-c3f41b2e171e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-066", "po": "privacy by design", "subdomain": "product & process review policy", "chroma:document": "Set up a privacy compliance process and conduct the review on the product and feature design proposal (e.g. PRD, technical solutions, UIUX demo) to identify potential issues (e.g. dark patterns) ; and clarify the roles, review object, timeline, trigger and method etc., to ensure compliance with guidelines and special requirements in different jurisdictions, and there is no conflict with launched products and features."}


created_at: 2025-02-25 13:23:46
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 676f3dbe-08fc-45ed-b7d5-9f3a3107e9b5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-067", "po": "privacy by design", "subdomain": "product & process review policy", "chroma:document": "Set up privacy compliance review process for vendors who processes personal information. Before product design, provide vendors with PbD guideline and process requirements and evaluate vendors's capability. Conduct compliance review based on the design proposal of products and features provided by vendors."}


created_at: 2025-02-25 13:23:48
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6135c417-5558-4699-978b-0ee874b93691
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-068", "po": "privacy by design", "subdomain": "product & process review policy", "chroma:document": "Set up review process before offline product and feature, evaluate offline proposal, clarify roles, timeline, standards, etc. If there are special circumstances that require delay or extended retention, exemption review should be carried out."}


created_at: 2025-02-25 13:23:50
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b76095da-67f1-4688-9305-0ef616d33e4b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-069", "po": "privacy by design", "subdomain": "verification", "chroma:document": "Set up a privacy technical review process and conduct review and test on technical solution and technical facts to identify potential issues, clarify roles, tools, scope, content, timeline, etc, to ensure that products and features comply with the PbD guideline technically."}


created_at: 2025-02-25 13:23:52
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: a8008955-3739-49ea-8e68-11bedd95deaa
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-070", "po": "privacy by design", "subdomain": "verification", "chroma:document": "Set up a privacy technical verification process to maintain records of PbD process and results and compliance solution execution, technical detection data etc, develop plan for manual and technical verification combined with external regulatory requirements and privacy policies,, clarify roles, trigger, tools, scope, timeline, etc, to ensure effectiveness of PbD capabilities."}


created_at: 2025-02-25 13:23:54
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ae5fb1ca-4f01-4a9f-a226-b77ccbc1fdb0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-071", "po": "privacy by design", "subdomain": "verification", "chroma:document": "Set up privacy compliance verification process for vendors who processes personal information. Verify the products and features provided by vendors based on manual and technical capabilities, clarify scope, timeline, method, etc., and link with the problem response and disposal process."}


created_at: 2025-02-25 13:23:56
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 82f7607b-334b-4f0a-b323-a5535444b5d4
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-072", "po": "privacy by design", "subdomain": "verification", "chroma:document": "Set up feedback compliance review process. When privacy concerns are raised by users, testing agencies or others, conduct targeted privacy review and technical verifications, develop adjustment plans and complete iteration to ensure that privacy feedback can be promptly and accurately reviewed, verified and disposed."}


created_at: 2025-02-25 13:23:58
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f162e28e-8662-4181-9c16-15806b644a96
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-073", "po": "privacy by design", "subdomain": "verification", "chroma:document": "Set up offline testing process, use manual or technical means to test products and features that have already implemented offline plans, to ensure that data processing activities within the offline scope are effectively terminated, historical data is effectively disposed of, etc."}


created_at: 2025-02-25 13:24:00
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: eda16775-2e5e-439c-996e-5405134dbcf5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-074", "po": "privacy by design", "subdomain": "verification", "chroma:document": "Set up problem response and disposal process for PbD, clarifying the roles and responsibilities, advancing the timely warning, risk assessment, plan formulation, upgrade decision-making, follow-up disposal, review and verification, and accountability for violations."}


created_at: 2025-02-25 13:24:02
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: bf3b9eeb-83b3-4984-b705-7de7c0c0db5c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-107", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Establish DPIA trigger judgment process, clarify the trigger conditions and thresholds, collect and retain product/feature information (eg. data type, data processing purpose, etc.) used to determine whether DPIA is needed, output judgment conclusions based on DPIA Guideline, and record the judgment process and results information. Clarify the required information list, judgment party, judgment criteria, timeline etc., to ensure that the business team can provide relevant information efficiently and completely, and have basic expectations for whether DPIA should be carried out."}


created_at: 2025-02-25 13:24:04
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b717704b-697b-4327-93c2-063844e4be38
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-108", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Establish DPIA assessment process. For situations where DPIA is required, collect and retain product/feature information used to assess risks (eg. safety measures taken, user interaction mode etc.), output risk assessment conclusions (eg. risk level, risk mitigation plan, etc.), and record the assessment process and results information. Clarify the required information list, assessor, assessment criteria, timeline, etc."}


created_at: 2025-02-25 13:24:06
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1f1c3c3f-22fa-44ee-8d11-32997ff75bd4
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-109", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Establish DPIA assessment result implementation process. Implement risk mitigation plans based on DPIA risk assessment conclusions and record the implementation status. Clarify the responsible parties and timeline for implementation."}


created_at: 2025-02-25 13:24:08
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 3a833e9e-138c-477a-971e-07d0887b4436
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-110", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Establish DPIA verification process. For situations where DPIA plans have been implemented, formulate a verification plan based on the DPIA assessment conclusions, collect and process implementation information (eg. data retention, individual rights, etc.), and use manual and technical means to complete the verification. Clarify the verification party, trigger method, verification tool, verification scope, timeline, etc. Ensure that the DPIA risk mitigation plan is implemented accurately and timely."}


created_at: 2025-02-25 13:24:11
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 48f27185-5936-453d-9037-d04801dc6311
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-111", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Establish DPIA re- or supplementary assessment process. For situations where DPIA assessments have been conducted, determine the trigger conditions for re- or supplementary assessments based on DPIA Guideline (eg. substantial changes in feature/product/scenario, changes in laws and regulations, changes in data processing purposes and methods, etc.), collect the information required to determine whether the trigger conditions are met, and set up a regular review mechanism to conduct re- or supplementary assessments, and link with the DPIA implementation and verification process to track updates. Clarify the information list, assessor, timeline, etc."}


created_at: 2025-02-25 13:24:13
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 2d41b5d0-07ed-4f47-8178-b8c5f2c30f41
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-112", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Establish DPIA disclosure process. When a disclosure need arises (eg. from regulators), guide the DPIA confirmation, review, and disclosure process, clarify the roles and responsibilities, the form of disclosure, and the continuous follow-up mechanism after disclosure."}


created_at: 2025-02-25 13:24:15
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ea7e70c0-fa0f-4827-8b98-035fa7dbdbdf
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-097", "po": "privacy by design", "subdomain": "product & process review policy", "chroma:document": "Build configuration capability that cater to regions (eg. EU, US). It can perceive configuration results and verify compliance to meet privacy compliance requirements of different business scenarios and jurisdictions."}


created_at: 2025-02-25 13:24:17
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 076f5365-c634-4371-8e34-18bae8054466
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-098", "po": "privacy by design", "subdomain": "verification", "chroma:document": "During development, use static detection to identify risks and support code merge interception to ensure that the code complies with PbD guideline."}


created_at: 2025-02-25 13:24:19
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ea2d24a3-90da-4e6c-8df2-dc325183dbd1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-099", "po": "privacy by design", "subdomain": "verification", "chroma:document": "During continuous integration (\"CI\") progress, use technical means (eg. static and dynamic detection) to conduct unit and integration test, identify risks and support deployment interception to ensure that the test version complies with PbD guideline and conclusions."}


created_at: 2025-02-25 13:24:21
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7c003ebd-c0d0-461a-856a-46857dd9c703
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-100", "po": "privacy by design", "subdomain": "verification", "chroma:document": "During continuous deployment (\"CD\") to gray phase release, use technical means (eg. static, dynamic and traffic detection) to conduct regression test, identify risks and support release interception to ensure that the release version complies with PbD guideline and conclusions."}


created_at: 2025-02-25 13:24:23
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 36f0e3ba-6992-41f0-837c-9ed864738226
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-101", "po": "privacy by design", "subdomain": "verification", "chroma:document": "After product and feature full launch, use technical means to monitor online status, identify risks, warn timely and support controls (eg. cut off and offline) to ensure that the release version complies with PbD guideline and conclusions."}


created_at: 2025-02-25 13:24:25
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f224ba5c-eee9-4a96-8246-5ec4bed99bef
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-139", "po": "privacy by design", "subdomain": "data protection impact assessment (dpia)", "chroma:document": "Establish DPIA management tool, which can achieve: process automation/semi-automation management (including linkage between processes), recording and displaying information (eg. the current node, process results, etc.), synchronization of information (eg. changes in data processing purposes due to feature iterations), DPIA management (eg. uploading, downloading, adding, deleting, modifying), permission management, notification prompts (eg. triggering reassessment), data analysis, etc."}


created_at: 2025-02-25 13:24:27
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 28f0fb95-101a-40c7-99d4-3da2af7347c8
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-015", "po": "individual rights", "subdomain": "inquiry management", "chroma:document": "Conduct regular or irregular training on policy, process, and technology related to individual rights to all affected employees, and clarify relevant requirement. Additionally, retain all training material and records."}


created_at: 2025-02-25 13:24:29
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7b13b5d9-d5c1-4253-aa34-03945c3f0083
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-027", "po": "individual rights", "subdomain": "inquiry management", "chroma:document": "Establish individual rights response guidelines for each jurisdiction following the relevant laws. Include response rules for all individual rights (e.g.  right of access, right to rectification, right to data portability, right to erasure ) and specify response duration and requirement for different special scenarios."}


created_at: 2025-02-25 13:24:31
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 122abe07-44f5-4808-9caf-295830298b65
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-028", "po": "individual rights", "subdomain": "third party submissions", "chroma:document": "Establish guidelines to handle individual rights requests requested by third-party agents (e.g. request via in-app account, or other channels) for each jurisdiction following the relevant laws, specifying response rule such as response times, specific actions for general and special scenarios. "}


created_at: 2025-02-25 13:24:33
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: adeb57ad-e304-40cf-84fa-21833c7a2edc
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-050", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Set up individual rights response process, specifying roles and response, execution methods, key nodes, specific actions, and qualification conditions throughout the entire process. This process should match to existing business forms and flexible to expand for new scenarios."}


created_at: 2025-02-25 13:24:35
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 71333bcd-f97e-46a0-952e-f22ce596dc7f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-051", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Set up a conflict management process for managing conflicts arising from individual rights, which guides detection, evaluation, and resolution of conflicts. The process should clearly define potential scenarios of conflicts, relevant roles and responsibilty, evaluation rules, resolution methods, and qualification conditions etc..Example:- exercising rights in different countries, - user mode change during teh processing- exercise the right to erasure data during the period of exercise right to portability- conflicts between individual rights and public interests."}


created_at: 2025-02-25 13:24:38
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8b27b5ed-cfbc-455b-ac62-01e0182cf949
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-052", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Set up a data consistency check process that clarifies relevant POCs, inspection methods, expected results, and remediation resolutions when restoring backup data due to special circumstances.If restored data is different from the data used to respond to data subject rights, take immediate actions to ensure execution effectiveness."}


created_at: 2025-02-25 13:24:39
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 20320e82-9fb7-4faa-ab35-476ba5069615
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-053", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Set up a process for managing complaints, specifying role and responsibility, complaint evaluation, verify procedures, key nodes, specific actions and qualification conditions etc. Additionally, provide users with explanations regarding complaint rejections, if necessary, and offer the appropriate regulatory contact information for their region."}


created_at: 2025-02-25 13:24:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 23cbe514-b826-4c50-84bb-e19e24b2b12e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-054", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Set up a process for the disposition of data (such as copies and caches) generated during the response process. Define the data types, relevant POCs, caching mechanisms, and the disposition actions (such as direct deletion, temporary freezing, retention as evidence, etc.) . "}


created_at: 2025-02-25 13:24:44
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 83f920eb-4b85-420c-8d28-1f215b0530ab
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-055", "po": "individual rights", "subdomain": "inquiry management", "chroma:document": "Set up a process to verify the legitimacy of individual rights requests, defining key nodes, POC, operating procedures, and qualificartion conditions. Ensure that the request has a legal basis and does not fall under legal restrictions or exceptions."}


created_at: 2025-02-25 13:24:46
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 63949044-46d8-4d99-b9eb-2de654bd3b0b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-056", "po": "individual rights", "subdomain": "inquiry management", "chroma:document": "Set up SLA management process for responding to individual rights, specifying SLA in various countries/regions. Monitor and identify behaviors that may violate SLAs, send alerts to relevant POCs to follow-up. If SLA violations have occurred, escalation action must be taken (e.g. reasonable deferral, regulator report)."}


created_at: 2025-02-25 13:24:48
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 54970a73-7e8d-4002-a24f-282b20805046
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-057", "po": "individual rights", "subdomain": "third party submissions", "chroma:document": "Set up a process to handle individual rights requests submitted by third-party agents, determine the appropriate response mode and methods.defining the POC, execution methods, control nodes, specific actions, and admission criteria for different scenarios. Determine the appropriate response mode and methods\uff0cadditionally, define the responsibilities, standards, and response modes for third-party agents in responding to rights requests."}


created_at: 2025-02-25 13:24:50
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 06bbd653-fdf7-43bd-9635-c65d22bb0f9c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-058", "po": "individual rights", "subdomain": "third party submissions", "chroma:document": "Set up a third-party notify and cooperation process for individual right response, clarify scenarios in which they should be engaged, POC, notification methods, cooperation task, feedback deadlines and quality assurance etc. and follow up on progress. "}


created_at: 2025-02-25 13:24:52
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e1010212-b88f-4a83-93ec-2ba9721ac011
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-070", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build individual rights request capability for right to access, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS."}


created_at: 2025-02-25 13:24:54
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: eccb6eb3-8699-44b4-9715-4e3d8dcb26d5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-071", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build individual rights request capability for right to rectification, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS."}


created_at: 2025-02-25 13:24:56
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 62eca727-cfbf-41ec-ab53-a59780f06bc3
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-072", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build individual rights request capability for right to data portability, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS."}


created_at: 2025-02-25 13:24:58
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ec6f54d0-6bc6-4b91-b993-97d4c92d3fdd
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-073", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build individual rights request capability for right to erasure, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS."}


created_at: 2025-02-25 13:25:00
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 16c4dfe1-3e39-41a6-b73b-ab104f824beb
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-074", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build individual rights request capability for right to restriction of processing, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS."}


created_at: 2025-02-25 13:25:02
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ea933b33-6506-45c7-b79d-e040e5da8cfe
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-075", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build individual rights request capability for right not to be subject to automated decision-making, including profiling,including profiling, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS."}


created_at: 2025-02-25 13:25:04
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: db22513c-0d1c-443b-b567-ad9505a20598
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-076", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build encryption and de-identification capability for the data during individual rights fullfillment. Implement data isolation and access control technologies to ensure personal data is only accessible to authorized personnel, including the data subject and necessary participants. Avoid infringing on the rights of other users."}


created_at: 2025-02-25 13:25:06
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c0b196ab-ffcc-4bdb-b227-77b953d1ea74
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-077", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build capability to respond to \"right to access\". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to response, including data types, processing purposes, automated decision-making use, and data disclosure status etc.."}


created_at: 2025-02-25 13:25:08
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 569880a1-c039-454a-8c37-bd891b5c1a73
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-078", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build capability to respond to \"right to rectification\". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to rectify any inaccurate or incorrect personal data or automated decision-making results throughout the entire process."}


created_at: 2025-02-25 13:25:10
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 716c1572-e6ce-4ebd-9901-b6b91e79fcc8
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-079", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build capability to respond to \"right to data portability\". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to provide an electronic copy or assist the requester as necessary in transferring it to another entity."}


created_at: 2025-02-25 13:25:12
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e52eeb54-6d5a-4879-aa24-354e5e4dc08d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-080", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build capability to respond to \"right to erasure\". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to delete the requested personal data throughout the entire process. If litigation holds apply, invoke exemption capability of Data Retention System until litigation hold period expires. "}


created_at: 2025-02-25 13:25:14
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f685e41f-f411-4bf7-ba7c-80cbe0957461
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-081", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build capability to respond to \"right to restriction of processing\". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to restrict processing activities throughout the entire process and seal its historical record."}


created_at: 2025-02-25 13:25:16
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4e8f6909-9948-4a2c-834d-cd03747af389
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-082", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build capability to respond to \"right not to be subject to automated individual decision-making, including profiling\". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to provide users with actionable options to free from it and take appropriate actions based on the choice."}


created_at: 2025-02-25 13:25:18
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 0cc4ae97-91e0-4f2d-a7ce-378d9852a6e8
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-083", "po": "individual rights", "subdomain": "inquiry management", "chroma:document": "Build authentication capabilities for requesters (users/third parties). For in-app request, such as digital signatures and integrity checks can be used. For off-app request, such as QR codes, SMS verification codes, and passwords can be used. Minimize data collection while ensuring effective identity verification."}


created_at: 2025-02-25 13:25:20
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b2a3797a-ab20-4b5a-9c93-553fb9b12dea
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-084", "po": "individual rights", "subdomain": "inquiry management", "chroma:document": "Build inform capability of individual right response result and complaint disposal result, such as in-app pop-ups, website notification and email, notify the information (e.g. request status, execution result, deferal reason) to the requester in a timely manner with standardized format."}


created_at: 2025-02-25 13:25:22
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 76e47898-fbf0-47c6-81f4-286ba531a26c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-085", "po": "individual rights", "subdomain": "inquiry management", "chroma:document": "Establish a system to record individual rights requests, including relevant details like request status, contact information, country/region, request content, submission, receipt, and response time, response method, and refusal reasons. Ensure that this information is stored in compliance with legal requirements and is deleted appropriately once it has served its intended purpose."}


created_at: 2025-02-25 13:25:24
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: bd720a3e-8968-4d9f-ab1a-7b626cf232b7
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-102", "po": "individual rights", "subdomain": "inquiry management", "chroma:document": "Establish metrics to measure the quality of individual right responses, and use the capability to collect data on the distribution and response times of different individual right requests across the countries/regions covered by the strategy (such as average response time, response delay numbers, etc.) for reporting on the response to rights."}


created_at: 2025-02-25 13:25:26
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c5305277-3ea3-46ce-819b-47e9ca85f3b4
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-124", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build capability to respond to \"right to know\". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to provide relevant information, including data controller, processing purposes and legal basis, data retention period, and individual rights etc.."}


created_at: 2025-02-25 13:25:28
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6a19d55a-6b3c-44af-bc0b-91e6dd2dcef1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-125", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build capability to respond to \"right to object\". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to provide users with options to object data processing and take appropriate actions based on the choice."}


created_at: 2025-02-25 13:25:30
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e3a6b739-4003-423d-9573-9de05464907c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-137", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build individual rights request capability for right to know\uff08including the right to be provided information where personal data are collected from the data subject or from third party\uff09, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS."}


created_at: 2025-02-25 13:25:32
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 34b8f391-192c-455d-b99c-54e2082196f1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-138", "po": "individual rights", "subdomain": "individual rights fulfillment", "chroma:document": "Build individual rights request capability for right to object\uff08including the right to object processing based on legitimate interests,public interest,or direct marketing\uff09, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS."}


created_at: 2025-02-25 13:25:34
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8a718e37-6a7b-4185-84c1-ed2e092af760
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-009", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Conduct regular training for all employees on data sharing, including application process for data sharing, compliance requirements, potential risk and mitigation measures etc."}


created_at: 2025-02-25 13:25:36
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8c2c6f1f-4219-4ecf-bbdd-6af2505c2dde
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-010", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Conduct cross-border data transfer policies training to all relevant stakeholders, including USDS and Non-USDS members, anthorized and restricted personnel, CN and non-CN employees, applicants and approvers. Ensure everyone understands the latest policies, guidelines, and specifications during policy launches & changes, as well as daily operations involving data transfers. At the same time, an examination section is set up for necessary personnel, and the passing score and pass rate of the examination are determined to ensure that relevant personnel accurately understand and comply with the compliance requirements for cross-border data transfer."}


created_at: 2025-02-25 13:25:39
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b5a91a30-15ea-4ca4-aec2-3fe78f6be167
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-018", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "Provide regular/irregular cross-border data transfer related trainings to all relevant personnel to clarify requirements, and retain training materials and records."}


created_at: 2025-02-25 13:25:40
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 2099edc5-ed29-48ee-a76b-bb2992839199
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-020", "po": "data sharing", "subdomain": "government investigations and complaints", "chroma:document": "Conduct policy training for employees involved in law enforcement request response, introduce methods for determining the sensitivity level of response materials, and different control requirements for different levels."}


created_at: 2025-02-25 13:25:43
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 655e4edc-8fc8-4d36-82c6-66ea10f82dee
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-011", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Establish data sharing guidelines to clarify the requirements and execution rules, such as pre-sharing checkpoints, monitoring rules during sharing, data deletion after sharing, etc., and meet the legal requirements, contractual agreements, and privacy protection principles of different jurisdiction regions."}


created_at: 2025-02-25 13:25:45
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6d34f0d7-cee1-4be2-9cc7-3abf2cfb3046
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-012", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Establish purpose limitation guidelines for cross-board data transfer(before transfer and data usage after transfer), specifying data types, permitted transfer purposes, usage purpose restriction after the transfer etc."}


created_at: 2025-02-25 13:25:47
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 40a7df35-7c98-460c-b658-10f77b65daee
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-013", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Establish cross-border data transfer guidelines for different regions. These guidelines, tailored for groups like USDS, Non-USDS, authorized and restricted employees, CN and non-CN staff, offer detailed strategies for transferring data across data centers. They should cover requirements on data type, data access, data tags and classxifications, data transferring compliance rules, introduction of data transferring gateways, etc. "}


created_at: 2025-02-25 13:25:49
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: eb273ef1-dcaa-4751-af1b-03ac94415513
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-014", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Establish gateway guidelines for cross-border data transfer, specifying gateway type, configuration, data labels etc. for R&D and data analysts when they need to set up or update the transfer channels. "}


created_at: 2025-02-25 13:25:51
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ee0d7ac1-599d-4914-8cda-1b536b2d8d88
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-015", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Establish data catalog and data classification guidelines specifically for cross-border data transfer, including data category, data type, descriptions, data samples etc.for R&D, data analysts, security and compliance team when they need to apply, approve,  configurate the transfer channels. "}


created_at: 2025-02-25 13:25:53
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 586af51b-8dcf-44b1-b05c-0336392183d2
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-016", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Establish data cross-border transferring approval guidelines, when reviewing cross-border transfer requests from business teams, review teams should follow the clear approval guidelines and ensure approval result consistency.  "}


created_at: 2025-02-25 13:25:55
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ba33398f-bbd9-4452-a660-491f7c508b29
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-017", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Maintain a region list where data cross-border transfer is allowed/prohibited. Provide context and approval guidelines when employees apply for data cross-border transfer or access, including the list of cross-border data transmission regions and the list of region for employee access etc.."}


created_at: 2025-02-25 13:25:57
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 3b51084d-0438-4fea-99eb-0149f06da0c3
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-018", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Establish third party data transfer guidelines for cross-border data transfer, specifying gateway and channel configuration, data center restrictions etc. when transferring or receiving user data corss-border with third parties."}


created_at: 2025-02-25 13:25:59
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: dc0ad833-58b9-4aa2-b656-b790a323ebb6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-029", "po": "data sharing", "subdomain": "contractual obligations for third-parties", "chroma:document": "Establish data sharing agreement for signing with data recipient before data sharing, specifying the shared data scope, purpose, duration, protection measures (e.g. access control and encryption),and data return or destruction mechanisms. "}


created_at: 2025-02-25 13:26:01
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: fdaee0e4-5d1a-4763-a9f0-2693931651fb
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-030", "po": "data sharing", "subdomain": "third-party compliance", "chroma:document": "Establish a third party management guidline, specifying third party definitation, management requirments, execution rules in cooperation, such as due diligence and review checkpoint, contract review and signing, audit, event response, data return or deletion, etc., to ensure that data processing behavior during the cooperation is security and compliant."}


created_at: 2025-02-25 13:26:03
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f96070b5-c96c-4db5-9ac4-267511c10201
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-042", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "Establish cross-border data guidelines to clarify the requirements and execution rules for cross-border data transfer,such as the definition of cross-border data transfer, compliance requirements, etc., and meet the legal requirements of different jurisdiction regions."}


created_at: 2025-02-25 13:26:05
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: a04b4659-e874-4a0d-b6da-b8ef131de48d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-043", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "According to the \"adequacy decision\" requirements of GDPR or similar legal requirements, establish and regularly update the \"Adequacy Decision\" list under different jurisdictions (i.e., countries or regions considered to provide sufficient privacy protection levels), to ensure the accuracy of the list."}


created_at: 2025-02-25 13:26:07
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8cc3a59d-f5f4-4683-a786-a049d0869733
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-044", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "Establish legal basis identification guidelines for cross-border data transfer, sort out the legal basis, applicable premises and compliance measures in various jurisdictions, guide the identification and management of legal basis, and ensure the accurate identification and application of legal basis."}


created_at: 2025-02-25 13:26:09
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 940f7def-5373-4d70-9ab6-a8d531d3de00
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-045", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "Establish agreements for signing with data recipients before cross-border intracompany data transfers\uff0cand clarify the management requirements, such as the application of data cross-border transfer agreement templates, agreement review and signing, incident response, and data return or destruction mechanisms, to comply with the latest legal and regulatory requirements."}


created_at: 2025-02-25 13:26:11
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 3ad1f6fa-7c30-49fe-ba01-d8cbc7ab27a2
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-046", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "Establish agreement for signing with data recipient before cross-border data transfers with third parties, and clarify the management requirements, such as the application of data cross-border transfer agreement templates, agreement review and signing, incident response, and data return or destruction mechanisms, to comply with the latest legal and regulatory requirements."}


created_at: 2025-02-25 13:26:13
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 45c6bdc6-bb29-454f-8a7e-4dcd32903448
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-047", "po": "data sharing", "subdomain": "government investigations and complaints", "chroma:document": "Establish response policy for law enforcement requests, clarify control requirements during the response process, including timeliness requirements, traceability requirements for process records, authenticity and accuracy requirements for result materials, materials retention requirement, related roles and responbilities, and data security requirements for the entire process."}


created_at: 2025-02-25 13:26:15
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ac97da57-a86a-45aa-8986-756b86b80625
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-048", "po": "data sharing", "subdomain": "government investigations and complaints", "chroma:document": "Establish control requirements for the law enforcement response materials, clarify the P&C markings of the materials during preparation, access control requirements, usage purpose restrictions, and requirements for archiving and deleting after the response is completed."}


created_at: 2025-02-25 13:26:17
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: d54bb4e8-d023-4454-81d6-73563a6b3fd5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-049", "po": "data sharing", "subdomain": "government investigations and complaints", "chroma:document": "Establish control requirements for P&C materials, clarify the criteria for determining P&C mark, and establish access control, usage restrictions, archiving and deletion, and other requirements for materials marked as P&C."}


created_at: 2025-02-25 13:26:20
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7bef3c4f-c4eb-47dd-a1b3-cb0cf2e8fe07
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-017", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Set up data sharing application process, clarifying apply and review process, including submission entrance, submission material (e.g. requirement document, technology solution), review objective as well as roles and responsibilities etc.."}


created_at: 2025-02-25 13:26:22
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7c145e2b-d740-4db1-8cb4-2263752a485f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-018", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Set up data sharing change management process when changes in data sharing are identified through monitoring or proactive notifications from business parties. Ensure risk assessment, additional approval, and contract update are followed through when needed."}


created_at: 2025-02-25 13:26:24
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1cc8bff0-f9cd-4053-a977-cc159ab9e7ce
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-019", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Set up a data sharing termination process, specifying stakeholder communication, termination initiation and approval, operation and recovery process."}


created_at: 2025-02-25 13:26:26
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c74b7dfd-de1a-4a64-bd5f-913028144990
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-020", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Set up a process for data disposal after sharing is complete. Guide employees to ensure data recipients retain or delete shared personal data as per contract terms. Collect and verify evidence of the disposal outcomes, and clearly assign responsibilities for these actions."}


created_at: 2025-02-25 13:26:28
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 26faf5b1-a19b-45b3-8a6c-9a870b3004d0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-021", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Set up a management process for privacy event identified in data sharing, which should cover requirements on root cause analysis, follow-up action, remediation timeline, roles and responsibilities, documentation and record keeping etc. "}


created_at: 2025-02-25 13:26:30
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cc0cc8f6-2cc5-4ebf-828a-3e4d3b079adf
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-022", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Set up a due diligence process for third party vendors. Before sharing data, guide employees to thoroughly review the vendors' capabilities and qualifications to ensure they can securely handle data and comply with agreed terms."}


created_at: 2025-02-25 13:26:32
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: dea237c5-dbff-481b-b618-48ab57dd6d34
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-023", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Set up an audit process for access permission granted to third party personnel and their accessing activitiesm, to ensure it meets the agreed data sharing requirements."}


created_at: 2025-02-25 13:26:34
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4fcfb4db-1671-48e7-8b98-c2ea186a508d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-024", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Set up management process for privacy event identified in data sharing with third party vendors, including root cause analysis, follow-up action, remediation timeline, roles and responsibilities, documentation etc. "}


created_at: 2025-02-25 13:26:36
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c66e92ae-7946-4dda-8f31-f1b2116e3f51
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-025", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Set up an audit process for third party vendors. Define the credit rating for vendors and specify the audit items, requirements, and audit frequency for different credit levels."}


created_at: 2025-02-25 13:26:38
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: a25b732d-b4b0-4207-8f52-cfc2eaadd6d5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-026", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Set up data sharing record maintenance process for maintain facts from different source such as approval processes, monitoring platforms, including the scope of shared data, the recipient entity, sharing purpose, the start and end time, etc., and continuously maintain accurate records, to ensure meet the needs of inquiries, risk identification, etc."}


created_at: 2025-02-25 13:26:40
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9dac0f74-193b-4949-8a2e-e615ec0c3fff
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-027", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Set up an approval process for cross-board data transfer channels, outlining approval process as well as roles and responsibilities for the process. "}


created_at: 2025-02-25 13:26:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 697555b9-8827-47a1-a513-953c6b1da28e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-028", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Establish cross-border data transfer approval strategy, targeting approval personnel responsible for cross-border data transfer. When reviewing cross-border data transfer applications from business personnel, standardized and unified audit standards are provided to reach consistent audit conclusions."}


created_at: 2025-02-25 13:26:44
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8a3bdc9d-561d-4d7e-a520-976f5e16c63a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-029", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Set up an audit process for cross-border data transfer channels. Conduct regular audit process for transfer channels."}


created_at: 2025-02-25 13:26:46
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 897e9fe1-595d-4ed2-831a-19a37fd7bc3c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-030", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Set up a change management process related to cross-border data transfer channels (e.g. transfer destination change, updates to data fields and channel deprecation), outlining process requirements of change intiation, approval process, channel removal etc."}


created_at: 2025-02-25 13:26:48
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 2bb6bc72-e75b-48a0-b482-7dfb30dd240e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-031", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Set up a purpose review process for cross-border data transfer channels, review the usage purpose after transferring to ensure compatibility with the purpose that the channel first applies for. "}


created_at: 2025-02-25 13:26:50
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 22674201-daa1-4ba3-a4c1-0eb48090ba4e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-032", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Establish a change notification process for cross-border data transfer requirements. All stakeholders should be notified of requirement changes, including but not limited to business teams and cross broder application review teams."}


created_at: 2025-02-25 13:26:52
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1320b191-2bf3-4269-8cb9-ceaf8872cbf8
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-033", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Build a trusted platform to support the application and approval process for managing cross-border data transfer requests."}


created_at: 2025-02-25 13:26:54
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1facc725-6bc9-424f-9e37-bcfabff9fd28
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-034", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Set up an appproval process for cross-border data transfer channels with third parties, which incldes requirements of request initiation, review and approval, as well as roles and responsibilities."}


created_at: 2025-02-25 13:26:56
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 31fb310d-89a8-411b-8338-d928dc68c2da
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-035", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "In response to the user's request to change the Country Code, a complete process should be established to ensure that the user can smoothly complete the change. The process should include reviewing and verifying the user's current Country Code, supporting the user to complete the process of changing the Country Code, and recording the user's Country Code change record and the user's latest Country Code during the process. At the same time, the user data that has changed the Country Code should be migrated/deleted synchronously according to the existing company system (if involved)."}


created_at: 2025-02-25 13:26:58
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b792488e-b105-4549-936d-f6fc7c268133
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-059", "po": "data sharing", "subdomain": "contractual obligations for third-parties", "chroma:document": "Set up an audit process for data sharing, specifying audit process and checkpoints, such as the consistency among technical facts from monitoring with the contract, the approval requests."}


created_at: 2025-02-25 13:27:00
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 3300e138-d88a-4147-b0ae-d68a342b8a6f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-060", "po": "data sharing", "subdomain": "contractual obligations for third-parties", "chroma:document": "Establish a data sharing agreement maintenance process, specifying archive the agreement in a timely manner after signing with the data recipient, and review and modify the agreement content as needed when changes occur of data sharing facts, to reach a new consensus with the data recipient."}


created_at: 2025-02-25 13:27:02
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: aeb8d31f-e5f2-4ac6-9bcc-03f80cb3a369
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-061", "po": "data sharing", "subdomain": "third-party compliance", "chroma:document": "Establish a third-party notify and cooperation process for vendor significant event response, such as bankrupt, serious data security incident, contract/agreement violation,  specifying event intake, stakeholder notification, conduct impact and risk assessment, and risk tracking and disposal mechanism etc."}


created_at: 2025-02-25 13:27:04
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: fb361a2c-032b-4aaf-b347-3cd22415830e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-062", "po": "data sharing", "subdomain": "lert tool", "chroma:document": "Establish a law enforcement response process when the regulators ask for personal information, specifying request intake and legality verify in a timely manner, extract dataset and verify completeness of dataset to meet the request. "}


created_at: 2025-02-25 13:27:06
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 2adba7fd-4655-42d8-8a5f-79e678145d08
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-063", "po": "data sharing", "subdomain": "lert tool", "chroma:document": "Establish a process to prioritize law enforcement response, specifying the expedited nodes (e.g. automatic dataset extraction, manual urgent response) to prioritize the emergency law enforcement request, and upgrade the dataset extraction tool if necessary."}


created_at: 2025-02-25 13:27:09
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 575f2752-1cae-4cfd-a02a-f936e568ac0d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-092", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "Establish legal basis identification process for cross-border data transfer, to ensure the legal basis is identified (such as adequacy decision, SCC,user consent, etc.) before the data is transferred across borders, and measures are taken to comply with the latest legal and regulatory requirements."}


created_at: 2025-02-25 13:27:11
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 56e7a798-2741-454f-bab2-c38e151f0fe9
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-093", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "Establish requirements follow-up process, sorting out and updating legal and regulatory requirements regarding cross-border data transfer. When there are changes in requirements, adjustments should be made to measures and legal documents to ensure the compliance of cross-border data transfer."}


created_at: 2025-02-25 13:27:13
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 02886886-24f9-4ed6-a30d-0ada417ba7df
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-094", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt - cbt frameworks", "chroma:document": "Establish framework certification process to guide how to certificate and maintain validity of framework certification (such as the EU-US Data Privacy Framework), ensuring that the company can achieve cross-border data transfer based on such framework certification."}


created_at: 2025-02-25 13:27:15
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 58396c48-586e-4db0-a3c9-ff07d841a735
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-095", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt - cbt assessments", "chroma:document": "Establish assessment process for cross-border data transfer, clarifying requirements of request initiation, review and approval, as well as roles and responsibilities, to ensure that cross-border data transfer complies with legal and regulatory requirements."}


created_at: 2025-02-25 13:27:17
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 59dd0431-550f-4804-aa3e-2a6f16cccaca
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-096", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt - cbt assessments", "chroma:document": "Establish audit process for cross-border data transfer, conduct audit on cross-border data transfer compliance on a regular/irregular basis. Address issues identified in this process,to ensure that cross-border data transfer complies with legal and regulatory requirements."}


created_at: 2025-02-25 13:27:19
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 688e1b3b-98f1-4e68-a024-2d2e2b70c71b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-097", "po": "data sharing", "subdomain": "partnership on initiatives", "chroma:document": "Establish a parsing process for enforcement requests, guides response employee to classify issues and parse the original request into standardized questions, such as effected region, data subject scope, data type scope,etc to ensure that supporter can quickly understand the task and prepare materials."}


created_at: 2025-02-25 13:27:21
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: dd5de82a-96ed-4fdd-adeb-9cf152e6999c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-026", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Build data data obfuscation capability for data sharing, including technologies such as mask, hash, truncation information, to ensure the minimun sharing scope. "}


created_at: 2025-02-25 13:27:23
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: d6d754ef-7b39-4e8d-9ead-ffe8ddab576d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-027", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Build encryption capability for data sharing, e.g. data field encryption, channel enryption, to ensure data security during sharing."}


created_at: 2025-02-25 13:27:25
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 55223092-c542-4c68-aaaa-03ae85547924
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-028", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Build service/interface authentication capability for data sharing via interface request, e.g. signature verification. For sensitive scenarios, e.g. transaction and payment, implement dual-way authentication to avoid man in the middle attack etc."}


created_at: 2025-02-25 13:27:27
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: d93ca97a-e6c7-44e2-bc23-315faec4f17e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-029", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Build monitoring capabilities in testing environments for data sharing to identify the data type, providers, recipients, and destination countries before sharing. This approach ensures effective evaluation of the data to be shared and helps detect any potentially non-compliant data sharing activities."}


created_at: 2025-02-25 13:27:29
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 745a2e32-171e-4c6a-95f6-c2b3fa6c97f4
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-030", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Build security detection capabilities like vulnerability scanning and penetration testing to dectect any known security vulnerabilities when using vendor-provided tech components, such as integrating a vendor's SDK or using their platform."}


created_at: 2025-02-25 13:27:31
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 60d74055-4170-4e24-9fed-aea3c5d9ffe5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-031", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Build cut-off capability for data sharing, to ensure the sharing activities can be terminated when data sharing guidelines/agreement terms are violated or agreement terms expire. "}


created_at: 2025-02-25 13:27:33
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 0b7e8b11-3470-47a0-a201-fd1ea68e5be1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-032", "po": "data sharing", "subdomain": "secure disclosure to third-parties", "chroma:document": "Build monitoring capability for data sharing, identify and monitoring the sharing activities including data types, sharing purposes, providers, recipients, destination countries, start and end times, frequency etc. and the change of these technical fact. The monitoring result should be available for search, analysis and audit."}


created_at: 2025-02-25 13:27:35
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7d4c08d9-6497-47aa-b04a-5b614203e8ba
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-033", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Build authentication capabilities on the platform which grant vendor access to share data, such as QR code scanning, SMS verification, and password checks, and  enable two-factor authentication for sensitive operations or accessing sensitive data."}


created_at: 2025-02-25 13:27:37
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1da1bce0-cb49-4907-8e8e-d00b221264c1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-034", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Build access management capabilities on the platform which grant vendor access to share data, such as permission search, change and removal."}


created_at: 2025-02-25 13:27:39
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 18e179c7-9245-4397-bac4-803c3d2b431b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-035", "po": "data sharing", "subdomain": "supply chain protections", "chroma:document": "Build access log and audit capabilities on the platform which grant vendor access to share data, including operator, time, operation object, actions, to ensure any non-compliant activities can be traced and audited."}


created_at: 2025-02-25 13:27:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cefe932e-752f-40b8-a891-4ef2cc83ec7f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-036", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Build data cross-border transfer gateways with technical capability to verify and control transfer activities (such as filtering invalid fields, identifying and intercepting protected data, etc.)"}


created_at: 2025-02-25 13:27:43
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c9fc0a5d-51aa-4f2d-b01d-8c67a018b95f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-037", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Build technology to restrict the modification of data transfer direction, destination, data center and other information of the channels that have been approved and in use."}


created_at: 2025-02-25 13:27:45
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8b619413-5abe-41a9-b7af-fd86ad23004c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-038", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Use cross-border data transfer technology (e.g. gateway, channel, platform) which is certified by the trusted 3rd-party (e.g. Oracle), so that the transfer activities can be effectively audited and monitored. "}


created_at: 2025-02-25 13:27:48
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 353f85a6-6515-4ab3-b179-b183e74db5e8
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-039", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Build cut-off technology for cross-border data transfer, to terminate the transfer activities when the channels are deprecated."}


created_at: 2025-02-25 13:27:50
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9f51e59b-0ecc-48f5-8938-ca735076a08d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-040", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Build data access control technology for data approved for cross-border transfer and storage in destination data centers. Ensures that only authorized personnel can access and use the data for specific purposes."}


created_at: 2025-02-25 13:27:52
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 496fad5b-6889-4e5c-bb4c-e54c221e0732
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-041", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Build data label recommendation and validation capabilities for applicants and approvers to use during the process of cross-border data transfer request and approval, to enhance accuracy of data label annotation."}


created_at: 2025-02-25 13:27:54
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b60b99d1-c3ad-481c-affb-c68258ba81bd
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-042", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Build monitoring capability for cross-border data transfer technical components (e.g. gateway, transfer channel, data flow), to ensure the consistency between actual transfer data and applications. Alert and notify relevant stakeholders any anomalies. "}


created_at: 2025-02-25 13:27:56
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6fae6ace-c031-441e-8c99-aeff16f8d93d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-043", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "Build tracking and monitoring capabilities for the usage and storage of data allowed for transfer (e.g. data lineage, asset lineage, purpose verification). Restrict unauthorized usage to ensure that data usage is compatible with the stated purposes in the application. Alert and address any anomalies. "}


created_at: 2025-02-25 13:27:58
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ed052d0f-0a02-48d7-b632-cc6c014b7ad5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-044", "po": "data sharing", "subdomain": "geolocation restrictions", "chroma:document": "For data processing activities involving cross-border transmission of user data, corresponding technical capabilities should be possessed to confirm and verify the user's current latest Country Code, in order to confirm the data cross-border transmission rules applicable to the current cross-border transmission of user data, and avoid user data entering non-compliant data centers due to incorrect judgment of the user's Country Code."}


created_at: 2025-02-25 13:28:00
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 33ca053f-15ca-481e-b9df-bc1b4125f559
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-088", "po": "data sharing", "subdomain": "contractual obligations for third-parties", "chroma:document": "Build consent manangement capability to verify the shared data has obitained user consent when the sharing based on the user consent, and supporting linkage of other technical capabilities to stop sharing promptly when the user withdraws consent, and require the data recipient to retain or deletion, etc."}


created_at: 2025-02-25 13:28:02
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f54aab3f-43d9-491c-bfab-dbd579fd8239
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-089", "po": "data sharing", "subdomain": "contractual obligations for third-parties", "chroma:document": "Build purpose verify capability of data sharing to verify the purpose complies with laws and regulations, within the scope of the privacy policy, and is consistent with the purpose agreed upon in the contract with the data recipient when sharing data."}


created_at: 2025-02-25 13:28:04
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f3c9abd6-7570-431b-995e-f168724021bf
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-090", "po": "data sharing", "subdomain": "lert tool", "chroma:document": "Build data extraction capability to accurately extract personal information according to  law enforcement requests."}


created_at: 2025-02-25 13:28:06
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 90c3b7ce-6305-420f-9935-ca79fe28970d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-091", "po": "data sharing", "subdomain": "lert tool", "chroma:document": "Build security capability for the Lert Tool, including authentication, permission control, operation record audit, data encryption, data deletion etc., to ensure data confidentiality when responding to law enforcement.  "}


created_at: 2025-02-25 13:28:08
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ecc9c1ca-0ed2-4cdb-b4d5-ca3a60499b38
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-126", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt", "chroma:document": "Establish monitoring capability to monitor and identify cross-border data transfer,including data types, data flows, the amount of data, providers, recipients, destination countries, start and end times, frequency etc.. The monitoring result should be available for search, analysis and audit."}


created_at: 2025-02-25 13:28:10
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: aabce172-ca5d-48ca-9259-9a71e65be680
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-127", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt - cbt assessments", "chroma:document": "Build monitoring capabilities for cross-border data transfer to identify data types, data flows, the amount of data, provider, recipient, destination country, etc. before data sharing.This approach ensures effective identification of cross-border data transfer and triggers corresponding assessment process."}


created_at: 2025-02-25 13:28:12
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 44c7f9e4-c2dc-4289-843b-962c0f81a04a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-128", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt - cbt assessments", "chroma:document": "Build monitoring capabilities for cross-border data access to identify data types,access permissions, accessing parties, accessed parties, etc..This approach ensures effective identification of cross-border data access and triggers corresponding assessment process."}


created_at: 2025-02-25 13:28:14
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6b923580-5875-49c8-9560-be5f489a5b3d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-129", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt - cbt assessments", "chroma:document": "Build capabilities for cross-border data transfer,such as data pseudonymization, data desensitization, and data encryption etc. to ensure the minimization and security of cross-border data transfer, and to avoid data leakage during the cross-border data transfer."}


created_at: 2025-02-25 13:28:16
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4b56d997-c666-488a-976f-4ac5429f2fc6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-130", "po": "data sharing", "subdomain": "cross-border data transfer - legal basis for cbt - cbt assessments", "chroma:document": "Build cut-off capability for cross-border data transfer, to ensure the cross-border data transfer can be terminated when prohibited cross-border data transfer or violations are discovered, and ensure that cross-border data transfer comply with legal and regulatory requirements."}


created_at: 2025-02-25 13:28:18
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b64c05af-f91d-421b-92d6-b9dbe39eaf96
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-131", "po": "data sharing", "subdomain": "government investigations and complaints", "chroma:document": "Build record capability for the Lert tool to log the activity in response, including receiving, veriftion, dispatching, material preparation, material validation, and result feedback. The log should record executor, action, result, timestamp, etc."}


created_at: 2025-02-25 13:28:20
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 209791ad-b86d-4777-baac-9f2076560a8a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-021", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Conduct PIR Policy and handling procedures training for information collection/receiving parties, business liaison POCs, customer service personnel, and other relevant personnel and roles during policy release and daily incident handling processes. Relevant personnel should be informed and ensured to understand the initiation and handling process of privacy incident-related policies and procedures."}


created_at: 2025-02-25 13:28:22
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6c3e55eb-9b95-44cd-98b1-5e36c8b2b691
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-050", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Establish privacy incident handling guidelines, which provides clear guidance on how to respond to privacy incident (such as user data leak or malicious tampering of user data, etc.), including defining and identifying privacy incidents, evaluation and grading standards, response measeres, notification, reporting and corresponding resposibilities of each role."}


created_at: 2025-02-25 13:28:24
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 55a3bd36-2534-4e05-a7fb-d6b351143de8
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-098", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up a privacy incident identification machanism and process, specify the initiation of various stages such as privacy incident analysis, evaluation and classification, and event investigation when a privacy incident occurs. Determine the personnel roles required for each stage and the responsibilities that different roles need to undertake in each stage."}


created_at: 2025-02-25 13:28:26
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6feb463f-a4eb-4a81-8d7a-b02c3db2a1d6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-099", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up a connected mechanism and process with 3rd parties, guiding on how to involve 3rd parties and the responsibilities they need to undertake in stage of the analysis, evaluation, investigation, handling, and response of privacy incidents."}


created_at: 2025-02-25 13:28:28
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 5847971b-d29c-4ff3-8288-64e36f16c39b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-100", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up a privacy incident notification process, guide the notification methods, scope, content issuance, and other related matters when it is necessary to notify users or individuals of privacy incidents. The process should also outline the roles and responsibilities of personnel involved."}


created_at: 2025-02-25 13:28:30
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 338b91c8-13cf-482a-a310-11cb1e627be1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-101", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up a regulator reporting process, includes guidance on reporting, feedback, response, and remediation of privacy incidents when reporting to regulators is required. Determine the personnel roles required for each stage and the responsibilities that different roles need to undertake."}


created_at: 2025-02-25 13:28:32
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4ea9e18f-e0be-4584-baf5-62977d1cbf24
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-102", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up an escalation process, guide on how to escalate the necessary personnel roles and responsibilities of each role when the escalation conditions are met during the incident handling process (such as timeout, negative handling, execution errors, etc.)."}


created_at: 2025-02-25 13:28:34
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1e20870b-9560-43e8-aab1-d6ac01c0bf56
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-103", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up a recording mechanism to record the handling of privacy incident response, timely and accurate recording of the time of the incident, discovery methods, event details, personnel involved, and handling measures should be made when a privacy incident occurs."}


created_at: 2025-02-25 13:28:36
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8e35834d-e905-4a2d-9556-f1a864e9cbe6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-104", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up a mechanism for updating privacy incident response rules and procedures, guides legal, privacy incident owners, and other roles to optimize and update relevant privacy incident response policies, privacy incident response process mechanisms, etc. in a timely manner when regulatory changes occur, to ensure that the corresponding policies and process mechanisms comply with regulatory requirements."}


created_at: 2025-02-25 13:28:38
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: abb37463-78ac-4405-9432-e6989cd60b74
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-105", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up a recovery mechanism, when a privacy incident occurs and the cause of the incident is determined, guid a recovery action plan based on the analysis and evaluation results of the incident to address the current problem and prevent the possibility of recurrence in the future. Determine the personnel roles required to participate in and the responsibilities they need to undertake."}


created_at: 2025-02-25 13:28:40
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f4bcfc89-488a-4a12-908b-242d4c3969a7
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-106", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Set up a lesson learn mechanism, including reviewing the effectiveness and role of each node in the privacy incident handling process, identifying shortcomings in the privacy incident handling process, and continuously improving the response and remediation process of privacy incidents."}


created_at: 2025-02-25 13:28:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8cba338b-ba68-4919-9fb7-307f098f9a58
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-132", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Build location analysis capbility(such as log analysis capabilities, network forensics capabilities, and analysis of malicious code in isolated environments) to locate and confirm the causes and scope of the incident, in order to assist in further handling and correction of the incident."}


created_at: 2025-02-25 13:28:44
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7794dd3c-3794-42e1-8c67-936a162b845e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-133", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Build automated notification capabilities(such as notification center capabilities and system notification capabilities on the client side) to accurately send event notifications to affected users and individuals, ensuring the effectiveness and accuracy of event notifications."}


created_at: 2025-02-25 13:28:47
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1c66f568-6ded-45c1-b916-a4cced01c640
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-134", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Build remedial capbility (such as automatic system disabling, system isolation, communication control, immediate automatic update of keys/certificates, data backup and recovery, system recovery, service recovery, etc.) ,and should be activated immediately after the occurrence of a privacy incident to suppress/mitigate the consequences caused by the incident."}


created_at: 2025-02-25 13:28:49
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 03339851-e8b2-47da-98d8-d24271a85187
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-135", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Build monitoring capbility (such as establishing a network event database, network and system monitoring, abnormal behavior monitoring, etc.)to closely monitor potential privacy incidents, and alert and dispose of relevant personnel when triggering abnormal thresholds, in order to achieve the effect of early prevention."}


created_at: 2025-02-25 13:28:51
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b93e47f4-bda0-4c35-9928-7d31c5e42933
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-136", "po": "data security", "subdomain": "incident and breach response", "chroma:document": "Build collaborate capbility (such as information synchronization interfaces, abnormal monitoring capabilities, etc.) to ensure timely synchronization of events and follow-up on handling situations."}


created_at: 2025-02-25 13:28:53
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e289ecc8-af22-4bec-98ca-eadb7b647b05
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-007", "po": "data retention", "subdomain": "data retention", "chroma:document": "Conduct data retention training for all affected employees regularly or when alterations occur (e.g., add deletion rules, changes in deletion scope), to clarify the latest requirements and processes related to data retention."}


created_at: 2025-02-25 13:28:55
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 0307d7f3-7c93-4857-8c1a-594e9e6416af
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-008", "po": "data retention", "subdomain": "data retention", "chroma:document": "Notify all relevant stakeholders of any changes in data deletion policies/tools through various communication channels (such as emails, internal workplace announcements, mobile message notifications, etc.), ensuring they are aware of and adhere to the latest policies and procedures."}


created_at: 2025-02-25 13:28:57
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cf8332c9-f31d-4291-985b-2ece163a11d7
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-008", "po": "data retention", "subdomain": "data retention", "chroma:document": "Establish data retention guidelines, specifying the data type and corresponding retention requirements in different scenarios: account deletion, DSAR (Data Subject Access Request) deletion, UGC content deletion, etc. It should also include detailed instructions of deletion rules, execution steps, deletion timing and deletion method, etc."}


created_at: 2025-02-25 13:28:59
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 45d12ebf-2cb1-4395-b863-7f6efa231073
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-009", "po": "data retention", "subdomain": "data retention", "chroma:document": "Establish guidelines to preserve data under Litigation Hold, specifying data deletion exemption mechanisms including data preservation (to prevent unexpected deletion) and protection (e.g. access limited only authorized personnel) requirements."}


created_at: 2025-02-25 13:29:01
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: efd052fc-f1f2-490e-9ff4-5b47a606818b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-010", "po": "data retention", "subdomain": "data retention", "chroma:document": "Establish region-specific data retention guideline for various data sovereignty states/regions, evaluate potential compliance risks in each business area, update data retention requirements promptly, and review regularly for applicability."}


created_at: 2025-02-25 13:29:03
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: a6960c20-51c0-4e2d-b297-79f8b244fe93
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-012", "po": "data retention", "subdomain": "data retention", "chroma:document": "Set up management process of data SOT (source of truth), clarifying the data update, verification and synchronization process for all SOT (e.g. TTP, ROW, DT, DR online, DR offline), to ensure the data sources are consistent across data deletion nodes. "}


created_at: 2025-02-25 13:29:05
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8bb139b8-72cf-4aaa-b6b2-c65f509367cc
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-013", "po": "data retention", "subdomain": "data retention", "chroma:document": "Set up configuration effectiveness verify process before data deletion starts. Ensure deletion configuration is consistent with deletion rules and updated in accordance with latest date deletion requirements. "}


created_at: 2025-02-25 13:29:07
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cc01043d-2e7c-4c7e-8900-86774adfdf28
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-014", "po": "data retention", "subdomain": "data retention", "chroma:document": "Set up a process for remedation of gaps identified in data retention, which should include steps covering root cause analysis, follow-up action, remediation timeline, roles and  responsibilities, as well as record keeping. "}


created_at: 2025-02-25 13:29:09
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: dfedea96-dd97-4d5e-8c52-0077c2e9c6eb
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-015", "po": "data retention", "subdomain": "data retention", "chroma:document": "Set up an operation process for data deletion, including setting SLA target for data deletion tasks, defining roles and responsibilities, and monitoring procesures. Once abnormalies are identified, relevant task owners should be notified to address the issue. "}


created_at: 2025-02-25 13:29:11
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b27b8258-69c4-4fe9-b5fb-c1dd66eb1a4f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-016", "po": "data retention", "subdomain": "data retention", "chroma:document": "Set up data deletion audit process, conduct audit on data deletion procesures and remediation processes on a regular/irregular basis. Address issues identified in this process."}


created_at: 2025-02-25 13:29:13
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 3431e899-8643-4ea2-9cba-ab103dbf78d8
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-015", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build asset discovery capability to continuously identify newly created databases, tables, storage components, and various types of user data etc., to ensure comprehensive and accurate coverage of data deletion."}


created_at: 2025-02-25 13:29:15
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 385624ae-a040-4f40-a468-5f1a2949a08f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-016", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build data identification capability to ensure accurate classification of data types, data subjects, and region labels are attached to data fields. This helps prevent accidental and wrongful deletion caused by misclassification of data."}


created_at: 2025-02-25 13:29:17
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 837e0188-63a3-4580-ba0d-cce0477cbf28
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-017", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build technology (such as allowlist verification and independent storage) to preserve data (e.g. litigation hold data) from regular deletion schedule, and apply separate access controls to avoid accidental deletion and unexpected access. After the exemption period ends,  the data should be deleted."}


created_at: 2025-02-25 13:29:19
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 44882f03-bb6e-4931-ade3-d528fd8adf2e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-018", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build capability to differientiate data from various regions and set up country specific retention/deletion based on data sovereignty requirements."}


created_at: 2025-02-25 13:29:21
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e50a1336-ab60-4707-b1e5-823ff425af3b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-019", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build SOT (\"source of truth\") synchronization and verification capabilities, including syncing data changes to SOT, updating the latest SOT throughout the deletion workstreams, and verifying the integrity of SOT to ensure data scope consistency with SOT."}


created_at: 2025-02-25 13:29:23
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e0477c2d-75e8-46cc-93e6-ebd41027633e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-020", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build data retention/deletion capability to perform deletion strategy/task  (e.g., rolling deletion, account deletion, DSAR deletion, account deletion, content deletion, and other deletion scenarios, etc.), to ensure accurate and thorough removal of retained data from all business systems. "}


created_at: 2025-02-25 13:29:25
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 73133a85-e881-44b2-81bf-e4cde57201d7
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-021", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build capability to check and validate the deletion tasks from upstream to downstream systems. Regularly verify the deletion operations among data retention system and its upstream/downstream system to ensure that all scenarios are properly covered and accuracy of the deletion process is maintained throughout the entire workflow."}


created_at: 2025-02-25 13:29:27
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 66ebccab-52d0-49d5-9072-0f3591aedc53
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-022", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build capability to scan residual data and conduct root cause analysis for residual data, and ensure remediation is followed."}


created_at: 2025-02-25 13:29:29
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9cddc9a5-9522-4ad5-9962-90ab397487ab
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-023", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build log management capability for data retention, to log the initiation of deletion tasks, execution details, callback events, and any encountered failures. Do not log any sensitive data. The log is used to verify whether the deletion is executed, as well as abnormal backtracking and auditing."}


created_at: 2025-02-25 13:29:31
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b1e50cb7-5a95-4ea9-a9b4-01f61fca3c45
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-024", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build a data deletion anomaly alert system to detect any deviations or abnormalities in the entire process. When anomalies occur (such as inaccurate deletion requests, failed or delayed deletion tasks, or inconsistencies with deletion policies, inconsistency between SOT and data scanning scopes, failure to set the expiration time (TTL) for data deletion etc), trigger alerts and notify relevant personnel for prompt resolution."}


created_at: 2025-02-25 13:29:33
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 21cac812-6da6-4c93-8c22-abc98e323d87
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-025", "po": "data retention", "subdomain": "data retention", "chroma:document": "Build data backup and recover capability, back up raw data periodically or before implementation of data deletion strategy. Check integrity, availability and accuracy of the backup files, to ensure when the errors occur, deleted/lost data can be recovered."}


created_at: 2025-02-25 13:29:35
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: edf13aae-949f-426b-ba8f-05ddf5855e77
encoding: FLOAT32
metadata:
{"safeguard_number": " safeguard-process-048", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Set up RoPA  consistency verification process. When RoPA facts are entered through automated processes or manually bound to PA, use manual and technical methods to check the consistency between the entered facts and PA, specifying verification steps, standards and roles."}


created_at: 2025-02-25 13:29:37
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: a96140d2-cd52-4f4b-8a3d-20116536793c
encoding: FLOAT32
metadata:
{"safeguard_number": " safeguard-process-049", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Build a unified RoPA management tools for process automation/semi-automation management, RoPA operations (view, add, delete and modify), recording and display of process information (eg. the node, results, PA update status, technical facts, PA purpose and legal basis), authority control, data analysis etc."}


created_at: 2025-02-25 13:29:39
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 21bf9af0-c1f9-457a-b208-7aa9ab43b756
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-004", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Regularly train and guide relevant personnel on data minimization strategies for collecting new data, ensuring they fully understand and adhere to the principles and rules of data minimization in daily work."}


created_at: 2025-02-25 13:29:41
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 393d24ce-9c46-4bde-b6f6-60399c95dc46
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-005", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Regularly train engineering team on monitoring strategies on data collection frequencies, scenerios, and data types to ensure effective implementation of monitoring."}


created_at: 2025-02-25 13:29:43
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ce09f18d-589f-42ef-81c3-e534ef68e44b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-006", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Conduct policy training for relevant objects with the purpose of improving the understanding and practical ability of purpose limitation."}


created_at: 2025-02-25 13:29:45
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: aa1544b9-c976-4a02-83a0-b66c57b396b6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-004", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish data collection guidelines for new data collection,  specifying requirements on data granularity, data type, collection frequency, scenario, and data subject. Ensure there are clear collection purpose and adhere to the principle of data minimization during collection."}


created_at: 2025-02-25 13:29:47
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 5dd3a541-4514-4cdf-9c70-cf16d403bfc1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-005", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish data acquisition guidelines, specifying requirements on the data sources, data sensitivity, and risk assessment standards to ensure that data acquisition complies with regulations and company policies."}


created_at: 2025-02-25 13:29:49
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f1373c47-0caa-4568-904d-4fc7dc040468
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-006", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish data collection monitoring guidelines, specifying the monitoring rules including collection frequency, collection scenarios, data fields collected, user types and code redundancy etc.."}


created_at: 2025-02-25 13:29:52
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cb9edc32-739b-4016-aee7-1956abe50144
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-007", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish purpose limitation guidelines to define the purpose taxonomy, purpose labeling principle, purpose compatible rules and potential risk levels of different data types and purpose, also specifying step by step rules for purpose labels, compatible check and routine operations."}


created_at: 2025-02-25 13:29:53
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 584ba9c1-ad4b-4da4-a148-d5c7bd81872e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-020", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Establish pseudonymization and anonymization guidelines, including the definition, trusted tooling/technical capabilities, criteria for use etc.,  covering data usage, data storage and data display on internal platforms within sensitive user data. "}


created_at: 2025-02-25 13:29:56
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6ff86cde-7167-403a-966e-be46c8fabaf2
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-021", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Establish RoPA guidelines, outlining RoPA definition, RoPA information scope, template and format, as well as facts (e.g. region, platform, purpose and legal basis) that need to be included."}


created_at: 2025-02-25 13:29:58
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 443ae1a6-5705-4a71-8a40-0918688c326c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-005", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Build pre-check process for new data collection, including data type, sensitivity level, data accuracy, collection frequency, business scenarios, collection time, collection purpose, user type, region to avoid data collection without a purpose or necessity."}


created_at: 2025-02-25 13:30:00
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 3b777683-1587-47ca-a529-73705499c547
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-006", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish a data acquisition process, outlining approval and operation process for data acquisition. "}


created_at: 2025-02-25 13:30:02
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9b88be4f-3c48-4d4e-857e-b8042682d684
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-007", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Set up management process for privacy event identified in data collection, including root cause analysis, follow-up action, remediation timeline, roles and responsibilities, documentation and record keeping etc. "}


created_at: 2025-02-25 13:30:04
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9e282dcc-52eb-4c10-970e-823dfcf527d2
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-008", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish the process of labeling and recording the purpose of user data, to ensure the user data has clear and specific collection and usage purposes."}


created_at: 2025-02-25 13:30:06
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c2e33f45-5319-4256-9d05-8f32c8df423d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-009", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Set up a process for remedation of gaps identified in purpose limitation, which should include steps covering root cause analysis, follow-up action, remediation timeline, roles and  responsibilities, as well as record keeping. "}


created_at: 2025-02-25 13:30:08
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ec648ddd-518c-4288-a392-12203bcc3518
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-010", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Set up a registration process for the new purpose scenarios and usage purpose change, and record up to date purpose as well as execute compatiable check to ensure the completeness and accuracy of the purpose."}


created_at: 2025-02-25 13:30:10
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 696adce4-5b67-4097-8f7f-825a355c5290
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-011", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Set up purpose limitation audit process, conduct audit on purpsoe limitation procesures and remediation processes on a regular/irregular basis. Address issues identified in this process."}


created_at: 2025-02-25 13:30:12
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 165c1a3e-0f1f-4fbf-b5e1-d852b9ab8cef
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-037", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Set up a RoPA management process, including detailed instructions for creating, iterating, and updating RoPA, as well as the tools to be used and the specific responsibilities of each team member involved."}


created_at: 2025-02-25 13:30:14
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: da525c5c-affd-4fe2-9732-c59b61eea777
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-038", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Set up a RoPA audit process, conduct the audit on completeness and accuracy of RoPA records. The process should specify audit frequency, standards and methods, etc., and handle abnormal situations."}


created_at: 2025-02-25 13:30:16
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ca596910-59ed-4cf2-9c36-8bd154b2e75c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-039", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Set up RoPA disclosure process, to clarify and conduct RoPA disclosure steps (e.g. confirmation, legal evaluation, review and disclosure) when it meets the disclosure scenario. The process should clarify roles and responsibility, form of disclosure and continuous follow-up mechanism after disclosure."}


created_at: 2025-02-25 13:30:18
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ad582b19-66db-42cf-ba91-2e2befb9bc5c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-008", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish technical capabilities to identify the service path (e.g. data post and get api) and scenario of data collection and usage for the user data that needs to be controlled. "}


created_at: 2025-02-25 13:30:20
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 913242b3-746c-4de8-a822-060e3dcfe4bc
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-009", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish technical capabilities to record the collection and usage purpose of user data."}


created_at: 2025-02-25 13:30:22
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 393972d4-836d-498b-9092-096edcc4b2b5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-010", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Establish technical capabilities to check the compatibility among collection purposes and usage purposes; when they are not compatible, corresponding actions can be taken (e.g., obtaining additional user consent, prohibiting use/blocking)."}


created_at: 2025-02-25 13:30:24
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c6cfdd3b-6027-4be2-8de2-d2f9e306e668
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-011", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Build log management capability for purpose limitation, to log the execution of purpose limitation rules, compatibility verification, operation failures, etc.."}


created_at: 2025-02-25 13:30:26
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: fce91c6e-de22-4dd5-af8b-4e624c9028a7
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-012", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Build a purpose limitation anomaly alert system to detect any deviations or abnormalities in the entire process.  When anomalies occur (e.g. execution object, limitation scope, rules are issued incorrectly), trigger alerts and notify relevant personnel for prompt resolution."}


created_at: 2025-02-25 13:30:28
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: df1f1c39-a72b-4825-b10b-f812967eaf4e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-013", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Build post-launch monitoring technology for new data collection, monitoring abnormalities indata type, sensitivity level, data accuracy, collection frequency, business scenarios, collection time, collection purpose, user type, collection region, redundant code. The monitoring result should be available for search, display and statistic."}


created_at: 2025-02-25 13:30:30
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: d52fd3a9-4d53-44e7-871b-7ca8011e8cb0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-014", "po": "data minimization & purpose limitation", "subdomain": "data minimization & purpose limitation", "chroma:document": "Build event insight capabilities to support automated risk and root cause analysis after the data collection, based on data fields, URL, domain name, business scenarios, purpose, components etc., and execute the disposal action (e.g. block collection and usage activities) . The disposal result can be search, display, and statistics."}


created_at: 2025-02-25 13:30:32
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: d14f415c-8785-4648-b198-71cf02579760
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-052", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Build pseudonymization and anonymization technical capability, relevant technical means such as masking, obfuscation, synthesis, replacement, hiding, and clipping should be used for de-identification to protect personal information."}


created_at: 2025-02-25 13:30:34
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c8753a19-9d08-4de6-aea6-84d569f75b54
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-053", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Build pseudonymization and anonymization technical capability, when displaying personal information on the internal platform frontend and client based on functional purposes, relevant technical measures should be used for filtering, such as interface clipping, to filter out personal information that is unnecessary and does not need to be displayed."}


created_at: 2025-02-25 13:30:36
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 0f0cc055-1daf-4daa-92e5-99c996fc3a73
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-054", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Build pseudonymization and anonymization technical capability, for high-sensitivity personal information that needs to be displayed, relevant technical measures should be used for de-identification processing, including masking, truncation, and replacement."}


created_at: 2025-02-25 13:30:38
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ea18eaa9-d570-4f04-8fc1-4ac545f5fafa
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-055", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Build database storage isolation capability, for the storage of user personal information for different products of the company, relevant technical measures, such as row/column isolation and table splitting, should be used to achieve physical or logical isolation, ensuring that data for different product lines is stored in different databases or tables (or can achieve isolation of access and processing)."}


created_at: 2025-02-25 13:30:40
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 2a1bda40-1e6e-4164-9e8b-efa75334115e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-056", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Build database storage isolation capability, for the storage of user personal information with different sensitivity levels for different product lines of the company, relevant technical means, such as row/column isolation, table splitting, and bucket splitting, should be used to achieve physical or logical isolation, ensuring that data for different product lines is stored in different databases or tables (or can achieve isolation of access and processing)."}


created_at: 2025-02-25 13:30:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cf5301f8-6591-4a3b-9e42-320322c888b5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-057", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Build environment isolation capability, separation of testing, production, and development environments, where operations in the test and development environments should not affect the production environment, data should also be isolated in each environment."}


created_at: 2025-02-25 13:30:44
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 74eff2d7-0256-42b0-938d-f1726ead5e92
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-058", "po": "data minimization & purpose limitation", "subdomain": "data processing", "chroma:document": "Build technology to verify the completeness of RoPA technical facts. Based on the scope of technical facts and the channels and methods for obtaining source data, use technical means to verify that the technical facts required for RoPA have been fully obtained and the technical facts are consistent with the source data."}


created_at: 2025-02-25 13:30:46
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 5342691e-01e7-458a-8809-0e57dccc431a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-013", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Conduct regular training for capabilities users, including data inventory, data classification, data lineage, etc, introduce integration and using methods, to ensure better understanding and locate data to manage."}


created_at: 2025-02-25 13:30:48
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9c9206f5-460d-4af1-9a46-14011668be18
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-014", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Conduct regular training of data classification, including the rules of data classification and sensitivity levels, to ensure stakeholders can assess and apply appropriate control measures when processing data."}


created_at: 2025-02-25 13:30:50
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 0dc61f9d-b096-461a-b249-17b2780d824f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-019", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "Establish data quality guidelines for data collected/acquired through various channels (including collection from client end, purchased data, and data acquired from third party), specifying requirements on data accuracy, data integrity and consistency etc.."}


created_at: 2025-02-25 13:30:52
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 2216d98c-dcbf-496b-92da-3f79a379e27b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-024", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Establish data classification guidelines, classifying data type definitation and identification rules based on business meaning, form, entity, etc., to ensure the selection of data which needs to be controlled based on corresbounding requirements."}


created_at: 2025-02-25 13:30:54
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: bfd50c18-37ba-418e-9844-0b0e97381d07
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-025", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Establish asset definitation guidlines, classifying assets definitation and identification rules based on assets' attributes, such as storage/service type, business ownership, deployment area, data processing activity, online status, and active status, to ensure the selection of assets which need to be controlled by corresbounding requirements."}


created_at: 2025-02-25 13:30:56
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 3aa50bbf-1471-407c-b976-e70b33f698f2
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-026", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Establish data subject definitation guidlines, classifying data subject definitation and identification rules based on its business meaning and attributes, such as user region, age groups,etc to ensure adapt to corresponding control requirements"}


created_at: 2025-02-25 13:30:58
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e1828af1-294f-46ed-b0c7-a2ba05c3b969
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-036", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "Set up a process to audit the quality of user personal information or data that may impact users, even if it is not personal information. This includes assessing accuracy and integrity of the data. Abnormalies such as outdated or missing data should be addressed accordingly."}


created_at: 2025-02-25 13:31:00
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e2cb835e-a922-4a34-b098-e40e0c280267
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-043", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Set up a data lineage quality verification process, including process of checking and validation of data lineage results (e.g. recall rate) and addressing quality issues identified. "}


created_at: 2025-02-25 13:31:02
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 747e5c62-fd30-40f6-b978-4d29d5b05447
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-044", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Set up a data classification quality verification process, clarifying the check and validation of data labelling result(e.g. recall, precision rate) and addressing quality issues.   "}


created_at: 2025-02-25 13:31:04
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 74cea8f3-c66d-4eb3-8a1b-345bc99fd651
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-045", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Set up a label management process for data taxonomy labels (e.g. data type, data subject, data format), outlining label creation, update and removal process including change initiation, approval, operation, record keeping, change launch etc.."}


created_at: 2025-02-25 13:31:06
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 21e0ba22-4321-401c-8c93-b354425ee8b1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-046", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Set up a process to intake new legal requirements to data taxonomy, evaluate and optimize the label structures and system to support compliance requirements implementation if needed. Define and build identification capabilities according to the label addition process to support compliance requirements implementation."}


created_at: 2025-02-25 13:31:08
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 08c1a59a-1f5c-48b6-8760-42661dc0e19d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-047", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Set up a quality control process for data assets, including verify asset identification results, such as asset identification coverage, accuracy of asset analysis and key attribute labeling, etc., and clearly define the repair mechanism after discovering quality problems to ensure that assets are fully identified and accurately labeled with attributes."}


created_at: 2025-02-25 13:31:10
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 0f2fd97d-9c1d-4dd6-9e85-51a55e4924e3
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-064", "po": "data accuracy", "subdomain": "data classification", "chroma:document": "Set up a label useage feedback handling process, specify comprehensive process to review, assess, handle the feedbacks. Feedbacks should be addressed incorporated to data classification iterations. "}


created_at: 2025-02-25 13:31:12
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: bedd3b8d-016f-4720-8c57-70da7b8d262b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-045", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "When a storage database involves user data, building data integrity and accuracy veridication capability , e.g. define global unique key identifier, verify foreign key identifiers. "}


created_at: 2025-02-25 13:31:14
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1efd72b2-781f-43a3-85d3-e7ce1cea3695
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-046", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "When service/interface interaction involves user data, build verification capabilities for data integrity and accuracy, e.g. defining the identification parameters of interface interaction and performing authentication between interfaces, maintaining accurate open_id and actual identification mapping in 3rd-party data sharing."}


created_at: 2025-02-25 13:31:16
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 30222239-0ee7-41fa-8c48-11db5b9ff1c5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-047", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "When the product features aims to protect privacy, build verification capabilities to ensure that the user's personal information designed is uniformly defined, managed, distributed, and consistency among upstream and downstream system. The product features includes but is not limited to:1. privacy setting status define and synchronization2. password format verification3. traffic routes based on store region"}


created_at: 2025-02-25 13:31:20
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 34511de9-14eb-4d55-8cd9-42534be0e7a1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-048", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "For user personal data, especially sensitive data (e.g. email, age), build capabilities (e.g. interface integration) to unify the collection source of data, and centralize data processing and storage following standard rules."}


created_at: 2025-02-25 13:31:22
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 725fe6ea-ce81-4425-93cc-c8aa37d3fd6f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-049", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "Build capabilities for data change synchronization capability to ensure that (e.g. table join, data deletion) it can be synchronized or distributed to upstream and downstream systems in a timely and accurate manner, and to ensure that the correct execution (such as task signature verification, task valid period verification)."}


created_at: 2025-02-25 13:31:24
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: fcb3f2a5-fbe9-441c-a7ad-48cbdf3a8e9d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-050", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "Monitoring and record operation history, modification records, and other data access, usage, and sharing behaviors throughout the entire data lifecycle. This enables timely detection and tracking of data in the system so as to enhance data interity. "}


created_at: 2025-02-25 13:31:26
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4097e1f5-7b62-4c5f-8726-47345f8b43e7
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-051", "po": "data accuracy", "subdomain": "data quality & accuracy", "chroma:document": "Implement real-time or periodic data quality validation (e.g. checking for duplicate values or missing data in databases and tables) throughout the entire data lifecycle to identify and rectify data issues. This can reduce data corruption and vulnerabilities."}


created_at: 2025-02-25 13:31:28
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4bf3b648-6a2b-441f-83f4-bce6ff985c5b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-068", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Build a data dictionary that maps out data types, definitions, raw data field samples etc.. The dictionary should be easy to use for control and protection purposes."}


created_at: 2025-02-25 13:31:30
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9ece6714-d109-41b3-b444-f04d74947dab
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-069", "po": "data accuracy", "subdomain": "data taxonomy, data mapping, data lineage tools", "chroma:document": "Build data type identification capability, to support automatic identification and labelling of data types and sensitivity levels within raw data, and support timely updates of identification results after asset changes, to ensure support control measures based on data types and levels."}


created_at: 2025-02-25 13:31:32
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 0b97ef02-5a2e-4646-8874-9e0b82b4ff46
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-092", "po": "data accuracy", "subdomain": "data classification", "chroma:document": "Build assets identification capability, to support the identification and labeling of various types of assets, such as whether they belong to TikTok, and support updating identification results when identification rules change."}


created_at: 2025-02-25 13:31:34
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 68c0c803-8c06-495c-938e-a64159318e3b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-093", "po": "data accuracy", "subdomain": "data classification", "chroma:document": "Build data subject identification capability, to support the identification and labelling of different data subjects (e.g. normal user, business user). "}


created_at: 2025-02-25 13:31:36
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 424526e2-b073-4aa6-9c62-c72a236d3577
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-094", "po": "data accuracy", "subdomain": "data classification", "chroma:document": "Build data format identification capability, to support the identification and labelling of different data format (e.g. ciphertext, masked data, hash value)."}


created_at: 2025-02-25 13:31:38
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4aea2d57-47a3-4608-8b7c-5fece7308262
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-095", "po": "data accuracy", "subdomain": "data classification", "chroma:document": "Build data lineage capability, to identify the data flow in engineering systems and storage resources throughout the entire data lifecycle. "}


created_at: 2025-02-25 13:31:40
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cc5579cc-ab5c-4e43-9feb-d78b529aa028
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-096", "po": "data accuracy", "subdomain": "data classification", "chroma:document": "Build user region identification capability, to identify the data subject's store region and priority region.(e.g. US, UK)"}


created_at: 2025-02-25 13:31:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 00023b23-86e9-48fb-a8a4-a31b5d0f8f29
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-011", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Create awareness program for model fairness. Provide fairness training to business and engineering teams using algorithm models. This training should cover fairness definitions, best practices, and emphasize that business decisions should not be influenced by human biases."}


created_at: 2025-02-25 13:31:44
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: fa12b92b-400a-44ca-9880-7713a21d1b29
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-012", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "When there are changes (including initial launch of model review) in model review process, such as the addition of reviewers or changes in review guidelines, training or notifications should be conducted for all affected employees."}


created_at: 2025-02-25 13:31:46
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 28a38531-d469-4547-9366-45ba51df340c
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-people-019", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish a model and AI system management awareness program. Provide policy and process requirements on model and AI system risk tier, compliance review, usage, disclosure, complaints handling, and decommissioning. Ensure that all roles (including the model user and model provider) have a clear understanding of their compliance responsibilities."}


created_at: 2025-02-25 13:31:48
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 23dd6adf-b92f-4024-afa7-8c3011b6dfff
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-022", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Establish fairness guidelines for AI models, specifying fairness definition and protection measures for prevention, validation, and monitoring of model fairness issues."}


created_at: 2025-02-25 13:31:50
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 946c21b9-9591-4eab-8a18-fee7176134d6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-023", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Establish AI model inference guidelines for user label inference, specifying labels (i.e. race) that model should not inferred  and labels (i.e. ange) that can be inferred with only limited use purposes."}


created_at: 2025-02-25 13:31:52
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 86a542ba-dbf5-417b-aead-8d64f0931718
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-032", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish policy setting out requirements for recording and management of collection, cleaning, storage, labelling and deletion of personal data in training data, specifying recording various data collection sources, storage time and location, usage purpose and scope, criteria for including and excluding certain categories of data/data sources, as well as relevant parties and responsibilities, to ensure that the transparency principle is met during the process."}


created_at: 2025-02-25 13:31:55
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 056b130f-ff7e-4501-97ad-135fd802abf4
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-033", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish training data retention policy for various data deletion scenarios such as DSAR deletion and rolling deletion, specifying deletion rules, execution steps, and deletion method for training data, memory of model and etc."}


created_at: 2025-02-25 13:31:57
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 1a84221c-88f0-48aa-b54b-9fbe37cda59b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-034", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish training data quality management policy, and provide execution strategy, specifying standards and requirements on accuracy, relevance, diversity, and timeliness and etc."}


created_at: 2025-02-25 13:31:59
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 5641c51a-d53c-4d9f-89b0-00538dd9c669
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-035", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish training data labelling policy, specifying data types, labeling requirements, and privacy principles to be followed for training data."}


created_at: 2025-02-25 13:32:01
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: fa187e1d-7347-485e-ba8a-41aa0c301400
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-036", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish policy setting out the roles and responsibilities between model users, model providers, data providers, and employees who interact with corporate models. Ensure clear data ownership and that the use of consumer data for training strictly aligns with the data controller's predefined purposes, to ensure compliance with privacy regulations."}


created_at: 2025-02-25 13:32:03
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 54e1f0ed-53b3-4b61-9aa6-430a2a001357
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-037", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish policy regarding transparency efforts for AI system. Specify clear communication to users about which models their data is used for, including the usage scenarios and purposes, to ensure informed consent and data protection compliance."}


created_at: 2025-02-25 13:32:05
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b8b8d1a9-e2bb-4a03-9ae3-bbd92ad10861
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-038", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish policy regarding the use of young user data and use of model by young user, to ensure that young users are protected when using models."}


created_at: 2025-02-25 13:32:07
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 65896813-85af-4b37-a8ee-f7446ce73331
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-039", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish Input and Output Control Management Policy for handling personal PII data in conversational scenarios. Specify the definitions and standards for PII data, and ensure identification, detection, filtering, or prohibition of certain data during the input and output processes, to ensure data privacy compliance."}


created_at: 2025-02-25 13:32:09
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: d0ba268e-dbc5-4922-a4b7-e891b7c7754b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-040", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish a risk management policy for AI system aligned to applicable laws, regulations, and principles such as the European Union's AI Act, US export control and etc."}


created_at: 2025-02-25 13:32:11
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8997f4a5-30a3-4046-bddc-ebaa7e4ecb46
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-policy-041", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish requirements for technical documentation for AI models, specifying information such as format, content, retention period, update frequency, model version information, technical architecture, and hyperparameters."}


created_at: 2025-02-25 13:32:13
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f1d259a3-1a51-4412-b445-10988cde5208
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-040", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Set up a review process for model deployment, covering the entire lifecycle of model development (such as training data creation, feature design, algorithm development, and model testing, model launch). The process should specify review steps, roles and responsibilities, and procedures for handling special cases."}


created_at: 2025-02-25 13:32:15
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4ffbe5a5-4d19-4913-83f1-4137324bbd3e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-041", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Build a review platform for the model deployment (such as training data creation, feature design, algorithm development, and model testing). This platform should enable model launch management, review workflow, review results notification, remediation workflow etc.. "}


created_at: 2025-02-25 13:32:17
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 2148e92b-65bd-40e8-a42c-8f75e7c4ebcf
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-042", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Set up an audit process for model review. Historical approval records should be audited to ensure effectiveness of the review process and gaps should be addressed."}


created_at: 2025-02-25 13:32:19
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b3906105-6a5b-4392-bf0f-55cf5abbffac
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-075", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish process for recording and management of collection, cleaning, storage, labelling and deletion of personal data in training data, including specifying roles, recording time, responsibilities for various functions, and record content (such as data sources, user consent, relevance, de-identification methods, etc.), to ensure these processes comply with the principle of transparency."}


created_at: 2025-02-25 13:32:21
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 0f01d605-5893-4600-a0dd-018fa06add65
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-076", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish process for approval and recording of access to and use of training data (such as directly accessing data storage or internal applications), specifying/clarifying the responsibilities and requirements that each role needs to bear in the access control measures (such as permission application, network isolation, etc.), to ensure the principle of data minimization."}


created_at: 2025-02-25 13:32:23
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: d9ca5f3b-d9d4-4769-8c85-f49ad2d83579
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-077", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up training data retention process, specifying/clarifying process nodes, responsible persons, and execution processes such as data deletion task configuration, triggering, execution, verification, attribution, etc., to ensure that the steps of the data deletion process are executable."}


created_at: 2025-02-25 13:32:25
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7d9b1e92-a9d1-45a1-a04c-af80fce4ec08
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-078", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up training data privacy assessment process for the process of data collection, cleaning, labeling, storage, deletion, etc., specifying/clarifying the responsibilities and evaluation points (such as accuracy, credibility, etc.) that each role needs to undertake, to ensure principles of purpose limitation, confidentiality."}


created_at: 2025-02-25 13:32:27
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 991c8586-0441-41e7-b2d4-e35b2acdda8f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-079", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up training data quality assessment process for the process of data collection, cleaning, labeling, storage, deletion, etc., specifying/clarifying the responsibilities and evaluation points (such as accuracy, credibility, etc.) that each role needs to undertake, to ensure principles of accuracy, completeness, and availability."}


created_at: 2025-02-25 13:32:29
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 15a2b821-7ded-47ef-82f7-d2af462981c2
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-080", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up training data labelling review process, specifying/clarifying the responsibilities and evaluation points that each role needs to undertake during the review process, to ensure principles of accuracy, fairness, and data security."}


created_at: 2025-02-25 13:32:31
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: c7871a6b-c601-4436-9221-344525c20c3f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-081", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish process for disclosure of information related to user data, clarifying the disclosure of service limitations, model and algorithm information, and details of personal data usage, to ensure users are informed of their rights."}


created_at: 2025-02-25 13:32:33
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e74f304c-57dd-480e-882d-080dae440d8b
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-082", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up model use feedback/complaint mechanism for handling user interactions, specifying comprehensive and actionable channels with clear procedures, to optimize user experience and safeguard their rights."}


created_at: 2025-02-25 13:32:35
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: fb654ee6-4cce-48c6-b01a-64540bd93795
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-083", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up model review process and assessment criteria for reviewing models before their official use by model users, specifying factual reviews of the model's data collection, usage, and processing practices. Establish distinct assessment criteria for internally developed and third-party provided models, and initiate an assessment process following significant model updates or upgrades. To ensure that all business parties have evaluation records when using various models."}


created_at: 2025-02-25 13:32:38
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9142288c-469e-475f-b13d-22333ba8a5b6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-084", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up process for decommissioning of models, including retention of compliance-related records and deletion of user data when models are no longer in use, specifying the timely cessation of data interactions with the model and prompt follow-up on the cleanup of historical data. This ensures that user data handling complies with data retention and deletion policy requirements."}


created_at: 2025-02-25 13:32:40
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 84711487-a515-42b9-ac28-b937a16620a2
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-085", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up Security Audit Process for model use scenarios, specifying regular security audits of the development frameworks and code being used. This process includes identifying security issues and vulnerabilities within open-source frameworks, and timely fixing of potential security weaknesses to enhance the safety of both the model itself and its usage."}


created_at: 2025-02-25 13:32:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 22b624ea-bb49-4472-8069-84e585b77aea
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-086", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up Security Backup Mechanism for model use scenarios, specifying the establishment of backup and recovery strategies for AI system data, models, frameworks, and tools to ensure effective protection of user data."}


created_at: 2025-02-25 13:32:44
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 576cd988-8258-4641-97ec-9cebb5ce86e0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-087", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up a risk management process for the entire AI system lifecycle specifying: risk level types and definitions, the purpose of the AI system and its potential impact on fundamental rights, risk assessment processes and remediation processes, documentation requirements, as well as roles and responsibilities."}


created_at: 2025-02-25 13:32:46
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9e1e7e99-7746-41a4-86ae-5c25e59ed11e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-088", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up an AI system privacy review process along with the SDLC, specifying privacy by design requirements e.g., fairness, transparency, data minimization, purpose limitations, consent, interpretability and predictability and etc."}


created_at: 2025-02-25 13:32:48
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 4051970c-5a84-4f61-b77e-eed9bb50588f
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-089", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Establish review guidelines and standards for human review of AI models for assessing AI model performance, specifying: privacy requirements and SOP, competence and training to determine if model output meets expectations."}


created_at: 2025-02-25 13:32:50
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7c6d3f84-a092-4889-a5e1-bb9aa291146a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-090", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up red-teaming assessments after a material product iteration launches and on a defined cadence thereafter. The assessments should include a risk assessment matrix and measurement index that helps to detect vulnerabilities related to privacy issues."}


created_at: 2025-02-25 13:32:52
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 58ae04d3-1aa3-485a-a8d3-a0c25f1c057a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-process-091", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up a process for external auditors to conduct compliance assessments for AI system as may be required by applicable AI laws and regulations, specifying audit scope, trigger conditions, deliverables, and stakeholders."}


created_at: 2025-02-25 13:32:54
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 823cde5f-2e39-41a0-a714-4f5f04cd9116
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-061", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "In scenarios involving model reuse and fine-tuning, build capability to perform fairness testing before fine-tuning the model. Whenever possible, select models with higher fairness levels or make fairness-based adjustments during the subsequent fine-tuning process."}


created_at: 2025-02-25 13:32:56
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 95c8e770-4e33-4021-92cb-eeed8ef97832
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-062", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "For user data involved in the model lifecycle (e.g. label, model input, model features, and model output), build technology (e.g. field name understanding, value parsing) to ensure data that prohibits collection, prohibits inference, or restriction of inference can be identified and disposed."}


created_at: 2025-02-25 13:32:58
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8681f7d4-c345-463e-b08f-13cdb461c56a
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-063", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Build technology to ensure representative and comprehensive distribution of samples in the training dataset preperation to reduce algorithmic bias towards specific sample features."}


created_at: 2025-02-25 13:33:00
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 613546a6-d06c-4096-9957-3f805edf7d8e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-064", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "During the model feature design and development, build techonology to measure whether the model performance is skewed by certain features, and adjust feature design in a timely manner."}


created_at: 2025-02-25 13:33:02
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 475cfe0a-f30f-4e5b-a9b0-23455888ef28
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-065", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Before or after the model launch, build technology to conduct fairness testing on the model, evaluating its performance across different demographic groups."}


created_at: 2025-02-25 13:33:05
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: e6975488-84bb-4efd-ae3e-603851980cb4
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-066", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Build monitor on performance of deployed models (e.g. recall rate in different groups). Alert the engineering team when the model fairness issue is identified. Take measures to address fairness issues at a timely manner including offlining models when necessary (e.g. the accuracy of the male group is much higher than that of the female group)."}


created_at: 2025-02-25 13:33:07
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f1545972-bd3b-4375-9e0d-2b9be6f4c242
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-067", "po": "ai governance", "subdomain": "analytical biases", "chroma:document": "Before or after the model launch, build technology to identify whether the model meets criteria (such as highly sensitive scenarios and highly sensitive data) that requires fairness testing, analysis, and monitoring."}


created_at: 2025-02-25 13:33:09
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: ab61451c-e672-4c3e-b6a4-aae0215c3c18
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-104", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build and implement technical capability for recording and managing the collection, cleaning, storage, labelling and deletion of personal data in the training data, to log an audit trail and monitor the processing of personal data, to ensure the transparency of the process."}


created_at: 2025-02-25 13:33:11
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: cb9c4620-4a81-4c40-8c5b-29a2be790c9e
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-105", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build personal data identification capability, especially for highly sensitive personal data and data subject(such as mobile number, email address, young user), for identifying it through fields, value parsing, data lineage, to ensure data accuracy of personal information."}


created_at: 2025-02-25 13:33:13
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: f2b425cd-eb8e-4ed9-ab27-9a360d68416d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-106", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build training data quality assessment capability for assessing the results of data collection and cleaning, such as correlation analysis and cross-verification, to identify and resolve errors such as weak data relevance and missing data, to ensure that training data is complete and available to support training objectives."}


created_at: 2025-02-25 13:33:15
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: d6e036d3-af38-4b65-b82c-9442f63eb331
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-107", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build training data monitoring, audit and anomaly detection capability for monitoring and auditing anomalies(such as data distribution and data label changes) through training data collection, cleaning, labeling, storage, and deletion to avoid risks such as non-execution and misoperation, to ensure that data anomalies throughout the lifecycle can be monitored and the process can be traced."}


created_at: 2025-02-25 13:33:17
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 7c214868-b4ff-4035-8cf5-e81d49e37757
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-108", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build training data attack detection and prevention capability(such as logs, etc.) for attacks on training data (such as member inference attacks and data poisoning attacks) to protect training data through randomization, sorting, data verification and other technical means, to ensure accuracy, integrity and availability."}


created_at: 2025-02-25 13:33:19
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9a5cd60c-8862-4e57-bd4b-67802dc9eeec
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-109", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build young user data identification capability for model use scenarios to ensure that models are appropriate for young user, restrict young users' input data, and limit the use of young users' data in training scenarios, to ensure compliance with young user data protection regulations."}


created_at: 2025-02-25 13:33:21
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 8edf659a-3d45-4e81-9600-0d8c76299e25
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-110", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build user data identification capability for tracking use of users' data across various models and services to ensure users are promptly and effectively informed about which models, and services their data is being used for and who the end users of these services are, to ensure transparency and data privacy compliance."}


created_at: 2025-02-25 13:33:23
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 86ac66cb-3c98-4966-b277-b2917e1fb4a6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-111", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build technical capabilities that informs users of, and gives users control over, how their user data is being used to train models."}


created_at: 2025-02-25 13:33:25
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: fd363a96-f7cd-4235-8667-fb147e481fc1
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-112", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build tooling to identify scenarios where content is generated by AI models and label such content as AI generated content for distinguishing between AI-enhanced and non-AI editing or generation features to clearly differentiate those functionalities and avoid confusion or misinterpretation among users, to ensure clarity and transparency in user interactions."}


created_at: 2025-02-25 13:33:27
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 42672153-b057-4db9-8ffd-2f01098d8dc0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-113", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Monitor and record input and output data of model with technical measure after it is deployed. In case the model's performance deviates from expectations, it is essential to promptly adjust or even take the model offline."}


created_at: 2025-02-25 13:33:29
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 13dfdfb6-0ff1-4255-917c-761bec571481
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-114", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build environment isolation capability for the scenario of model deployment to control resources to separate training environments from inference environments. This prevents interactions between training and inference data, mitigating the risks of data leakage and unauthorized access."}


created_at: 2025-02-25 13:33:31
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 09c6c375-a8b7-40ba-9fe5-e6c9154ff5f5
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-115", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build Continuous Input Monitoring and Blocking Capability for the scenario of model deployment to safeguard against malicious input attacks and prevent risks such as DDoS, XSS, and injection attacks. This ensures the security and integrity of deployed models."}


created_at: 2025-02-25 13:33:33
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 6f95412e-2a65-4514-92f9-04d3826561b0
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-116", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build API access control capability for the scenario of interactions with models to implement mechanisms that detect and block robotic operations. This ensures restricted access to AI models by limiting the number of queries or outputs per user within a specified time frame to prevent account misuse."}


created_at: 2025-02-25 13:33:35
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 9224134d-8e59-44d6-8d7c-6bb626858254
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-117", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build Personal Information Filtering and Management Capability for the scenario of handling inputs and outputs containing personally identifiable information. This ensures the timely identification of content featuring personal data through the creation of a manual labeling platform combined with algorithmic capabilities. This mechanism is designed to detect, filter, or process personal sensitive information as defined in the [Input & Output Controls Policy], and to prohibit or restrict the input and output of such data."}


created_at: 2025-02-25 13:33:38
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 099bdb80-827f-487d-8e95-57b12c22aa32
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-118", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build tooling that allows users to be notified of the risks associated with providing personal data (including sensitive personal data) or requesting information that they are not authorized to receive. This ensures that specific notifications are embedded to promptly inform users of the associated risks."}


created_at: 2025-02-25 13:33:40
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: a4403537-23d2-4642-8ea1-e4827a2ed10d
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-119", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Build AI system incident response logging capability for scenarios involving model inference calls and input/output access. This ensures that all details such as user IDs, timestamps, types of operations are recorded and stored, and preserved according to the data retention policy."}


created_at: 2025-02-25 13:33:42
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: 71d14e60-68c8-44e3-aedf-a659a022ce83
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-120", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Set up an AI system privacy review platform to support the operation of privacy evaluation related processes. According to the requirements of the review matrix, support the collection of model technical facts and record the review results."}


created_at: 2025-02-25 13:33:44
topic: persistent://default/default/79fbf534-6025-4841-95ab-c63f5e340f83
id: b5d5033c-2cf1-4325-8681-620d4e909cc6
encoding: FLOAT32
metadata:
{"safeguard_number": "safeguard-technology-121", "po": "ai governance", "subdomain": "ai model lifecycle", "chroma:document": "Based on the model risk level and corresponding compliance requirements, establish a red team detection capability that supports model output to discover model privacy vulnerabilities, fairness and other related issues."}


# collections

id: 79fbf534-6025-4841-95ab-c63f5e340f83
name: safeguard_database
database_id: 00000000-0000-0000-0000-000000000000
config_json_str:
{"hnsw_configuration": {"space": "l2", "ef_construction": 100, "ef_search": 100, "num_threads": 9, "M": 16, "resize_factor": 1.2, "batch_size": 100, "sync_threshold": 1000, "_type": "HNSWConfigurationInternal"}, "_type": "CollectionConfigurationInternal"}


# embedding_metadata

key: chroma:document
string_value:
Conduct training for all staff involved in Privacy Policy creation and update process, such as product managers, developers, and QA personnel, to ensure they understand Privacy Policy and correctly implement any new changes.


key: chroma:document
string_value:
Develop training programs for all personnel involved, including but not limited to product managers, developers, and QA, on the format, content, and deployment strategies for non-Privacy Policy notifications or consents (such as pop-ups). Ensure these team members are fully aware of the requirements and implement them effectively.


key: chroma:document
string_value:
Conduct regular training for all staff involved, on the standard operating procedures for setting up and managing cookie consent banners to ensure collection and processing of cookies are consistent with Cookie Policy.


key: chroma:document
string_value:
Establish guidelines for display of Privacy Policy, specifying the wording, user interface (UI), and display timing, to ensure that data subjects are provided with data collection notices before data is collected.


key: chroma:document
string_value:
Establish guidelines for non-Privacy Policy notifications, such as in-app pop-ups. The guidelines should include:  UIUX Requirements: Provide options for notifying formats, such as text, videos, or graphics, to enhance readability and efficiently convey essential information to users.Content Requirements: define the timing and content of notifications or consents. Ensure that the actual collection and processing align with the scope and purpose stated in the notification or consent.


key: chroma:document
string_value:
Establish Cookie guidelines to align cookie banner practices with the Cookie Policy, specifying consent and withdrawal procedures for cookies, as well as consistency checking rules. This ensures that the collection and processing of cookies match user consent.


key: chroma:document
string_value:
Set up a Privacy Policy management process to handle changes (including content, format, UIUX changes). This should cover change initiation, approval, and operational procedures to ensure correct Privacy Policy for right users (such as disabled users and young users) and regions.


key: chroma:document
string_value:
Establish the trigger conditions and review process for user notification updates, clarify the application, approval, operation and verification process, in order to fulfill the annual update activity and significant update activity notification requirements of specific regional supervision (such as US GPRA).


key: chroma:document
string_value:
Set up a management process for non-Privacy Policy notification, to handle changes (including content, format, UIUX changes). This should cover change initiation, approval, and operational procedures to ensure accuracy. 


key: chroma:document
string_value:
Set up a management process for Cookie Policy and Cookie banner UIUX configuration, specifying change initiation, approval, and operational procedures to ensure collection and processing of cookies are consistent with Cookie Policy.


key: chroma:document
string_value:
Build technology to verify that Privacy Policy display properly when users register or first open the app (e.g. proper content display, functional links, and right UI).


key: chroma:document
string_value:
Set up technical capability to support the display of pop-up (such as in-app notification related to the data collection/processing).


key: chroma:document
string_value:
Build technology to verify that data collection and usage activities (e.g. data type, usage scenario) align with the commitments made to users in notifications (e.g. Privacy Policy, in-app pop up).


key: chroma:document
string_value:
Build technical tools for recording, monitoring, and managing the status of Privacy Policies and user consent status, to ensure subsequent data collection and processing are consistent with user authorization. For personal information collected based on user consent, provide the ability to manage and withdraw, and synchronize the status with third-party controllers or processors. For example, when a user withdraws consent, it is necessary to stop processing and notify the third parties.


key: chroma:document
string_value:
Build technology to verify that Cookie Policy and Cookie banner display align with the regional compliance requirement, e.g. proper content display, functional links, and right UI. As well as other similar tracking technology.


key: chroma:document
string_value:
Provide the opt-in and opt-out functions for Cookies that require users' consent. Build technology to manage and monitor opt-in and opt-out status to ensure data collection and usage activities align with our committment. 


key: chroma:document
string_value:
Build a user education knowledge center to centralize manage the information related to the data subject right and user notice/consent, to help user can easily get those information such as submit the request, report or appeal, ensure the transparency. 


key: chroma:document
string_value:
Build notification capability to notify the users (e.g. what kind of law enforcement request)  when their personal information need to be accessed or shared to meet the regulator requirement. 


key: chroma:document
string_value:
Conduct PbD guideline training for affected employees, to ensure employees understand PbD principles, review and verification standards, and compliance solutions for general/special scenario. 


key: chroma:document
string_value:
Conduct training for affected employees on PbD and problem response and disposal process, to ensure that employees knows the process nodes, review/verification/disposal methods, timeline and POC.


key: chroma:document
string_value:
Provide training courses for all affected employees regarding DPIA Guideline and related processes, retain training courseware and training records, and ensure that the training recipients understand DPIA's trigger conditions, compliance significance, process timeline, and relevant parties before designing products and features.


key: chroma:document
string_value:
Establish PbD guideline to clarify meaning, goals, and implementation methods of PbD. Provide compliance solutions and rules in general/special scenarios throughout the product and feature life cycle (e.g. design, development, test, release, operation, and offline), including but not limited to feature design principle, system design principle, code standard, data management, dark pattern etc.


key: chroma:document
string_value:
Establish DPIA Guideline to clarify the definition of DPIA, the different requirements of DPIA in various jurisdictions, the impact and objectives of DPIA, the paradigm of DPIA, etc.


key: chroma:document
string_value:
Set up a platform to support PbD process and problem response and disposal process, providing online management capabilities throughout the product and feature life cycle (e.g. design, development, test, release, operation, and offline) . Its functions include process management, information recording and displaying, change and exception notification, permission control, etc.


key: chroma:document
string_value:
Set up a privacy compliance process and conduct the review on the product and feature design proposal (e.g. PRD, technical solutions, UIUX demo) to identify potential issues (e.g. dark patterns) ; and clarify the roles, review object, timeline, trigger and method etc., to ensure compliance with guidelines and special requirements in different jurisdictions, and there is no conflict with launched products and features.


key: chroma:document
string_value:
Set up privacy compliance review process for vendors who processes personal information. Before product design, provide vendors with PbD guideline and process requirements and evaluate vendors's capability. Conduct compliance review based on the design proposal of products and features provided by vendors.


key: chroma:document
string_value:
Set up review process before offline product and feature, evaluate offline proposal, clarify roles, timeline, standards, etc. If there are special circumstances that require delay or extended retention, exemption review should be carried out.


key: chroma:document
string_value:
Set up a privacy technical review process and conduct review and test on technical solution and technical facts to identify potential issues, clarify roles, tools, scope, content, timeline, etc, to ensure that products and features comply with the PbD guideline technically.


key: chroma:document
string_value:
Set up a privacy technical verification process to maintain records of PbD process and results and compliance solution execution, technical detection data etc, develop plan for manual and technical verification combined with external regulatory requirements and privacy policies,, clarify roles, trigger, tools, scope, timeline, etc, to ensure effectiveness of PbD capabilities.


key: chroma:document
string_value:
Set up privacy compliance verification process for vendors who processes personal information. Verify the products and features provided by vendors based on manual and technical capabilities, clarify scope, timeline, method, etc., and link with the problem response and disposal process.


key: chroma:document
string_value:
Set up feedback compliance review process. When privacy concerns are raised by users, testing agencies or others, conduct targeted privacy review and technical verifications, develop adjustment plans and complete iteration to ensure that privacy feedback can be promptly and accurately reviewed, verified and disposed.


key: chroma:document
string_value:
Set up offline testing process, use manual or technical means to test products and features that have already implemented offline plans, to ensure that data processing activities within the offline scope are effectively terminated, historical data is effectively disposed of, etc.


key: chroma:document
string_value:
Set up problem response and disposal process for PbD, clarifying the roles and responsibilities, advancing the timely warning, risk assessment, plan formulation, upgrade decision-making, follow-up disposal, review and verification, and accountability for violations.


key: chroma:document
string_value:
Establish DPIA trigger judgment process, clarify the trigger conditions and thresholds, collect and retain product/feature information (eg. data type, data processing purpose, etc.) used to determine whether DPIA is needed, output judgment conclusions based on DPIA Guideline, and record the judgment process and results information. Clarify the required information list, judgment party, judgment criteria, timeline etc., to ensure that the business team can provide relevant information efficiently and completely, and have basic expectations for whether DPIA should be carried out.


key: chroma:document
string_value:
Establish DPIA assessment process. For situations where DPIA is required, collect and retain product/feature information used to assess risks (eg. safety measures taken, user interaction mode etc.), output risk assessment conclusions (eg. risk level, risk mitigation plan, etc.), and record the assessment process and results information. Clarify the required information list, assessor, assessment criteria, timeline, etc.


key: chroma:document
string_value:
Establish DPIA assessment result implementation process. Implement risk mitigation plans based on DPIA risk assessment conclusions and record the implementation status. Clarify the responsible parties and timeline for implementation.


key: chroma:document
string_value:
Establish DPIA verification process. For situations where DPIA plans have been implemented, formulate a verification plan based on the DPIA assessment conclusions, collect and process implementation information (eg. data retention, individual rights, etc.), and use manual and technical means to complete the verification. Clarify the verification party, trigger method, verification tool, verification scope, timeline, etc. Ensure that the DPIA risk mitigation plan is implemented accurately and timely.


key: chroma:document
string_value:
Establish DPIA re- or supplementary assessment process. For situations where DPIA assessments have been conducted, determine the trigger conditions for re- or supplementary assessments based on DPIA Guideline (eg. substantial changes in feature/product/scenario, changes in laws and regulations, changes in data processing purposes and methods, etc.), collect the information required to determine whether the trigger conditions are met, and set up a regular review mechanism to conduct re- or supplementary assessments, and link with the DPIA implementation and verification process to track updates. Clarify the information list, assessor, timeline, etc.


key: chroma:document
string_value:
Establish DPIA disclosure process. When a disclosure need arises (eg. from regulators), guide the DPIA confirmation, review, and disclosure process, clarify the roles and responsibilities, the form of disclosure, and the continuous follow-up mechanism after disclosure.


key: chroma:document
string_value:
Build configuration capability that cater to regions (eg. EU, US). It can perceive configuration results and verify compliance to meet privacy compliance requirements of different business scenarios and jurisdictions.


key: chroma:document
string_value:
During development, use static detection to identify risks and support code merge interception to ensure that the code complies with PbD guideline.


key: chroma:document
string_value:
During continuous integration ("CI") progress, use technical means (eg. static and dynamic detection) to conduct unit and integration test, identify risks and support deployment interception to ensure that the test version complies with PbD guideline and conclusions.


key: chroma:document
string_value:
During continuous deployment ("CD") to gray phase release, use technical means (eg. static, dynamic and traffic detection) to conduct regression test, identify risks and support release interception to ensure that the release version complies with PbD guideline and conclusions.


key: chroma:document
string_value:
After product and feature full launch, use technical means to monitor online status, identify risks, warn timely and support controls (eg. cut off and offline) to ensure that the release version complies with PbD guideline and conclusions.


key: chroma:document
string_value:
Establish DPIA management tool, which can achieve: process automation/semi-automation management (including linkage between processes), recording and displaying information (eg. the current node, process results, etc.), synchronization of information (eg. changes in data processing purposes due to feature iterations), DPIA management (eg. uploading, downloading, adding, deleting, modifying), permission management, notification prompts (eg. triggering reassessment), data analysis, etc.


key: chroma:document
string_value:
Conduct regular or irregular training on policy, process, and technology related to individual rights to all affected employees, and clarify relevant requirement. Additionally, retain all training material and records.


key: chroma:document
string_value:
Establish individual rights response guidelines for each jurisdiction following the relevant laws. Include response rules for all individual rights (e.g.  right of access, right to rectification, right to data portability, right to erasure ) and specify response duration and requirement for different special scenarios.


key: chroma:document
string_value:
Establish guidelines to handle individual rights requests requested by third-party agents (e.g. request via in-app account, or other channels) for each jurisdiction following the relevant laws, specifying response rule such as response times, specific actions for general and special scenarios. 


key: chroma:document
string_value:
Set up individual rights response process, specifying roles and response, execution methods, key nodes, specific actions, and qualification conditions throughout the entire process. This process should match to existing business forms and flexible to expand for new scenarios.


key: chroma:document
string_value:
Set up a conflict management process for managing conflicts arising from individual rights, which guides detection, evaluation, and resolution of conflicts. The process should clearly define potential scenarios of conflicts, relevant roles and responsibilty, evaluation rules, resolution methods, and qualification conditions etc..Example:- exercising rights in different countries, - user mode change during teh processing- exercise the right to erasure data during the period of exercise right to portability- conflicts between individual rights and public interests.


key: chroma:document
string_value:
Set up a data consistency check process that clarifies relevant POCs, inspection methods, expected results, and remediation resolutions when restoring backup data due to special circumstances.If restored data is different from the data used to respond to data subject rights, take immediate actions to ensure execution effectiveness.


key: chroma:document
string_value:
Set up a process for managing complaints, specifying role and responsibility, complaint evaluation, verify procedures, key nodes, specific actions and qualification conditions etc. Additionally, provide users with explanations regarding complaint rejections, if necessary, and offer the appropriate regulatory contact information for their region.


key: chroma:document
string_value:
Set up a process for the disposition of data (such as copies and caches) generated during the response process. Define the data types, relevant POCs, caching mechanisms, and the disposition actions (such as direct deletion, temporary freezing, retention as evidence, etc.) . 


key: chroma:document
string_value:
Set up a process to verify the legitimacy of individual rights requests, defining key nodes, POC, operating procedures, and qualificartion conditions. Ensure that the request has a legal basis and does not fall under legal restrictions or exceptions.


key: chroma:document
string_value:
Set up SLA management process for responding to individual rights, specifying SLA in various countries/regions. Monitor and identify behaviors that may violate SLAs, send alerts to relevant POCs to follow-up. If SLA violations have occurred, escalation action must be taken (e.g. reasonable deferral, regulator report).


key: chroma:document
string_value:
Set up a process to handle individual rights requests submitted by third-party agents, determine the appropriate response mode and methods.defining the POC, execution methods, control nodes, specific actions, and admission criteria for different scenarios. Determine the appropriate response mode and methods，additionally, define the responsibilities, standards, and response modes for third-party agents in responding to rights requests.


key: chroma:document
string_value:
Set up a third-party notify and cooperation process for individual right response, clarify scenarios in which they should be engaged, POC, notification methods, cooperation task, feedback deadlines and quality assurance etc. and follow up on progress. 


key: chroma:document
string_value:
Build individual rights request capability for right to access, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS.


key: chroma:document
string_value:
Build individual rights request capability for right to rectification, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS.


key: chroma:document
string_value:
Build individual rights request capability for right to data portability, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS.


key: chroma:document
string_value:
Build individual rights request capability for right to erasure, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS.


key: chroma:document
string_value:
Build individual rights request capability for right to restriction of processing, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS.


key: chroma:document
string_value:
Build individual rights request capability for right not to be subject to automated decision-making, including profiling,including profiling, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS.


key: chroma:document
string_value:
Build encryption and de-identification capability for the data during individual rights fullfillment. Implement data isolation and access control technologies to ensure personal data is only accessible to authorized personnel, including the data subject and necessary participants. Avoid infringing on the rights of other users.


key: chroma:document
string_value:
Build capability to respond to "right to access". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to response, including data types, processing purposes, automated decision-making use, and data disclosure status etc..


key: chroma:document
string_value:
Build capability to respond to "right to rectification". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to rectify any inaccurate or incorrect personal data or automated decision-making results throughout the entire process.


key: chroma:document
string_value:
Build capability to respond to "right to data portability". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to provide an electronic copy or assist the requester as necessary in transferring it to another entity.


key: chroma:document
string_value:
Build capability to respond to "right to erasure". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to delete the requested personal data throughout the entire process. If litigation holds apply, invoke exemption capability of Data Retention System until litigation hold period expires. 


key: chroma:document
string_value:
Build capability to respond to "right to restriction of processing". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to restrict processing activities throughout the entire process and seal its historical record.


key: chroma:document
string_value:
Build capability to respond to "right not to be subject to automated individual decision-making, including profiling". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to provide users with actionable options to free from it and take appropriate actions based on the choice.


key: chroma:document
string_value:
Build authentication capabilities for requesters (users/third parties). For in-app request, such as digital signatures and integrity checks can be used. For off-app request, such as QR codes, SMS verification codes, and passwords can be used. Minimize data collection while ensuring effective identity verification.


key: chroma:document
string_value:
Build inform capability of individual right response result and complaint disposal result, such as in-app pop-ups, website notification and email, notify the information (e.g. request status, execution result, deferal reason) to the requester in a timely manner with standardized format.


key: chroma:document
string_value:
Establish a system to record individual rights requests, including relevant details like request status, contact information, country/region, request content, submission, receipt, and response time, response method, and refusal reasons. Ensure that this information is stored in compliance with legal requirements and is deleted appropriately once it has served its intended purpose.


key: chroma:document
string_value:
Establish metrics to measure the quality of individual right responses, and use the capability to collect data on the distribution and response times of different individual right requests across the countries/regions covered by the strategy (such as average response time, response delay numbers, etc.) for reporting on the response to rights.


key: chroma:document
string_value:
Build capability to respond to "right to know". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to provide relevant information, including data controller, processing purposes and legal basis, data retention period, and individual rights etc..


key: chroma:document
string_value:
Build capability to respond to "right to object". Comply with relevant policies based on the requester's type (normal user or third party), country/region, and request method (in-app or off-app) to provide users with options to object data processing and take appropriate actions based on the choice.


key: chroma:document
string_value:
Build individual rights request capability for right to know（including the right to be provided information where personal data are collected from the data subject or from third party）, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS.


key: chroma:document
string_value:
Build individual rights request capability for right to object（including the right to object processing based on legitimate interests,public interest,or direct marketing）, which provides access portals for different regions and situations. Implement standardized design and validation procedures for the portals' UI/UX, and ensure that all interfaces and processed data are properly encrypted transmission, such as via HTTPS.


key: chroma:document
string_value:
Conduct regular training for all employees on data sharing, including application process for data sharing, compliance requirements, potential risk and mitigation measures etc.


key: chroma:document
string_value:
Conduct cross-border data transfer policies training to all relevant stakeholders, including USDS and Non-USDS members, anthorized and restricted personnel, CN and non-CN employees, applicants and approvers. Ensure everyone understands the latest policies, guidelines, and specifications during policy launches & changes, as well as daily operations involving data transfers. At the same time, an examination section is set up for necessary personnel, and the passing score and pass rate of the examination are determined to ensure that relevant personnel accurately understand and comply with the compliance requirements for cross-border data transfer.


key: chroma:document
string_value:
Provide regular/irregular cross-border data transfer related trainings to all relevant personnel to clarify requirements, and retain training materials and records.


key: chroma:document
string_value:
Conduct policy training for employees involved in law enforcement request response, introduce methods for determining the sensitivity level of response materials, and different control requirements for different levels.


key: chroma:document
string_value:
Establish data sharing guidelines to clarify the requirements and execution rules, such as pre-sharing checkpoints, monitoring rules during sharing, data deletion after sharing, etc., and meet the legal requirements, contractual agreements, and privacy protection principles of different jurisdiction regions.


key: chroma:document
string_value:
Establish purpose limitation guidelines for cross-board data transfer(before transfer and data usage after transfer), specifying data types, permitted transfer purposes, usage purpose restriction after the transfer etc.


key: chroma:document
string_value:
Establish cross-border data transfer guidelines for different regions. These guidelines, tailored for groups like USDS, Non-USDS, authorized and restricted employees, CN and non-CN staff, offer detailed strategies for transferring data across data centers. They should cover requirements on data type, data access, data tags and classxifications, data transferring compliance rules, introduction of data transferring gateways, etc. 


key: chroma:document
string_value:
Establish gateway guidelines for cross-border data transfer, specifying gateway type, configuration, data labels etc. for R&D and data analysts when they need to set up or update the transfer channels. 


key: chroma:document
string_value:
Establish data catalog and data classification guidelines specifically for cross-border data transfer, including data category, data type, descriptions, data samples etc.for R&D, data analysts, security and compliance team when they need to apply, approve,  configurate the transfer channels. 


key: chroma:document
string_value:
Establish data cross-border transferring approval guidelines, when reviewing cross-border transfer requests from business teams, review teams should follow the clear approval guidelines and ensure approval result consistency.  


key: chroma:document
string_value:
Maintain a region list where data cross-border transfer is allowed/prohibited. Provide context and approval guidelines when employees apply for data cross-border transfer or access, including the list of cross-border data transmission regions and the list of region for employee access etc..


key: chroma:document
string_value:
Establish third party data transfer guidelines for cross-border data transfer, specifying gateway and channel configuration, data center restrictions etc. when transferring or receiving user data corss-border with third parties.


key: chroma:document
string_value:
Establish data sharing agreement for signing with data recipient before data sharing, specifying the shared data scope, purpose, duration, protection measures (e.g. access control and encryption),and data return or destruction mechanisms. 


key: chroma:document
string_value:
Establish a third party management guidline, specifying third party definitation, management requirments, execution rules in cooperation, such as due diligence and review checkpoint, contract review and signing, audit, event response, data return or deletion, etc., to ensure that data processing behavior during the cooperation is security and compliant.


key: chroma:document
string_value:
Establish cross-border data guidelines to clarify the requirements and execution rules for cross-border data transfer,such as the definition of cross-border data transfer, compliance requirements, etc., and meet the legal requirements of different jurisdiction regions.


key: chroma:document
string_value:
According to the "adequacy decision" requirements of GDPR or similar legal requirements, establish and regularly update the "Adequacy Decision" list under different jurisdictions (i.e., countries or regions considered to provide sufficient privacy protection levels), to ensure the accuracy of the list.


key: chroma:document
string_value:
Establish legal basis identification guidelines for cross-border data transfer, sort out the legal basis, applicable premises and compliance measures in various jurisdictions, guide the identification and management of legal basis, and ensure the accurate identification and application of legal basis.


key: chroma:document
string_value:
Establish agreements for signing with data recipients before cross-border intracompany data transfers，and clarify the management requirements, such as the application of data cross-border transfer agreement templates, agreement review and signing, incident response, and data return or destruction mechanisms, to comply with the latest legal and regulatory requirements.


key: chroma:document
string_value:
Establish agreement for signing with data recipient before cross-border data transfers with third parties, and clarify the management requirements, such as the application of data cross-border transfer agreement templates, agreement review and signing, incident response, and data return or destruction mechanisms, to comply with the latest legal and regulatory requirements.


key: chroma:document
string_value:
Establish response policy for law enforcement requests, clarify control requirements during the response process, including timeliness requirements, traceability requirements for process records, authenticity and accuracy requirements for result materials, materials retention requirement, related roles and responbilities, and data security requirements for the entire process.


key: chroma:document
string_value:
Establish control requirements for the law enforcement response materials, clarify the P&C markings of the materials during preparation, access control requirements, usage purpose restrictions, and requirements for archiving and deleting after the response is completed.


key: chroma:document
string_value:
Establish control requirements for P&C materials, clarify the criteria for determining P&C mark, and establish access control, usage restrictions, archiving and deletion, and other requirements for materials marked as P&C.


key: chroma:document
string_value:
Set up data sharing application process, clarifying apply and review process, including submission entrance, submission material (e.g. requirement document, technology solution), review objective as well as roles and responsibilities etc..


key: chroma:document
string_value:
Set up data sharing change management process when changes in data sharing are identified through monitoring or proactive notifications from business parties. Ensure risk assessment, additional approval, and contract update are followed through when needed.


key: chroma:document
string_value:
Set up a data sharing termination process, specifying stakeholder communication, termination initiation and approval, operation and recovery process.


key: chroma:document
string_value:
Set up a process for data disposal after sharing is complete. Guide employees to ensure data recipients retain or delete shared personal data as per contract terms. Collect and verify evidence of the disposal outcomes, and clearly assign responsibilities for these actions.


key: chroma:document
string_value:
Set up a management process for privacy event identified in data sharing, which should cover requirements on root cause analysis, follow-up action, remediation timeline, roles and responsibilities, documentation and record keeping etc. 


key: chroma:document
string_value:
Set up a due diligence process for third party vendors. Before sharing data, guide employees to thoroughly review the vendors' capabilities and qualifications to ensure they can securely handle data and comply with agreed terms.


key: chroma:document
string_value:
Set up an audit process for access permission granted to third party personnel and their accessing activitiesm, to ensure it meets the agreed data sharing requirements.


key: chroma:document
string_value:
Set up management process for privacy event identified in data sharing with third party vendors, including root cause analysis, follow-up action, remediation timeline, roles and responsibilities, documentation etc. 


key: chroma:document
string_value:
Set up an audit process for third party vendors. Define the credit rating for vendors and specify the audit items, requirements, and audit frequency for different credit levels.


key: chroma:document
string_value:
Set up data sharing record maintenance process for maintain facts from different source such as approval processes, monitoring platforms, including the scope of shared data, the recipient entity, sharing purpose, the start and end time, etc., and continuously maintain accurate records, to ensure meet the needs of inquiries, risk identification, etc.


key: chroma:document
string_value:
Set up an approval process for cross-board data transfer channels, outlining approval process as well as roles and responsibilities for the process. 


key: chroma:document
string_value:
Establish cross-border data transfer approval strategy, targeting approval personnel responsible for cross-border data transfer. When reviewing cross-border data transfer applications from business personnel, standardized and unified audit standards are provided to reach consistent audit conclusions.


key: chroma:document
string_value:
Set up an audit process for cross-border data transfer channels. Conduct regular audit process for transfer channels.


key: chroma:document
string_value:
Set up a change management process related to cross-border data transfer channels (e.g. transfer destination change, updates to data fields and channel deprecation), outlining process requirements of change intiation, approval process, channel removal etc.


key: chroma:document
string_value:
Set up a purpose review process for cross-border data transfer channels, review the usage purpose after transferring to ensure compatibility with the purpose that the channel first applies for. 


key: chroma:document
string_value:
Establish a change notification process for cross-border data transfer requirements. All stakeholders should be notified of requirement changes, including but not limited to business teams and cross broder application review teams.


key: chroma:document
string_value:
Build a trusted platform to support the application and approval process for managing cross-border data transfer requests.


key: chroma:document
string_value:
Set up an appproval process for cross-border data transfer channels with third parties, which incldes requirements of request initiation, review and approval, as well as roles and responsibilities.


key: chroma:document
string_value:
In response to the user's request to change the Country Code, a complete process should be established to ensure that the user can smoothly complete the change. The process should include reviewing and verifying the user's current Country Code, supporting the user to complete the process of changing the Country Code, and recording the user's Country Code change record and the user's latest Country Code during the process. At the same time, the user data that has changed the Country Code should be migrated/deleted synchronously according to the existing company system (if involved).


key: chroma:document
string_value:
Set up an audit process for data sharing, specifying audit process and checkpoints, such as the consistency among technical facts from monitoring with the contract, the approval requests.


key: chroma:document
string_value:
Establish a data sharing agreement maintenance process, specifying archive the agreement in a timely manner after signing with the data recipient, and review and modify the agreement content as needed when changes occur of data sharing facts, to reach a new consensus with the data recipient.


key: chroma:document
string_value:
Establish a third-party notify and cooperation process for vendor significant event response, such as bankrupt, serious data security incident, contract/agreement violation,  specifying event intake, stakeholder notification, conduct impact and risk assessment, and risk tracking and disposal mechanism etc.


key: chroma:document
string_value:
Establish a law enforcement response process when the regulators ask for personal information, specifying request intake and legality verify in a timely manner, extract dataset and verify completeness of dataset to meet the request. 


key: chroma:document
string_value:
Establish a process to prioritize law enforcement response, specifying the expedited nodes (e.g. automatic dataset extraction, manual urgent response) to prioritize the emergency law enforcement request, and upgrade the dataset extraction tool if necessary.


key: chroma:document
string_value:
Establish legal basis identification process for cross-border data transfer, to ensure the legal basis is identified (such as adequacy decision, SCC,user consent, etc.) before the data is transferred across borders, and measures are taken to comply with the latest legal and regulatory requirements.


key: chroma:document
string_value:
Establish requirements follow-up process, sorting out and updating legal and regulatory requirements regarding cross-border data transfer. When there are changes in requirements, adjustments should be made to measures and legal documents to ensure the compliance of cross-border data transfer.


key: chroma:document
string_value:
Establish framework certification process to guide how to certificate and maintain validity of framework certification (such as the EU-US Data Privacy Framework), ensuring that the company can achieve cross-border data transfer based on such framework certification.


key: chroma:document
string_value:
Establish assessment process for cross-border data transfer, clarifying requirements of request initiation, review and approval, as well as roles and responsibilities, to ensure that cross-border data transfer complies with legal and regulatory requirements.


key: chroma:document
string_value:
Establish audit process for cross-border data transfer, conduct audit on cross-border data transfer compliance on a regular/irregular basis. Address issues identified in this process,to ensure that cross-border data transfer complies with legal and regulatory requirements.


key: chroma:document
string_value:
Establish a parsing process for enforcement requests, guides response employee to classify issues and parse the original request into standardized questions, such as effected region, data subject scope, data type scope,etc to ensure that supporter can quickly understand the task and prepare materials.


key: chroma:document
string_value:
Build data data obfuscation capability for data sharing, including technologies such as mask, hash, truncation information, to ensure the minimun sharing scope. 


key: chroma:document
string_value:
Build encryption capability for data sharing, e.g. data field encryption, channel enryption, to ensure data security during sharing.


key: chroma:document
string_value:
Build service/interface authentication capability for data sharing via interface request, e.g. signature verification. For sensitive scenarios, e.g. transaction and payment, implement dual-way authentication to avoid man in the middle attack etc.


key: chroma:document
string_value:
Build monitoring capabilities in testing environments for data sharing to identify the data type, providers, recipients, and destination countries before sharing. This approach ensures effective evaluation of the data to be shared and helps detect any potentially non-compliant data sharing activities.


key: chroma:document
string_value:
Build security detection capabilities like vulnerability scanning and penetration testing to dectect any known security vulnerabilities when using vendor-provided tech components, such as integrating a vendor's SDK or using their platform.


key: chroma:document
string_value:
Build cut-off capability for data sharing, to ensure the sharing activities can be terminated when data sharing guidelines/agreement terms are violated or agreement terms expire. 


key: chroma:document
string_value:
Build monitoring capability for data sharing, identify and monitoring the sharing activities including data types, sharing purposes, providers, recipients, destination countries, start and end times, frequency etc. and the change of these technical fact. The monitoring result should be available for search, analysis and audit.


key: chroma:document
string_value:
Build authentication capabilities on the platform which grant vendor access to share data, such as QR code scanning, SMS verification, and password checks, and  enable two-factor authentication for sensitive operations or accessing sensitive data.


key: chroma:document
string_value:
Build access management capabilities on the platform which grant vendor access to share data, such as permission search, change and removal.


key: chroma:document
string_value:
Build access log and audit capabilities on the platform which grant vendor access to share data, including operator, time, operation object, actions, to ensure any non-compliant activities can be traced and audited.


key: chroma:document
string_value:
Build data cross-border transfer gateways with technical capability to verify and control transfer activities (such as filtering invalid fields, identifying and intercepting protected data, etc.)


key: chroma:document
string_value:
Build technology to restrict the modification of data transfer direction, destination, data center and other information of the channels that have been approved and in use.


key: chroma:document
string_value:
Use cross-border data transfer technology (e.g. gateway, channel, platform) which is certified by the trusted 3rd-party (e.g. Oracle), so that the transfer activities can be effectively audited and monitored. 


key: chroma:document
string_value:
Build cut-off technology for cross-border data transfer, to terminate the transfer activities when the channels are deprecated.


key: chroma:document
string_value:
Build data access control technology for data approved for cross-border transfer and storage in destination data centers. Ensures that only authorized personnel can access and use the data for specific purposes.


key: chroma:document
string_value:
Build data label recommendation and validation capabilities for applicants and approvers to use during the process of cross-border data transfer request and approval, to enhance accuracy of data label annotation.


key: chroma:document
string_value:
Build monitoring capability for cross-border data transfer technical components (e.g. gateway, transfer channel, data flow), to ensure the consistency between actual transfer data and applications. Alert and notify relevant stakeholders any anomalies. 


key: chroma:document
string_value:
Build tracking and monitoring capabilities for the usage and storage of data allowed for transfer (e.g. data lineage, asset lineage, purpose verification). Restrict unauthorized usage to ensure that data usage is compatible with the stated purposes in the application. Alert and address any anomalies. 


key: chroma:document
string_value:
For data processing activities involving cross-border transmission of user data, corresponding technical capabilities should be possessed to confirm and verify the user's current latest Country Code, in order to confirm the data cross-border transmission rules applicable to the current cross-border transmission of user data, and avoid user data entering non-compliant data centers due to incorrect judgment of the user's Country Code.


key: chroma:document
string_value:
Build consent manangement capability to verify the shared data has obitained user consent when the sharing based on the user consent, and supporting linkage of other technical capabilities to stop sharing promptly when the user withdraws consent, and require the data recipient to retain or deletion, etc.


key: chroma:document
string_value:
Build purpose verify capability of data sharing to verify the purpose complies with laws and regulations, within the scope of the privacy policy, and is consistent with the purpose agreed upon in the contract with the data recipient when sharing data.


key: chroma:document
string_value:
Build data extraction capability to accurately extract personal information according to  law enforcement requests.


key: chroma:document
string_value:
Build security capability for the Lert Tool, including authentication, permission control, operation record audit, data encryption, data deletion etc., to ensure data confidentiality when responding to law enforcement.  


key: chroma:document
string_value:
Establish monitoring capability to monitor and identify cross-border data transfer,including data types, data flows, the amount of data, providers, recipients, destination countries, start and end times, frequency etc.. The monitoring result should be available for search, analysis and audit.


key: chroma:document
string_value:
Build monitoring capabilities for cross-border data transfer to identify data types, data flows, the amount of data, provider, recipient, destination country, etc. before data sharing.This approach ensures effective identification of cross-border data transfer and triggers corresponding assessment process.


key: chroma:document
string_value:
Build monitoring capabilities for cross-border data access to identify data types,access permissions, accessing parties, accessed parties, etc..This approach ensures effective identification of cross-border data access and triggers corresponding assessment process.


key: chroma:document
string_value:
Build capabilities for cross-border data transfer,such as data pseudonymization, data desensitization, and data encryption etc. to ensure the minimization and security of cross-border data transfer, and to avoid data leakage during the cross-border data transfer.


key: chroma:document
string_value:
Build cut-off capability for cross-border data transfer, to ensure the cross-border data transfer can be terminated when prohibited cross-border data transfer or violations are discovered, and ensure that cross-border data transfer comply with legal and regulatory requirements.


key: chroma:document
string_value:
Build record capability for the Lert tool to log the activity in response, including receiving, veriftion, dispatching, material preparation, material validation, and result feedback. The log should record executor, action, result, timestamp, etc.


key: chroma:document
string_value:
Conduct PIR Policy and handling procedures training for information collection/receiving parties, business liaison POCs, customer service personnel, and other relevant personnel and roles during policy release and daily incident handling processes. Relevant personnel should be informed and ensured to understand the initiation and handling process of privacy incident-related policies and procedures.


key: chroma:document
string_value:
Establish privacy incident handling guidelines, which provides clear guidance on how to respond to privacy incident (such as user data leak or malicious tampering of user data, etc.), including defining and identifying privacy incidents, evaluation and grading standards, response measeres, notification, reporting and corresponding resposibilities of each role.


key: chroma:document
string_value:
Set up a privacy incident identification machanism and process, specify the initiation of various stages such as privacy incident analysis, evaluation and classification, and event investigation when a privacy incident occurs. Determine the personnel roles required for each stage and the responsibilities that different roles need to undertake in each stage.


key: chroma:document
string_value:
Set up a connected mechanism and process with 3rd parties, guiding on how to involve 3rd parties and the responsibilities they need to undertake in stage of the analysis, evaluation, investigation, handling, and response of privacy incidents.


key: chroma:document
string_value:
Set up a privacy incident notification process, guide the notification methods, scope, content issuance, and other related matters when it is necessary to notify users or individuals of privacy incidents. The process should also outline the roles and responsibilities of personnel involved.


key: chroma:document
string_value:
Set up a regulator reporting process, includes guidance on reporting, feedback, response, and remediation of privacy incidents when reporting to regulators is required. Determine the personnel roles required for each stage and the responsibilities that different roles need to undertake.


key: chroma:document
string_value:
Set up an escalation process, guide on how to escalate the necessary personnel roles and responsibilities of each role when the escalation conditions are met during the incident handling process (such as timeout, negative handling, execution errors, etc.).


key: chroma:document
string_value:
Set up a recording mechanism to record the handling of privacy incident response, timely and accurate recording of the time of the incident, discovery methods, event details, personnel involved, and handling measures should be made when a privacy incident occurs.


key: chroma:document
string_value:
Set up a mechanism for updating privacy incident response rules and procedures, guides legal, privacy incident owners, and other roles to optimize and update relevant privacy incident response policies, privacy incident response process mechanisms, etc. in a timely manner when regulatory changes occur, to ensure that the corresponding policies and process mechanisms comply with regulatory requirements.


key: chroma:document
string_value:
Set up a recovery mechanism, when a privacy incident occurs and the cause of the incident is determined, guid a recovery action plan based on the analysis and evaluation results of the incident to address the current problem and prevent the possibility of recurrence in the future. Determine the personnel roles required to participate in and the responsibilities they need to undertake.


key: chroma:document
string_value:
Set up a lesson learn mechanism, including reviewing the effectiveness and role of each node in the privacy incident handling process, identifying shortcomings in the privacy incident handling process, and continuously improving the response and remediation process of privacy incidents.


key: chroma:document
string_value:
Build location analysis capbility(such as log analysis capabilities, network forensics capabilities, and analysis of malicious code in isolated environments) to locate and confirm the causes and scope of the incident, in order to assist in further handling and correction of the incident.


key: chroma:document
string_value:
Build automated notification capabilities(such as notification center capabilities and system notification capabilities on the client side) to accurately send event notifications to affected users and individuals, ensuring the effectiveness and accuracy of event notifications.


key: chroma:document
string_value:
Build remedial capbility (such as automatic system disabling, system isolation, communication control, immediate automatic update of keys/certificates, data backup and recovery, system recovery, service recovery, etc.) ,and should be activated immediately after the occurrence of a privacy incident to suppress/mitigate the consequences caused by the incident.


key: chroma:document
string_value:
Build monitoring capbility (such as establishing a network event database, network and system monitoring, abnormal behavior monitoring, etc.)to closely monitor potential privacy incidents, and alert and dispose of relevant personnel when triggering abnormal thresholds, in order to achieve the effect of early prevention.


key: chroma:document
string_value:
Build collaborate capbility (such as information synchronization interfaces, abnormal monitoring capabilities, etc.) to ensure timely synchronization of events and follow-up on handling situations.


key: chroma:document
string_value:
Conduct data retention training for all affected employees regularly or when alterations occur (e.g., add deletion rules, changes in deletion scope), to clarify the latest requirements and processes related to data retention.


key: chroma:document
string_value:
Notify all relevant stakeholders of any changes in data deletion policies/tools through various communication channels (such as emails, internal workplace announcements, mobile message notifications, etc.), ensuring they are aware of and adhere to the latest policies and procedures.


key: chroma:document
string_value:
Establish data retention guidelines, specifying the data type and corresponding retention requirements in different scenarios: account deletion, DSAR (Data Subject Access Request) deletion, UGC content deletion, etc. It should also include detailed instructions of deletion rules, execution steps, deletion timing and deletion method, etc.


key: chroma:document
string_value:
Establish guidelines to preserve data under Litigation Hold, specifying data deletion exemption mechanisms including data preservation (to prevent unexpected deletion) and protection (e.g. access limited only authorized personnel) requirements.


key: chroma:document
string_value:
Establish region-specific data retention guideline for various data sovereignty states/regions, evaluate potential compliance risks in each business area, update data retention requirements promptly, and review regularly for applicability.


key: chroma:document
string_value:
Set up management process of data SOT (source of truth), clarifying the data update, verification and synchronization process for all SOT (e.g. TTP, ROW, DT, DR online, DR offline), to ensure the data sources are consistent across data deletion nodes. 


key: chroma:document
string_value:
Set up configuration effectiveness verify process before data deletion starts. Ensure deletion configuration is consistent with deletion rules and updated in accordance with latest date deletion requirements. 


key: chroma:document
string_value:
Set up a process for remedation of gaps identified in data retention, which should include steps covering root cause analysis, follow-up action, remediation timeline, roles and  responsibilities, as well as record keeping. 


key: chroma:document
string_value:
Set up an operation process for data deletion, including setting SLA target for data deletion tasks, defining roles and responsibilities, and monitoring procesures. Once abnormalies are identified, relevant task owners should be notified to address the issue. 


key: chroma:document
string_value:
Set up data deletion audit process, conduct audit on data deletion procesures and remediation processes on a regular/irregular basis. Address issues identified in this process.


key: chroma:document
string_value:
Build asset discovery capability to continuously identify newly created databases, tables, storage components, and various types of user data etc., to ensure comprehensive and accurate coverage of data deletion.


key: chroma:document
string_value:
Build data identification capability to ensure accurate classification of data types, data subjects, and region labels are attached to data fields. This helps prevent accidental and wrongful deletion caused by misclassification of data.


key: chroma:document
string_value:
Build technology (such as allowlist verification and independent storage) to preserve data (e.g. litigation hold data) from regular deletion schedule, and apply separate access controls to avoid accidental deletion and unexpected access. After the exemption period ends,  the data should be deleted.


key: chroma:document
string_value:
Build capability to differientiate data from various regions and set up country specific retention/deletion based on data sovereignty requirements.


key: chroma:document
string_value:
Build SOT ("source of truth") synchronization and verification capabilities, including syncing data changes to SOT, updating the latest SOT throughout the deletion workstreams, and verifying the integrity of SOT to ensure data scope consistency with SOT.


key: chroma:document
string_value:
Build data retention/deletion capability to perform deletion strategy/task  (e.g., rolling deletion, account deletion, DSAR deletion, account deletion, content deletion, and other deletion scenarios, etc.), to ensure accurate and thorough removal of retained data from all business systems. 


key: chroma:document
string_value:
Build capability to check and validate the deletion tasks from upstream to downstream systems. Regularly verify the deletion operations among data retention system and its upstream/downstream system to ensure that all scenarios are properly covered and accuracy of the deletion process is maintained throughout the entire workflow.


key: chroma:document
string_value:
Build capability to scan residual data and conduct root cause analysis for residual data, and ensure remediation is followed.


key: chroma:document
string_value:
Build log management capability for data retention, to log the initiation of deletion tasks, execution details, callback events, and any encountered failures. Do not log any sensitive data. The log is used to verify whether the deletion is executed, as well as abnormal backtracking and auditing.


key: chroma:document
string_value:
Build a data deletion anomaly alert system to detect any deviations or abnormalities in the entire process. When anomalies occur (such as inaccurate deletion requests, failed or delayed deletion tasks, or inconsistencies with deletion policies, inconsistency between SOT and data scanning scopes, failure to set the expiration time (TTL) for data deletion etc), trigger alerts and notify relevant personnel for prompt resolution.


key: chroma:document
string_value:
Build data backup and recover capability, back up raw data periodically or before implementation of data deletion strategy. Check integrity, availability and accuracy of the backup files, to ensure when the errors occur, deleted/lost data can be recovered.


key: chroma:document
string_value:
Set up RoPA  consistency verification process. When RoPA facts are entered through automated processes or manually bound to PA, use manual and technical methods to check the consistency between the entered facts and PA, specifying verification steps, standards and roles.


key: chroma:document
string_value:
Build a unified RoPA management tools for process automation/semi-automation management, RoPA operations (view, add, delete and modify), recording and display of process information (eg. the node, results, PA update status, technical facts, PA purpose and legal basis), authority control, data analysis etc.


key: chroma:document
string_value:
Regularly train and guide relevant personnel on data minimization strategies for collecting new data, ensuring they fully understand and adhere to the principles and rules of data minimization in daily work.


key: chroma:document
string_value:
Regularly train engineering team on monitoring strategies on data collection frequencies, scenerios, and data types to ensure effective implementation of monitoring.


key: chroma:document
string_value:
Conduct policy training for relevant objects with the purpose of improving the understanding and practical ability of purpose limitation.


key: chroma:document
string_value:
Establish data collection guidelines for new data collection,  specifying requirements on data granularity, data type, collection frequency, scenario, and data subject. Ensure there are clear collection purpose and adhere to the principle of data minimization during collection.


key: chroma:document
string_value:
Establish data acquisition guidelines, specifying requirements on the data sources, data sensitivity, and risk assessment standards to ensure that data acquisition complies with regulations and company policies.


key: chroma:document
string_value:
Establish data collection monitoring guidelines, specifying the monitoring rules including collection frequency, collection scenarios, data fields collected, user types and code redundancy etc..


key: chroma:document
string_value:
Establish purpose limitation guidelines to define the purpose taxonomy, purpose labeling principle, purpose compatible rules and potential risk levels of different data types and purpose, also specifying step by step rules for purpose labels, compatible check and routine operations.


key: chroma:document
string_value:
Establish pseudonymization and anonymization guidelines, including the definition, trusted tooling/technical capabilities, criteria for use etc.,  covering data usage, data storage and data display on internal platforms within sensitive user data. 


key: chroma:document
string_value:
Establish RoPA guidelines, outlining RoPA definition, RoPA information scope, template and format, as well as facts (e.g. region, platform, purpose and legal basis) that need to be included.


key: chroma:document
string_value:
Build pre-check process for new data collection, including data type, sensitivity level, data accuracy, collection frequency, business scenarios, collection time, collection purpose, user type, region to avoid data collection without a purpose or necessity.


key: chroma:document
string_value:
Establish a data acquisition process, outlining approval and operation process for data acquisition. 


key: chroma:document
string_value:
Set up management process for privacy event identified in data collection, including root cause analysis, follow-up action, remediation timeline, roles and responsibilities, documentation and record keeping etc. 


key: chroma:document
string_value:
Establish the process of labeling and recording the purpose of user data, to ensure the user data has clear and specific collection and usage purposes.


key: chroma:document
string_value:
Set up a process for remedation of gaps identified in purpose limitation, which should include steps covering root cause analysis, follow-up action, remediation timeline, roles and  responsibilities, as well as record keeping. 


key: chroma:document
string_value:
Set up a registration process for the new purpose scenarios and usage purpose change, and record up to date purpose as well as execute compatiable check to ensure the completeness and accuracy of the purpose.


key: chroma:document
string_value:
Set up purpose limitation audit process, conduct audit on purpsoe limitation procesures and remediation processes on a regular/irregular basis. Address issues identified in this process.


key: chroma:document
string_value:
Set up a RoPA management process, including detailed instructions for creating, iterating, and updating RoPA, as well as the tools to be used and the specific responsibilities of each team member involved.


key: chroma:document
string_value:
Set up a RoPA audit process, conduct the audit on completeness and accuracy of RoPA records. The process should specify audit frequency, standards and methods, etc., and handle abnormal situations.


key: chroma:document
string_value:
Set up RoPA disclosure process, to clarify and conduct RoPA disclosure steps (e.g. confirmation, legal evaluation, review and disclosure) when it meets the disclosure scenario. The process should clarify roles and responsibility, form of disclosure and continuous follow-up mechanism after disclosure.


key: chroma:document
string_value:
Establish technical capabilities to identify the service path (e.g. data post and get api) and scenario of data collection and usage for the user data that needs to be controlled. 


key: chroma:document
string_value:
Establish technical capabilities to check the compatibility among collection purposes and usage purposes; when they are not compatible, corresponding actions can be taken (e.g., obtaining additional user consent, prohibiting use/blocking).


key: chroma:document
string_value:
Build log management capability for purpose limitation, to log the execution of purpose limitation rules, compatibility verification, operation failures, etc..


key: chroma:document
string_value:
Build a purpose limitation anomaly alert system to detect any deviations or abnormalities in the entire process.  When anomalies occur (e.g. execution object, limitation scope, rules are issued incorrectly), trigger alerts and notify relevant personnel for prompt resolution.


key: chroma:document
string_value:
Build post-launch monitoring technology for new data collection, monitoring abnormalities indata type, sensitivity level, data accuracy, collection frequency, business scenarios, collection time, collection purpose, user type, collection region, redundant code. The monitoring result should be available for search, display and statistic.


key: chroma:document
string_value:
Build event insight capabilities to support automated risk and root cause analysis after the data collection, based on data fields, URL, domain name, business scenarios, purpose, components etc., and execute the disposal action (e.g. block collection and usage activities) . The disposal result can be search, display, and statistics.


key: chroma:document
string_value:
Build pseudonymization and anonymization technical capability, relevant technical means such as masking, obfuscation, synthesis, replacement, hiding, and clipping should be used for de-identification to protect personal information.


key: chroma:document
string_value:
Build pseudonymization and anonymization technical capability, when displaying personal information on the internal platform frontend and client based on functional purposes, relevant technical measures should be used for filtering, such as interface clipping, to filter out personal information that is unnecessary and does not need to be displayed.


key: chroma:document
string_value:
Build pseudonymization and anonymization technical capability, for high-sensitivity personal information that needs to be displayed, relevant technical measures should be used for de-identification processing, including masking, truncation, and replacement.


key: chroma:document
string_value:
Build database storage isolation capability, for the storage of user personal information for different products of the company, relevant technical measures, such as row/column isolation and table splitting, should be used to achieve physical or logical isolation, ensuring that data for different product lines is stored in different databases or tables (or can achieve isolation of access and processing).


key: chroma:document
string_value:
Build database storage isolation capability, for the storage of user personal information with different sensitivity levels for different product lines of the company, relevant technical means, such as row/column isolation, table splitting, and bucket splitting, should be used to achieve physical or logical isolation, ensuring that data for different product lines is stored in different databases or tables (or can achieve isolation of access and processing).


key: chroma:document
string_value:
Build environment isolation capability, separation of testing, production, and development environments, where operations in the test and development environments should not affect the production environment, data should also be isolated in each environment.


key: chroma:document
string_value:
Build technology to verify the completeness of RoPA technical facts. Based on the scope of technical facts and the channels and methods for obtaining source data, use technical means to verify that the technical facts required for RoPA have been fully obtained and the technical facts are consistent with the source data.


key: chroma:document
string_value:
Conduct regular training for capabilities users, including data inventory, data classification, data lineage, etc, introduce integration and using methods, to ensure better understanding and locate data to manage.


key: chroma:document
string_value:
Conduct regular training of data classification, including the rules of data classification and sensitivity levels, to ensure stakeholders can assess and apply appropriate control measures when processing data.


key: chroma:document
string_value:
Establish data quality guidelines for data collected/acquired through various channels (including collection from client end, purchased data, and data acquired from third party), specifying requirements on data accuracy, data integrity and consistency etc..


key: chroma:document
string_value:
Establish data classification guidelines, classifying data type definitation and identification rules based on business meaning, form, entity, etc., to ensure the selection of data which needs to be controlled based on corresbounding requirements.


key: chroma:document
string_value:
Establish asset definitation guidlines, classifying assets definitation and identification rules based on assets' attributes, such as storage/service type, business ownership, deployment area, data processing activity, online status, and active status, to ensure the selection of assets which need to be controlled by corresbounding requirements.


key: chroma:document
string_value:
Establish data subject definitation guidlines, classifying data subject definitation and identification rules based on its business meaning and attributes, such as user region, age groups,etc to ensure adapt to corresponding control requirements


key: chroma:document
string_value:
Set up a process to audit the quality of user personal information or data that may impact users, even if it is not personal information. This includes assessing accuracy and integrity of the data. Abnormalies such as outdated or missing data should be addressed accordingly.


key: chroma:document
string_value:
Set up a data lineage quality verification process, including process of checking and validation of data lineage results (e.g. recall rate) and addressing quality issues identified. 


key: chroma:document
string_value:
Set up a data classification quality verification process, clarifying the check and validation of data labelling result(e.g. recall, precision rate) and addressing quality issues.   


key: chroma:document
string_value:
Set up a label management process for data taxonomy labels (e.g. data type, data subject, data format), outlining label creation, update and removal process including change initiation, approval, operation, record keeping, change launch etc..


key: chroma:document
string_value:
Set up a process to intake new legal requirements to data taxonomy, evaluate and optimize the label structures and system to support compliance requirements implementation if needed. Define and build identification capabilities according to the label addition process to support compliance requirements implementation.


key: chroma:document
string_value:
Set up a quality control process for data assets, including verify asset identification results, such as asset identification coverage, accuracy of asset analysis and key attribute labeling, etc., and clearly define the repair mechanism after discovering quality problems to ensure that assets are fully identified and accurately labeled with attributes.


key: chroma:document
string_value:
Set up a label useage feedback handling process, specify comprehensive process to review, assess, handle the feedbacks. Feedbacks should be addressed incorporated to data classification iterations. 


key: chroma:document
string_value:
When a storage database involves user data, building data integrity and accuracy veridication capability , e.g. define global unique key identifier, verify foreign key identifiers. 


key: chroma:document
string_value:
When service/interface interaction involves user data, build verification capabilities for data integrity and accuracy, e.g. defining the identification parameters of interface interaction and performing authentication between interfaces, maintaining accurate open_id and actual identification mapping in 3rd-party data sharing.


key: chroma:document
string_value:
When the product features aims to protect privacy, build verification capabilities to ensure that the user's personal information designed is uniformly defined, managed, distributed, and consistency among upstream and downstream system. The product features includes but is not limited to:1. privacy setting status define and synchronization2. password format verification3. traffic routes based on store region


key: chroma:document
string_value:
For user personal data, especially sensitive data (e.g. email, age), build capabilities (e.g. interface integration) to unify the collection source of data, and centralize data processing and storage following standard rules.


key: chroma:document
string_value:
Build capabilities for data change synchronization capability to ensure that (e.g. table join, data deletion) it can be synchronized or distributed to upstream and downstream systems in a timely and accurate manner, and to ensure that the correct execution (such as task signature verification, task valid period verification).


key: chroma:document
string_value:
Monitoring and record operation history, modification records, and other data access, usage, and sharing behaviors throughout the entire data lifecycle. This enables timely detection and tracking of data in the system so as to enhance data interity. 


key: chroma:document
string_value:
Implement real-time or periodic data quality validation (e.g. checking for duplicate values or missing data in databases and tables) throughout the entire data lifecycle to identify and rectify data issues. This can reduce data corruption and vulnerabilities.


key: chroma:document
string_value:
Build a data dictionary that maps out data types, definitions, raw data field samples etc.. The dictionary should be easy to use for control and protection purposes.


key: chroma:document
string_value:
Build data type identification capability, to support automatic identification and labelling of data types and sensitivity levels within raw data, and support timely updates of identification results after asset changes, to ensure support control measures based on data types and levels.


key: chroma:document
string_value:
Build assets identification capability, to support the identification and labeling of various types of assets, such as whether they belong to TikTok, and support updating identification results when identification rules change.


key: chroma:document
string_value:
Build data subject identification capability, to support the identification and labelling of different data subjects (e.g. normal user, business user). 


key: chroma:document
string_value:
Build data format identification capability, to support the identification and labelling of different data format (e.g. ciphertext, masked data, hash value).


key: chroma:document
string_value:
Build data lineage capability, to identify the data flow in engineering systems and storage resources throughout the entire data lifecycle. 


key: chroma:document
string_value:
Build user region identification capability, to identify the data subject's store region and priority region.(e.g. US, UK)


key: chroma:document
string_value:
Create awareness program for model fairness. Provide fairness training to business and engineering teams using algorithm models. This training should cover fairness definitions, best practices, and emphasize that business decisions should not be influenced by human biases.


key: chroma:document
string_value:
When there are changes (including initial launch of model review) in model review process, such as the addition of reviewers or changes in review guidelines, training or notifications should be conducted for all affected employees.


key: chroma:document
string_value:
Establish a model and AI system management awareness program. Provide policy and process requirements on model and AI system risk tier, compliance review, usage, disclosure, complaints handling, and decommissioning. Ensure that all roles (including the model user and model provider) have a clear understanding of their compliance responsibilities.


key: chroma:document
string_value:
Establish fairness guidelines for AI models, specifying fairness definition and protection measures for prevention, validation, and monitoring of model fairness issues.


key: chroma:document
string_value:
Establish AI model inference guidelines for user label inference, specifying labels (i.e. race) that model should not inferred  and labels (i.e. ange) that can be inferred with only limited use purposes.


key: chroma:document
string_value:
Establish policy setting out requirements for recording and management of collection, cleaning, storage, labelling and deletion of personal data in training data, specifying recording various data collection sources, storage time and location, usage purpose and scope, criteria for including and excluding certain categories of data/data sources, as well as relevant parties and responsibilities, to ensure that the transparency principle is met during the process.


key: chroma:document
string_value:
Establish training data retention policy for various data deletion scenarios such as DSAR deletion and rolling deletion, specifying deletion rules, execution steps, and deletion method for training data, memory of model and etc.


key: chroma:document
string_value:
Establish training data quality management policy, and provide execution strategy, specifying standards and requirements on accuracy, relevance, diversity, and timeliness and etc.


key: chroma:document
string_value:
Establish training data labelling policy, specifying data types, labeling requirements, and privacy principles to be followed for training data.


key: chroma:document
string_value:
Establish policy setting out the roles and responsibilities between model users, model providers, data providers, and employees who interact with corporate models. Ensure clear data ownership and that the use of consumer data for training strictly aligns with the data controller's predefined purposes, to ensure compliance with privacy regulations.


key: chroma:document
string_value:
Establish policy regarding transparency efforts for AI system. Specify clear communication to users about which models their data is used for, including the usage scenarios and purposes, to ensure informed consent and data protection compliance.


key: chroma:document
string_value:
Establish policy regarding the use of young user data and use of model by young user, to ensure that young users are protected when using models.


key: chroma:document
string_value:
Establish Input and Output Control Management Policy for handling personal PII data in conversational scenarios. Specify the definitions and standards for PII data, and ensure identification, detection, filtering, or prohibition of certain data during the input and output processes, to ensure data privacy compliance.


key: chroma:document
string_value:
Establish a risk management policy for AI system aligned to applicable laws, regulations, and principles such as the European Union's AI Act, US export control and etc.


key: chroma:document
string_value:
Establish requirements for technical documentation for AI models, specifying information such as format, content, retention period, update frequency, model version information, technical architecture, and hyperparameters.


key: chroma:document
string_value:
Set up a review process for model deployment, covering the entire lifecycle of model development (such as training data creation, feature design, algorithm development, and model testing, model launch). The process should specify review steps, roles and responsibilities, and procedures for handling special cases.


key: chroma:document
string_value:
Build a review platform for the model deployment (such as training data creation, feature design, algorithm development, and model testing). This platform should enable model launch management, review workflow, review results notification, remediation workflow etc.. 


key: chroma:document
string_value:
Set up an audit process for model review. Historical approval records should be audited to ensure effectiveness of the review process and gaps should be addressed.


key: chroma:document
string_value:
Establish process for recording and management of collection, cleaning, storage, labelling and deletion of personal data in training data, including specifying roles, recording time, responsibilities for various functions, and record content (such as data sources, user consent, relevance, de-identification methods, etc.), to ensure these processes comply with the principle of transparency.


key: chroma:document
string_value:
Establish process for approval and recording of access to and use of training data (such as directly accessing data storage or internal applications), specifying/clarifying the responsibilities and requirements that each role needs to bear in the access control measures (such as permission application, network isolation, etc.), to ensure the principle of data minimization.


key: chroma:document
string_value:
Set up training data retention process, specifying/clarifying process nodes, responsible persons, and execution processes such as data deletion task configuration, triggering, execution, verification, attribution, etc., to ensure that the steps of the data deletion process are executable.


key: chroma:document
string_value:
Set up training data privacy assessment process for the process of data collection, cleaning, labeling, storage, deletion, etc., specifying/clarifying the responsibilities and evaluation points (such as accuracy, credibility, etc.) that each role needs to undertake, to ensure principles of purpose limitation, confidentiality.


key: chroma:document
string_value:
Set up training data quality assessment process for the process of data collection, cleaning, labeling, storage, deletion, etc., specifying/clarifying the responsibilities and evaluation points (such as accuracy, credibility, etc.) that each role needs to undertake, to ensure principles of accuracy, completeness, and availability.


key: chroma:document
string_value:
Set up training data labelling review process, specifying/clarifying the responsibilities and evaluation points that each role needs to undertake during the review process, to ensure principles of accuracy, fairness, and data security.


key: chroma:document
string_value:
Establish process for disclosure of information related to user data, clarifying the disclosure of service limitations, model and algorithm information, and details of personal data usage, to ensure users are informed of their rights.


key: chroma:document
string_value:
Set up model use feedback/complaint mechanism for handling user interactions, specifying comprehensive and actionable channels with clear procedures, to optimize user experience and safeguard their rights.


key: chroma:document
string_value:
Set up model review process and assessment criteria for reviewing models before their official use by model users, specifying factual reviews of the model's data collection, usage, and processing practices. Establish distinct assessment criteria for internally developed and third-party provided models, and initiate an assessment process following significant model updates or upgrades. To ensure that all business parties have evaluation records when using various models.


key: chroma:document
string_value:
Set up process for decommissioning of models, including retention of compliance-related records and deletion of user data when models are no longer in use, specifying the timely cessation of data interactions with the model and prompt follow-up on the cleanup of historical data. This ensures that user data handling complies with data retention and deletion policy requirements.


key: chroma:document
string_value:
Set up Security Audit Process for model use scenarios, specifying regular security audits of the development frameworks and code being used. This process includes identifying security issues and vulnerabilities within open-source frameworks, and timely fixing of potential security weaknesses to enhance the safety of both the model itself and its usage.


key: chroma:document
string_value:
Set up Security Backup Mechanism for model use scenarios, specifying the establishment of backup and recovery strategies for AI system data, models, frameworks, and tools to ensure effective protection of user data.


key: chroma:document
string_value:
Set up a risk management process for the entire AI system lifecycle specifying: risk level types and definitions, the purpose of the AI system and its potential impact on fundamental rights, risk assessment processes and remediation processes, documentation requirements, as well as roles and responsibilities.


key: chroma:document
string_value:
Set up an AI system privacy review process along with the SDLC, specifying privacy by design requirements e.g., fairness, transparency, data minimization, purpose limitations, consent, interpretability and predictability and etc.


key: chroma:document
string_value:
Establish review guidelines and standards for human review of AI models for assessing AI model performance, specifying: privacy requirements and SOP, competence and training to determine if model output meets expectations.


key: chroma:document
string_value:
Set up red-teaming assessments after a material product iteration launches and on a defined cadence thereafter. The assessments should include a risk assessment matrix and measurement index that helps to detect vulnerabilities related to privacy issues.


key: chroma:document
string_value:
Set up a process for external auditors to conduct compliance assessments for AI system as may be required by applicable AI laws and regulations, specifying audit scope, trigger conditions, deliverables, and stakeholders.


key: chroma:document
string_value:
In scenarios involving model reuse and fine-tuning, build capability to perform fairness testing before fine-tuning the model. Whenever possible, select models with higher fairness levels or make fairness-based adjustments during the subsequent fine-tuning process.


key: chroma:document
string_value:
For user data involved in the model lifecycle (e.g. label, model input, model features, and model output), build technology (e.g. field name understanding, value parsing) to ensure data that prohibits collection, prohibits inference, or restriction of inference can be identified and disposed.


key: chroma:document
string_value:
Build technology to ensure representative and comprehensive distribution of samples in the training dataset preperation to reduce algorithmic bias towards specific sample features.


key: chroma:document
string_value:
During the model feature design and development, build techonology to measure whether the model performance is skewed by certain features, and adjust feature design in a timely manner.


key: chroma:document
string_value:
Before or after the model launch, build technology to conduct fairness testing on the model, evaluating its performance across different demographic groups.


key: chroma:document
string_value:
Build monitor on performance of deployed models (e.g. recall rate in different groups). Alert the engineering team when the model fairness issue is identified. Take measures to address fairness issues at a timely manner including offlining models when necessary (e.g. the accuracy of the male group is much higher than that of the female group).


key: chroma:document
string_value:
Before or after the model launch, build technology to identify whether the model meets criteria (such as highly sensitive scenarios and highly sensitive data) that requires fairness testing, analysis, and monitoring.


key: chroma:document
string_value:
Build and implement technical capability for recording and managing the collection, cleaning, storage, labelling and deletion of personal data in the training data, to log an audit trail and monitor the processing of personal data, to ensure the transparency of the process.


key: chroma:document
string_value:
Build personal data identification capability, especially for highly sensitive personal data and data subject(such as mobile number, email address, young user), for identifying it through fields, value parsing, data lineage, to ensure data accuracy of personal information.


key: chroma:document
string_value:
Build training data quality assessment capability for assessing the results of data collection and cleaning, such as correlation analysis and cross-verification, to identify and resolve errors such as weak data relevance and missing data, to ensure that training data is complete and available to support training objectives.


key: chroma:document
string_value:
Build training data monitoring, audit and anomaly detection capability for monitoring and auditing anomalies(such as data distribution and data label changes) through training data collection, cleaning, labeling, storage, and deletion to avoid risks such as non-execution and misoperation, to ensure that data anomalies throughout the lifecycle can be monitored and the process can be traced.


key: chroma:document
string_value:
Build training data attack detection and prevention capability(such as logs, etc.) for attacks on training data (such as member inference attacks and data poisoning attacks) to protect training data through randomization, sorting, data verification and other technical means, to ensure accuracy, integrity and availability.


key: chroma:document
string_value:
Build young user data identification capability for model use scenarios to ensure that models are appropriate for young user, restrict young users' input data, and limit the use of young users' data in training scenarios, to ensure compliance with young user data protection regulations.


key: chroma:document
string_value:
Build user data identification capability for tracking use of users' data across various models and services to ensure users are promptly and effectively informed about which models, and services their data is being used for and who the end users of these services are, to ensure transparency and data privacy compliance.


key: chroma:document
string_value:
Build technical capabilities that informs users of, and gives users control over, how their user data is being used to train models.


key: chroma:document
string_value:
Build tooling to identify scenarios where content is generated by AI models and label such content as AI generated content for distinguishing between AI-enhanced and non-AI editing or generation features to clearly differentiate those functionalities and avoid confusion or misinterpretation among users, to ensure clarity and transparency in user interactions.


key: chroma:document
string_value:
Monitor and record input and output data of model with technical measure after it is deployed. In case the model's performance deviates from expectations, it is essential to promptly adjust or even take the model offline.


key: chroma:document
string_value:
Build environment isolation capability for the scenario of model deployment to control resources to separate training environments from inference environments. This prevents interactions between training and inference data, mitigating the risks of data leakage and unauthorized access.


key: chroma:document
string_value:
Build Continuous Input Monitoring and Blocking Capability for the scenario of model deployment to safeguard against malicious input attacks and prevent risks such as DDoS, XSS, and injection attacks. This ensures the security and integrity of deployed models.


key: chroma:document
string_value:
Build API access control capability for the scenario of interactions with models to implement mechanisms that detect and block robotic operations. This ensures restricted access to AI models by limiting the number of queries or outputs per user within a specified time frame to prevent account misuse.


key: chroma:document
string_value:
Build Personal Information Filtering and Management Capability for the scenario of handling inputs and outputs containing personally identifiable information. This ensures the timely identification of content featuring personal data through the creation of a manual labeling platform combined with algorithmic capabilities. This mechanism is designed to detect, filter, or process personal sensitive information as defined in the [Input & Output Controls Policy], and to prohibit or restrict the input and output of such data.


key: chroma:document
string_value:
Build tooling that allows users to be notified of the risks associated with providing personal data (including sensitive personal data) or requesting information that they are not authorized to receive. This ensures that specific notifications are embedded to promptly inform users of the associated risks.


key: chroma:document
string_value:
Build AI system incident response logging capability for scenarios involving model inference calls and input/output access. This ensures that all details such as user IDs, timestamps, types of operations are recorded and stored, and preserved according to the data retention policy.


key: chroma:document
string_value:
Set up an AI system privacy review platform to support the operation of privacy evaluation related processes. According to the requirements of the review matrix, support the collection of model technical facts and record the review results.


key: chroma:document
string_value:
Based on the model risk level and corresponding compliance requirements, establish a red team detection capability that supports model output to discover model privacy vulnerabilities, fairness and other related issues.


