# migrations

dir: embeddings_queue
filename: 00001-embeddings.sqlite.sql
hash: d3755dfd232be8e8301f4d7fcfb3a486
sql:
CREATE TABLE embeddings_queue (
    seq_id INTEGER PRIMARY KEY,
    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    operation INTEGER NOT NULL,
    topic TEXT NOT NULL,
    id TEXT NOT NULL,
    vector BLOB,
    encoding TEXT,
    metadata TEXT
);


dir: sysdb
filename: 00001-collections.sqlite.sql
hash: 38352d725ad1c16074fac420b22b4633
sql:
CREATE TABLE collections (
    id TEXT PRIMARY KEY,
    name TEXT NOT NULL,
    topic TEXT NOT NULL,
    UNIQUE (name)
);

CREATE TABLE collection_metadata (
    collection_id TEXT REFERENCES collections(id) ON DELETE CASCADE,
    key TEXT NOT NULL,
    str_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (collection_id, key)
);


dir: sysdb
filename: 00002-segments.sqlite.sql
hash: 2913cb6a503055a95f625448037e8912
sql:
CREATE TABLE segments (
    id TEXT PRIMARY KEY,
    type TEXT NOT NULL,
    scope TEXT NOT NULL,
    topic TEXT,
    collection TEXT REFERENCES collection(id)
);

CREATE TABLE segment_metadata (
    segment_id TEXT  REFERENCES segments(id) ON DELETE CASCADE,
    key TEXT NOT NULL,
    str_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (segment_id, key)
);


dir: sysdb
filename: 00004-tenants-databases.sqlite.sql
hash: 048867ce8fcdefe4023c7110e4433591
sql:
CREATE TABLE IF NOT EXISTS tenants (
    id TEXT PRIMARY KEY,
    UNIQUE (id)
);

CREATE TABLE IF NOT EXISTS databases (
    id TEXT PRIMARY KEY, -- unique globally
    name TEXT NOT NULL, -- unique per tenant
    tenant_id TEXT NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
    UNIQUE (tenant_id, name) -- Ensure that a tenant has only one database with a given name
);

CREATE TABLE IF NOT EXISTS collections_tmp (
    id TEXT PRIMARY KEY, -- unique globally
    name TEXT NOT NULL, -- unique per database
    topic TEXT NOT NULL,
    dimension INTEGER,
    database_id TEXT NOT NULL REFERENCES databases(id) ON DELETE CASCADE,
    UNIQUE (name, database_id)
);

-- Create default tenant and database
INSERT OR REPLACE INTO tenants (id) VALUES ('default_tenant'); -- The default tenant id is 'default_tenant' others are UUIDs
INSERT OR REPLACE INTO databases (id, name, tenant_id) VALUES ('00000000-0000-0000-0000-000000000000', 'default_database', 'default_tenant');

INSERT OR REPLACE INTO collections_tmp (id, name, topic, dimension, database_id)
    SELECT id, name, topic, dimension, '00000000-0000-0000-0000-000000000000' FROM collections;
DROP TABLE collections;
ALTER TABLE collections_tmp RENAME TO collections;


dir: sysdb
filename: 00005-remove-topic.sqlite.sql
hash: b1367c826b8fba5f96f27befdc1d42d2
sql:
-- Remove the topic column from the Collections and Segments tables

ALTER TABLE collections DROP COLUMN topic;
ALTER TABLE segments DROP COLUMN topic;


dir: sysdb
filename: 00006-collection-segment-metadata.sqlite.sql
hash: 4eea7468935bf25d4604a0fed2366116
sql:
-- SQLite does not support adding check with alter table, as a result, adding a check
-- involve creating a new table and copying the data over. It is over kill with adding
-- a boolean type column. The application write to the table needs to ensure the data
-- integrity.
ALTER TABLE collection_metadata ADD COLUMN bool_value INTEGER;
ALTER TABLE segment_metadata ADD COLUMN bool_value INTEGER;


dir: sysdb
filename: 00007-collection-config.sqlite.sql
hash: 1c7e63bba346a42a18b6ab7f1c989bed
sql:
-- Stores collection configuration dictionaries.
ALTER TABLE collections ADD COLUMN config_json_str TEXT;


dir: sysdb
filename: 00008-maintenance-log.sqlite.sql
hash: 0a0e7e93111a01789addf64961c6127c
sql:
-- Records when database maintenance operations are performed.
-- At time of creation, this table is only used to record vacuum operations.
CREATE TABLE maintenance_log (
  id INT PRIMARY KEY,
  timestamp INT NOT NULL,
  operation TEXT NOT NULL
);


dir: sysdb
filename: 00009-segment-collection-not-null.sqlite.sql
hash: 054355aef9e63702bf54ea29e61563f1
sql:
-- This makes segments.collection non-nullable.
CREATE TABLE segments_temp (
    id TEXT PRIMARY KEY,
    type TEXT NOT NULL,
    scope TEXT NOT NULL,
    collection TEXT REFERENCES collection(id) NOT NULL
);

INSERT INTO segments_temp SELECT * FROM segments;
DROP TABLE segments;
ALTER TABLE segments_temp RENAME TO segments;


dir: metadb
filename: 00001-embedding-metadata.sqlite.sql
hash: 2b4cf52c4bb2676e21d6860a4409f856
sql:
CREATE TABLE embeddings (
    id INTEGER PRIMARY KEY,
    segment_id TEXT NOT NULL,
    embedding_id TEXT NOT NULL,
    seq_id BLOB NOT NULL,
    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    UNIQUE (segment_id, embedding_id)
);

CREATE TABLE embedding_metadata (
    id INTEGER REFERENCES embeddings(id),
    key TEXT NOT NULL,
    string_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (id, key)
);

CREATE TABLE max_seq_id (
    segment_id TEXT PRIMARY KEY,
    seq_id BLOB NOT NULL
);

CREATE VIRTUAL TABLE embedding_fulltext USING fts5(id, string_value);


dir: metadb
filename: 00002-embedding-metadata.sqlite.sql
hash: 12a570f7121b3a8ce750a2a7c36da20f
sql:
-- SQLite does not support adding check with alter table, as a result, adding a check
-- involve creating a new table and copying the data over. It is over kill with adding
-- a boolean type column. The application write to the table needs to ensure the data
-- integrity.
ALTER TABLE embedding_metadata ADD COLUMN bool_value INTEGER


dir: metadb
filename: 00003-full-text-tokenize.sqlite.sql
hash: f97ad6334aeaa8f419f01110b648b97a
sql:
CREATE VIRTUAL TABLE embedding_fulltext_search USING fts5(string_value, tokenize='trigram');
INSERT INTO embedding_fulltext_search (rowid, string_value) SELECT rowid, string_value FROM embedding_metadata;
DROP TABLE embedding_fulltext;


dir: metadb
filename: 00004-metadata-indices.sqlite.sql
hash: fb36603a45ee2cd0254cef3ef86585e8
sql:
CREATE INDEX IF NOT EXISTS embedding_metadata_int_value ON embedding_metadata (key, int_value) WHERE int_value IS NOT NULL;
CREATE INDEX IF NOT EXISTS embedding_metadata_float_value ON embedding_metadata (key, float_value) WHERE float_value IS NOT NULL;
CREATE INDEX IF NOT EXISTS embedding_metadata_string_value ON embedding_metadata (key, string_value) WHERE string_value IS NOT NULL;


# embeddings_queue

created_at: 2025-02-27 07:39:49
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 8a755bb0-4dcd-42a6-9de0-aa0aa9fb4f6a
encoding: FLOAT32
metadata:
{"index": 0, "version": 1, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-010', 'safeguard-policy-001', 'safeguard-technology-004', 'safeguard-process-010']", "chroma:document": "Data Minimization Consent for incompatible purposes: Require consent for additional use of personal information not reasonably necessary to or incompatible with original purpose disclosure."}


created_at: 2025-02-27 07:39:51
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: e2862fda-b68c-4233-906d-77e006887cba
encoding: FLOAT32
metadata:
{"index": 1, "version": 1, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-process-003', 'safeguard-process-001', 'safeguard-technology-011', 'safeguard-process-010']", "chroma:document": "Notice for incompatible purposes: Require notice for additional collection or use of personal information incompatible with original disclosure."}


created_at: 2025-02-27 07:39:53
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 4773e831-f8bb-43f4-97a4-036adee1e0c2
encoding: FLOAT32
metadata:
{"index": 2, "version": 1, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-process-005', 'safeguard-process-008', 'safeguard-technology-009', 'safeguard-policy-004']", "chroma:document": "Purpose limitation : Require business to limit collection & use to what is adequate, relevant, and reasonably necessary for the disclosed processing purposes"}


created_at: 2025-02-27 07:39:55
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 0f55828f-2393-4964-acdd-f37dec241561
encoding: FLOAT32
metadata:
{"index": 3, "version": 1, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-technology-009', 'safeguard-policy-007', 'safeguard-policy-004', 'safeguard-process-005']", "chroma:document": "Purpose limitation : Require business to limit collection to what is \"reasonably necessary and proportionate\" to provide or maintain a specific product or service requested by the consumer to whom the data pertains"}


created_at: 2025-02-27 07:39:57
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 34510ed1-1da9-488e-9e94-ac222a6450bc
encoding: FLOAT32
metadata:
{"index": 4, "version": 1, "PO": "['young users', 'data minimization & purpose limitation', 'data accuracy']", "safeguard": "['safeguard-policy-007', 'safeguard-policy-024', 'safeguard-technology-012', 'safeguard will finalized in q4', 'safeguard-technology-069', 'safeguard-technology-013', 'safeguard-policy-004']", "chroma:document": "Sensitive Data Analysis Required: Requirement that businesses use certain types of sensitive personal information only for limited purposes; which includes the following categories: Data revealing racial or ethnic origin, data revealing religious beliefs, data revealing sex life or sexual orientation or similar terms, data revealing revealing citizenship or immigration status or similar terms, genetic data, biometric data, data revealing a mental or physical health condition or diagnosis or similar terms, precise geolocation data, data revealing status as transgender or nonbinary, data revealing national origin, consumer health data, status as the victim of a crime, children's data (child defined as younger than 13), children's data (child defined as younger than 18), financial information including account information plus log-in information, data revealing social security, drivers license, state identification card, or passport number, data revealing philosophical beliefs, data revealing union membership, contents of mail, email, and text messages not sent to the controller."}


created_at: 2025-02-27 07:39:59
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 359ffdde-90ae-400a-92c4-698372889dff
encoding: FLOAT32
metadata:
{"index": 5, "version": 1, "PO": "['data accuracy']", "safeguard": "['safeguard-policy-024']", "chroma:document": "Exceptions to use of SPI: Personal data revealing an individuals racial or ethnic origin if processed by a video communication service; Processing data for short-term, transient use; Processing data to prevent bad actors from committing illegal actions directed at the business (and prosecute those who do), Processing data to ensuring physical safety, Personal data processed by a person licensed to provided health care under state laws, The content of communications or data generated by utility systems or equiptment, When processed to avoid discrimination under state or federal law: racial or ethnic origin, religious eliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, Processing data to provide goods/services reasonably expected by an average consumer who requests those goods or services, Processing data to prevent, detect, and investigate security incidents, Processing data to ensuring physical safety, Processing data to maintain or improve the business's products, services, or devices, Sensitive personal information collected or processed without the purpose of inferring characterisitics about a consumer, Sensitive information that is publicly available, Processing data for short-term, transient use, Processing data to perform services on behalf of the business"}


created_at: 2025-02-27 07:40:01
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: ad20866a-0b2a-406c-b864-fae0a6077fdf
encoding: FLOAT32
metadata:
{"index": 6, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Usage Restrictions for Sensitive Data Processing: Ban sale of sensitive data "}


created_at: 2025-02-27 07:40:02
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: c3443dda-58ad-4544-af0b-4fe7f36d6dcc
encoding: FLOAT32
metadata:
{"index": 7, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-technology-004']", "chroma:document": "Require business to provide an Opt-In: Requires controllers to obtain consumer consent before processing sensitive data or, with regards to known children, process such data in accordance with the federal Children\u2019s Online Privacy Protection Act (COPPA).  "}


created_at: 2025-02-27 07:40:04
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: f008f72f-c0e5-4e3d-a68d-64309045fce3
encoding: FLOAT32
metadata:
{"index": 8, "version": 1, "PO": "['data minimization & purpose limitation', 'transparency', 'individual rights']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-002', 'safeguard-technology-125', 'safeguard-technology-138', 'safeguard-technology-004']", "chroma:document": "Require business to provide an Opt-Out: Requires controllers to provide consumers with the right to limit the use and disclosure of their sensitive personal information \u201cto that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.\u201d Where required, organizations must provide a \u201cLimit the Use of My Sensitive Personal Information\u201d link on their homepage that consumers can use to exercise this right to opt out of sensitive data processing."}


created_at: 2025-02-27 07:40:06
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: dd02f86b-0862-408a-8866-2eb7767a2ef0
encoding: FLOAT32
metadata:
{"index": 9, "version": 1, "PO": "['data minimization & purpose limitation', 'data accuracy']", "safeguard": "['safeguard-policy-007', 'safeguard-policy-024']", "chroma:document": "Require business to provide an Opt-Out: Restrict collection, processing, sharing of sensitive data except where the collection or processing is strictly necessary to provide or maintain a specific product or service requested by the consumer"}


created_at: 2025-02-27 07:40:08
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 8a2a3ee3-3b77-477a-81af-bca93133935f
encoding: FLOAT32
metadata:
{"index": 10, "version": 1, "PO": "['individual rights', 'data retention']", "safeguard": "['safeguard-policy-008', 'safeguard-technology-080', 'safeguard-technology-073']", "chroma:document": "Broad deletion rights : Includes: Personal data \"about\" the consumer and Personal data the controller obtained from another source and derived data."}


created_at: 2025-02-27 07:40:10
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: b506ffca-340a-49e7-9974-851e94776ea9
encoding: FLOAT32
metadata:
{"index": 11, "version": 1, "PO": "['data retention']", "safeguard": "['safeguard-process-016', 'safeguard-policy-008', 'safeguard-policy-010']", "chroma:document": "Retention of sensitive data : Require business to delete or anonymize sensitive data that it no longer has consent to process within a reasonable period of the withdrawal of consentRequire annual review of biometric identifiers and similar data to determine if storage is still necessary"}


created_at: 2025-02-27 07:40:11
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 74693761-a7ee-45c1-80f3-1a0048450b96
encoding: FLOAT32
metadata:
{"index": 12, "version": 1, "PO": "['data retention']", "safeguard": "['safeguard-policy-008', 'safeguard-policy-009']", "chroma:document": "Prescriptive retention timeline requirements: Require business to retain data for only as long as needed to satisfy the purpose for which it was collected, the expiration/termination of the contract for collecting the data, or two years after the consumer's last interaction with business (exceptions apply)"}


created_at: 2025-02-27 07:40:13
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: c5c14b42-be66-43d6-9e25-e3d55261bdbb
encoding: FLOAT32
metadata:
{"index": 13, "version": 1, "PO": "['data minimization & purpose limitation', 'data retention']", "safeguard": "['safeguard-policy-007', 'safeguard-policy-008']", "chroma:document": "Principles based retention timeline requirements: Require business to retain personal information for what is \"reasonably necessary and proportionate\" to the disclosed processing purposes for which it was collected"}


created_at: 2025-02-27 07:40:15
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: acb1918a-1cd2-4515-b1bf-48d2e4edf12e
encoding: FLOAT32
metadata:
{"index": 14, "version": 1, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-020', 'safeguard-technology-054']", "chroma:document": "General security Safeguards: Require business to implement reasonable security practices"}


created_at: 2025-02-27 07:40:17
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 82a0475f-4681-4e61-984e-b23534b7e04b
encoding: FLOAT32
metadata:
{"index": 15, "version": 1, "PO": "['data sharing']", "safeguard": "['safeguard-process-059', 'safeguard-technology-026', 'safeguard-process-025', 'safeguard-technology-031', 'safeguard-technology-089', 'safeguard-policy-029', 'safeguard-technology-032', 'safeguard-process-060', 'safeguard-process-021', 'safeguard-technology-088']", "chroma:document": "Contracts - Controller Contractual Updates Required: Identify specific business purpose for processing, and specify that is the only purpose, Set out processing instructions, including, nature and purpose of processing, type of data subject to processing, and duration of processing, Prohibit processor from selling or sharing personal information collected pursuant to the contract, Prohibit the processor from retaining, using, or disclosing the personal information for any purpose other than the business purpose identified in the contract or outside of the direct relationship with the controller, unless otherwise permitted by law, Require processor to return or delete personal information at the end of the services (as requested by controller), Require processor to implement reasonable technical and organizational security measures, Prohibit the processor from combining personal information it recieves from the controller with personal information from other sources, Require processor to comply with applicable privacy law, Require processor to enable controller in complying with data rights requests, including those recieved by business or by processor, Require processor to notify controller if processor can no longer meet obligations under applicable privacy law, Require processor to ensure all personnel processing personal information is subject to duty of confidentiality, Require processor to engage subprocessors pursuant to contract that binds subprocessor to processor's obligations, Requires processor to give business opportunity to object to subprocessors, Grant controller the right to take reasonable and appropriate steps to ensure that the processor uses the personal information consistent with controllers' obligations under applicable privacy laws, or right to receive information necessary to confirm compliance upon reasonable request, Permit controller to monitor processor's contract compliance through reasonable measures, including through reasonable assessment by controller or independent auditor, Grant controller the right to take reasonable and appropriate steps to stop and remediate processor's unauthorized use of personal information,Certify that contractor understands restrictions and will comply , Require processor to stop processing data on request by controller made in accordance with a consumer's authenticated request, Requires a binding contract between controllers and third parties where there is a \"sell\" or \"share\" (and arguments required even where no sale, share), Set out \"limited and specified purpose\" the personal information is made available to the third party, Require compliance with CCPA and Regs and notification to business if cannot comply, Grant business right to take reasonable and appropriate steps to (a) ensure using data in accordance with CCPA and Regs and (b) remediate unauthorized use, Contractual requirements for de-identification (e.g., prohibit recipient from associating data with an individuals; publicly commit to mantain and use in deidentified form, and not attempt to reidentify), Monitor and address breaches of contractual commitments with respect to de-identified data."}


created_at: 2025-02-27 07:40:19
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 9efd52e5-6cb9-485a-ac3f-64fafd518269
encoding: FLOAT32
metadata:
{"index": 16, "version": 1, "PO": "['data sharing']", "safeguard": "['safeguard-technology-029', 'safeguard-process-059', 'safeguard-technology-030', 'safeguard-technology-027', 'safeguard-technology-031', 'safeguard-process-020', 'safeguard-policy-030', 'safeguard-policy-029', 'safeguard-technology-034', 'safeguard-technology-088', 'safeguard-technology-032', 'safeguard-technology-026']", "chroma:document": "Contracts - Processor Contractual Obligations: Service providers/Processors are contractually required to:Not sell and share personal information. Not retain, use, or disclose personal information for any other business purpose, commercial purpose, or outside the direct business relationship except as permitted by the CCPA and Regs, and not combine data obtained from the business with other personal information; Require compliance with CCPA and Regs and notification to business if cannot comply; Grant business right to take reasonable and appropriate steps to (a) ensure using data in accordance with CCPA and Regs and (b) remediate unauthorized use; Comply with consumer requests; Ensure all personnel processing the personal data be subject to a duty of confidentiality; Engage a subcontractor after giving the controller an opportunity to object; Implement technical and organizational security measures; Return or delete all personal data at the end of the requested services; Allow for and contribute to reasonable audits; Ensure all subcontractors are under written agreement that obligates them to uphold the processor's obligations with respect to the personal data. Cooperate with reasonable assessments by the controller (or independent assessor), Implement appropriate technical and organizational security measures and establish clear implementation responsibilities between controller and processor. Stop processing data on request by the controller in connection with a consumer's authenticated request;"}


created_at: 2025-02-27 07:40:21
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 803de367-53c4-41f8-aa44-6aaa3f768186
encoding: FLOAT32
metadata:
{"index": 17, "version": 1, "PO": "['data sharing', 'data security', 'privacy by design']", "safeguard": "['safeguard-technology-136', 'safeguard-process-099', 'safeguard-technology-027', 'safeguard-technology-026', 'safeguard-process-071', 'safeguard-process-067', 'safeguard-policy-030', 'safeguard-technology-032', 'safeguard-technology-088']", "chroma:document": "Contracts - Processor Obligations - Non-Contractual: A service provider/Processor must:For advertising or marketing, not combine the personal information of opted-out consumers that the service provider receives from the buisness with personal information that the service provider receives from/on behalf of another person or collects from its own interaction with consumers; Not contract with a controller to provide cross-contextual behavioral advertising; Notify the business if it engages any other person to assist in processing personal information, and engage that other person pursuant to a written contract that requires the person to observe the same requirements that the service provider must follow; Honor consumer requests received by the controller to limit the use of sensitive personal information; Adhere to the controller's instructions and assist the controller in meeting its statutory obligations; Take appropriate technical and organizational measures to assist the controller in responding to consumer rights requests; Assist controllers in meeting obligations regarding the security of processing and data breach notifications; Implement technical and organizational measures appropriate to the risk of processing and allocate responsibilities between the controller and processor; Adopt technical and physical Safeguards to protect the security and confidentiality of processed personal data;"}


created_at: 2025-02-27 07:40:22
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: c487b83f-4d52-4d53-8dc1-a0a4bd16719f
encoding: FLOAT32
metadata:
{"index": 18, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "List of Third-Parties the Consumer's PI is disclosed to: Individuals are entitled to receive a list of specific third parties to whom the controller has disclosed personal information or any personal data."}


created_at: 2025-02-27 07:40:24
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: ad1ee94d-447d-45b6-8628-409f570ba8c6
encoding: FLOAT32
metadata:
{"index": 19, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-083']", "chroma:document": "Best efforts to authenticate consumer: Make a reasonable effort to request that the consumer provide additional information reasonably necessary to authenticate the consumer"}


created_at: 2025-02-27 07:40:26
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: c785a31e-f791-4c07-a443-e4bbcb9fb45e
encoding: FLOAT32
metadata:
{"index": 20, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-084']", "chroma:document": "Notice re: Basis of Denial : Require notice to consumer before denial of a right's request based on an inability to authenticate"}


created_at: 2025-02-27 07:40:28
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 34c512b5-6b37-49c5-9c77-bae4a2d9e003
encoding: FLOAT32
metadata:
{"index": 21, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-policy-027']", "chroma:document": "Confirm Receipt (10 Days): Confirm receipt of a consumer rights requests within 10 business days"}


created_at: 2025-02-27 07:40:30
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 17732bd8-5a8a-4a12-a28c-3efd6acc3a5f
encoding: FLOAT32
metadata:
{"index": 22, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-policy-027']", "chroma:document": "Free of Charge (Generally): Information must be given free of charge generally, unless \"manifestly unfounded or excessive.\""}


created_at: 2025-02-27 07:40:32
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: aa8f5911-03a1-448a-aad0-e4071f9da719
encoding: FLOAT32
metadata:
{"index": 23, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-policy-027']", "chroma:document": "Free of Charge (Once Annually): Information must be given free of charge at least once per year"}


created_at: 2025-02-27 07:40:33
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: feb61551-f5c8-4d14-905b-f6b349e8396a
encoding: FLOAT32
metadata:
{"index": 24, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-policy-027']", "chroma:document": "Free of Charge (Twice Annually): Information must be given free of charge twice per year "}


created_at: 2025-02-27 07:40:35
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 860a7ee0-c015-4907-a726-1eb1a9d092de
encoding: FLOAT32
metadata:
{"index": 25, "version": 1, "PO": "['transparency', 'individual rights']", "safeguard": "['safeguard-technology-076', 'safeguard-policy-001']", "chroma:document": "Methods for exercising data subject rights must include one or more methods: Must establish secure and reliable means for exercising data rights and describe such means in privacy Policy"}


created_at: 2025-02-27 07:40:37
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 9c6a4667-11a8-47f4-9939-1d9f1abf6b79
encoding: FLOAT32
metadata:
{"index": 26, "version": 1, "PO": "['transparency', 'individual rights']", "safeguard": "['safeguard-policy-027', 'safeguard-policy-001']", "chroma:document": "Methods for exercising data subject rights must include two methods (one being a toll-free phone number unless exempted): One of two methods must be a toll-free number, and these methods must be described in privacy policy. If business maintains internet website, one method must be website. However, if business operates exclusively online and has direct relationship with consumers about whom it collects personal information - then the business may provide only an email address."}


created_at: 2025-02-27 07:40:39
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: d1bf8124-c68e-411b-845c-d26a5d35cadc
encoding: FLOAT32
metadata:
{"index": 27, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-083']", "chroma:document": "Verification of data rights requests: Business must use commercially reasonable efforts to verify consumer identity "}


created_at: 2025-02-27 07:40:41
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: f7ed5921-f936-41ce-8039-5bbf17a6e07e
encoding: FLOAT32
metadata:
{"index": 28, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-process-053']", "chroma:document": "Consumer: Appeals: If the business denies a consumer request, it must inform the consumer of the reasons for not taking action and any right to appeal the decision to the business"}


created_at: 2025-02-27 07:40:43
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 19b1a41f-afa1-4f94-b1e5-13e1c293880b
encoding: FLOAT32
metadata:
{"index": 29, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-084']", "chroma:document": "Procedural Requirement: Appeal process must be similar to the process consumers use to submit initial requests"}


created_at: 2025-02-27 07:40:45
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 96f9dfdd-fed0-42cb-b298-19934f91a80e
encoding: FLOAT32
metadata:
{"index": 30, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-124', 'safeguard-technology-137', 'safeguard-technology-077']", "chroma:document": "Consumer: Right to Access / Right to Know: The right to know (request disclosure of) personal information collected by the business about the consumer, from whom it was collected, why it was collected, and, if sold, to whom."}


created_at: 2025-02-27 07:40:46
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 112a2698-7c13-463d-949d-a5610c67ee84
encoding: FLOAT32
metadata:
{"index": 31, "version": 1, "PO": "['transparency', 'individual rights']", "safeguard": "['safeguard-technology-124', 'safeguard-technology-137', 'safeguard-policy-001']", "chroma:document": "Additional Obligation: Third Party Recipients: Consumers have the right to obtain list of third parties that received the consumer's data"}


created_at: 2025-02-27 07:40:48
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: e75bce3d-22f6-4b04-a6c8-2c5e83b6088e
encoding: FLOAT32
metadata:
{"index": 32, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-124', 'safeguard-technology-137']", "chroma:document": "Inferred Data: As part of the right to know, consumers have the right to know the business\u2019 internally generated inferences about that consumer, unless a business can demonstrate that a statutory exception applies."}


created_at: 2025-02-27 07:40:50
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 5336c49b-c788-4fbc-9665-6cda3934b13e
encoding: FLOAT32
metadata:
{"index": 33, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-078', 'safeguard-technology-071']", "chroma:document": "Consumer: Right to Correct: The right to ask businesses to correct inaccurate information that they have about you."}


created_at: 2025-02-27 07:40:52
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 8e5f18f0-5b6b-4c8e-91f9-ae241b5df568
encoding: FLOAT32
metadata:
{"index": 34, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-080']", "chroma:document": "Consumer: Right to Delete: The right to request that a business delete any personal information of the consumer (includes information \"about\" or \"concerning\" the consumer and information collected from the consumer)"}


created_at: 2025-02-27 07:40:54
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 5226cf2c-8aaa-4bd6-b201-939f0e4ed15a
encoding: FLOAT32
metadata:
{"index": 35, "version": 1, "PO": "['individual rights', 'data retention']", "safeguard": "['safeguard-technology-022', 'safeguard-technology-080']", "chroma:document": "Disclosure of data retained and not deleted: If deletion is via opting out of processing, Controller must provide categories of personal data that were not deleted along with any applicable exception. Controller may also not use personal data retained for any secondary purpose"}


created_at: 2025-02-27 07:40:56
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 17e8f07b-1d39-4fdf-a969-9f8aabd895ed
encoding: FLOAT32
metadata:
{"index": 36, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-process-056', 'safeguard-policy-027', 'safeguard-process-050', 'safeguard-process-055', 'safeguard-process-051']", "chroma:document": "Consumer: Right to Non-Discrimination: Right prohibits a business from discriminating against California consumers for exercising their rights under the law."}


created_at: 2025-02-27 07:40:58
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 826a81f2-eb12-4240-bf54-57b0ecd091f8
encoding: FLOAT32
metadata:
{"index": 37, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-policy-027']", "chroma:document": "Price Control: Businesses can not increase the cost or decrease the availablity of a product or service \"based solely on the exercise of a right and unrelated to feasibility or the value of a service.\" "}


created_at: 2025-02-27 07:40:59
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 7b92d9d8-f729-426b-ac23-8601896712b7
encoding: FLOAT32
metadata:
{"index": 38, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-079', 'safeguard-technology-072', 'safeguard-policy-027']", "chroma:document": "Consumer: Right to Portability: Right to request the specific pieces of personal information, in a format that is easily understandable and in a machine-readable which may also be transmitted to another entity at the consumer\u2019s request."}


created_at: 2025-02-27 07:41:01
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: de265f5e-191c-4711-89e3-c90c9f01cdee
encoding: FLOAT32
metadata:
{"index": 39, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-technology-072']", "chroma:document": "Limited Right to Portability: Only data that was provided by the consumer is covered by the portability right. "}


created_at: 2025-02-27 07:41:03
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 0bd8222e-f65d-4f33-a787-f91c19635fc1
encoding: FLOAT32
metadata:
{"index": 40, "version": 1, "PO": "['data retention']", "safeguard": "['safeguard-policy-008']", "chroma:document": "DSAR Third Party: Request to Delete: If the business obtains personal data from third parties, the business can respond to requests to delete in one of two ways: 1) by retaining a record of the deletion request and the minimum data required to ensure that the data remains deleted AND not using the retained data for other purposes. 2) by opting the consumer out of personal data processing for any purpose except those permitted by the statute."}


created_at: 2025-02-27 07:41:05
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: f1985eee-c1d0-4867-b6e8-1355f1d1a8cc
encoding: FLOAT32
metadata:
{"index": 41, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-people-015']", "chroma:document": "DSAR Training Requirements: Document & implement our training policies for US state privacy law compliance specific to consumer rights + sale/share requirements"}


created_at: 2025-02-27 07:41:07
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: bda88d21-6887-44c2-a5d9-d7824ed56f95
encoding: FLOAT32
metadata:
{"index": 42, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-people-015']", "chroma:document": "General personnel training regarding compliance with state privacy law : Establish, document, and comply with a training policy to ensure that all employees responsible for handling consumer requests or state law privacy compliance are informed of the law's requirements (if the business \"knows or reasonably should know\" that it, alone or in combination, buys, receives for the business's commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year)."}


created_at: 2025-02-27 07:41:09
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 009971d2-cff2-4920-92cc-a17c2144da8e
encoding: FLOAT32
metadata:
{"index": 43, "version": 1, "PO": "['individual rights']", "safeguard": "['safeguard-people-015']", "chroma:document": "Training for employees on teams operationalizing consumer rights requirements: Inform employees responsible for handling the business's information practices or privacy compliance of the state privacy law's requirements and how to direct consumers to exercise their rights."}


created_at: 2025-02-27 07:41:10
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: c03381d7-257c-422b-8c96-be73bc4d3a00
encoding: FLOAT32
metadata:
{"index": 44, "version": 1, "PO": "['privacy by design']", "safeguard": "['safeguard-policy-051']", "chroma:document": "DPIA Specifications: - Short summary of processing activity- Categories of personal data being processed (including sensitive data and personal data from a known child)- Context of the processing activity, including relationship between consumer and controller and reasonable expectations of consumers- Nature and operational elements (e.g., sources of personal data, Technology used, recipients, purpose for disclosure) of the processing activity (specificity to be determined by considering type, amount, and sensitivity of the personal data processed, impacts operational elements will have on risk of processing activity, and relevant unique relationships). - Core purposes of processing activity, including benefits to stakeholders and public- Source and nature of risks to the rights of consumers (e.g., unfair treatment, privacy harms, constitutional harms)- Measures and Safeguards business will employ to reduce identified risks (e.g., use of deidentified data)- Description of how benefits outweigh risks, as mitigated by Safeguards and considering the use of de-identified data, reasonable expectations of consumers, context of the processing and controller/consumer relationship- Relevant internal and external parties contributing to DPIA- Details regarding any internal or external audit in connection with the DPIA- Names, positions, signatures of approvers, and dates DPIA was reviewed and approvedIf processing sensitive data inferences subject to exception in Colorado Regulations, Rule 6.10 (e.g., processing would be obvious to reasonable consumer), DPIA must also include details of the process implemented to ensure that personal data and Sensitive Data Inferences are not transferred and are deleted within twenty-four (24) hours."}


created_at: 2025-02-27 07:41:12
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: aa30fa4e-a5fe-47e9-a6ec-5e8600672c20
encoding: FLOAT32
metadata:
{"index": 45, "version": 1, "PO": "['privacy by design']", "safeguard": "['safeguard-process-107']", "chroma:document": "DPIA Requirements Minors: - Purpose of the online service, product, or feature- Categories of minors' personal data that such online service, product or feature processes,\"- Purposes for which controller processes minors' personal data- Reasonably foreseeable heightened risk(s) of harm to minors "}


created_at: 2025-02-27 07:41:14
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: b6895558-d046-4dd4-9748-77c46c87d2f2
encoding: FLOAT32
metadata:
{"index": 46, "version": 1, "PO": "['privacy by design']", "safeguard": "['safeguard-process-107']", "chroma:document": "DPIA Requirements Profiling : -Profiling when profiling presents a reasonably foreseeable risk of substantial injury to consumers (risks enumerated in statutes; includes unfair/deceptive treatment, disparate impact, financial/physical/reputational injury, unreasonable intrusion)- Specific types of personal data used- Decision being made using profiling- Benefits of automated processing over manual processing for purpose- Plain language explanation of why profiling directly and reasonably relates to goods/services- Explanation of training data and logic used to create profiling system, including statistics used in analysis- If profiling is conducted by third-party software, name of software and copies of internal or external evaluations sufficient to show accuracy and reliability- Plain language description of outputs- Plain language description of how outputs are used, including whether and how used to make decisions to: provide or deny financial or lending services, housing, insurance, education, enrollment or opportunity, criminal justic, employment opportunities, health-care services, access to essential goods/services - Degree and details of human involvement- Decription and results of evaluation for fairness and disparate impact- Safeguards used to reduce risk of identified harms, including for data sets produced or derived from profiling"}


created_at: 2025-02-27 07:41:16
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 8aafca00-e2a4-4e31-9bc9-015ba4a3fbcb
encoding: FLOAT32
metadata:
{"index": 47, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy Notice at or Before Collection (In Product): The business must give consumers notice at or before the point at which the business collects personal information from the consumer. This notice should include a number of statements, including:(1) A list of the categories of personal information about consumers, including categories of sensitive personal information to be collected(2) The purpose(s) of collection and processing(3) Whether each category of personal information is sold or shared(4) The length of time the business intends to retain each category of personal information (or if that is not possible, criteria to determine retention)(5) If the business sells or shares personal information, the link to the Notice of Right to Opt-out of Sale/Sharing(6) A link to the the business' privacy policy.(7) The notice must be made available in the languages that the business provides web pages and types of other information to consumers. (8) Categories of personal data processed(9) Processing purposes(10) Categories of data shared with third parties(11) Categories of third parties with whom data is shared(12) Methods for consumers to exercise their rights (13) Categories of personal data collected(14) An online mechanism where the business can be contacted(15) Statement on whether the business engages in targeted advertising or sharing as applicable(16) Method to opt out of targeted advertising or sharing as applicable(17) Statement on whether the business engages in profiling which results in legal/similarly significant effects(18) Date last updated "}


created_at: 2025-02-27 07:41:18
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 4418adc5-1ce5-44ea-8006-89e0610d6121
encoding: FLOAT32
metadata:
{"index": 48, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-process-001']", "chroma:document": "Privacy Policy : Privacy policy must be updated at least once every 12 months"}


created_at: 2025-02-27 07:41:19
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 224826e6-25c3-4922-92d3-31685c9fd566
encoding: FLOAT32
metadata:
{"index": 49, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : ByteDance's identity, which includes the business name ByteDance registered with the Secretary of State and any assumed business names"}


created_at: 2025-02-27 07:41:21
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: f0cb78ab-3490-4015-b94b-72e34cb419ad
encoding: FLOAT32
metadata:
{"index": 50, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : The notice should be linked through the business' app settings menu"}


created_at: 2025-02-27 07:41:23
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: f617c54b-3d9a-4f66-9bfa-bc0e18885e42
encoding: FLOAT32
metadata:
{"index": 51, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : Privacy Policy should be conspicuously posted online via a link that says \"privacy\" on controller's home page and should be available in printable format"}


created_at: 2025-02-27 07:41:25
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: e7096b90-2e40-4cce-9d3f-d04f77d63224
encoding: FLOAT32
metadata:
{"index": 52, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : Require to post specific statements if it sells sensitive or biometric data"}


created_at: 2025-02-27 07:41:27
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 43fcd912-9477-4215-921b-6d22b647ce66
encoding: FLOAT32
metadata:
{"index": 53, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : Privacy Policy must state whether the business has sold or shared personal information in previous 12 months and the categories shared, categories of third-party recipients, and business or commercial purposes and opt out method"}


created_at: 2025-02-27 07:41:28
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 39af4473-efa2-43da-9f31-aefb0fd729b1
encoding: FLOAT32
metadata:
{"index": 54, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : If business does not sell or share personal information, require business Privacy Policy to state that it does not sell or share personal information"}


created_at: 2025-02-27 07:41:30
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: d18330cd-1a6a-4f09-b6f7-39a222f4263c
encoding: FLOAT32
metadata:
{"index": 55, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : The privacy notice must include the \"categories of sensitive data\" that the controller processes and the categories of sensitive data shared with third parties. "}


created_at: 2025-02-27 07:41:32
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 0ea25b2c-e468-4eb9-b8a2-daa2190b35c3
encoding: FLOAT32
metadata:
{"index": 56, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : The privacy notice must include whether the personal data of a child or other sensitive data is processed.The privacy notice must also include whether the business will delete sensitive data inferences within twelve (12) hours, a description of the sensitive data inferences and the retention and deletion timeline for such sensitive data inferences. "}


created_at: 2025-02-27 07:41:34
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 1a26971a-0570-48b0-abee-b0adb6b7e07a
encoding: FLOAT32
metadata:
{"index": 57, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : If applicable, the business must provide a statement on whether sensitive data is used or disclosed."}


created_at: 2025-02-27 07:41:36
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: d73c1240-3097-4bcd-9e74-01dba60558cc
encoding: FLOAT32
metadata:
{"index": 58, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-technology-086']", "chroma:document": "Transparency Metrics : Businesses that buy, receive, sell, share, or make available the personal information of at least 10 million consumers in a calendar year must disclose additional transparency metrics. The business must compile the following metrics for the previous calendar year:(A) The number of requests to delete that ByteDance received, complied with in whole or in part, and denied;(B) The number of requests to correct that ByteDance received, complied with in whole or in part, and denied;(C) The number of requests to know that ByteDance received, complied with in whole or in part, and denied;(D) The number of requests to opt-out of sale/sharing that ByteDance received, complied with in whole or in part, and denied;(E) The number of requests to limit that ByteDance received, complied with in whole or in part, and denied; and(F) The median or mean number of days within which ByteDance substantively responded to requests to delete, requests to correct, requests to know, requests to opt-out of sale/sharing, and requests to limit.Before July 1 each year, ByteDance must include the information above in ByteDance's privacy policy or posted on ByteDance's website and accessible from a link included in ByteDance's privacy policy. If preferable, ByteDance may choose to compile and disclose the information above for requests received from all individuals, rather than requests received from consumers. If ByteDance does this, it must state whether it has done so in its disclosure and be prepared to compile and provide to the Attorney General the information above for requests received from consumers as needed."}


created_at: 2025-02-27 07:41:37
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: e6ad8e7f-f00c-4972-88db-563eb3499a59
encoding: FLOAT32
metadata:
{"index": 59, "version": 1, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Privacy Policy : The business must disclose whether it processes personal data from children under the age of 13."}


created_at: 2025-02-27 07:41:39
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 222811fc-6ef0-4607-8df7-c3329cdef218
encoding: FLOAT32
metadata:
{"index": 60, "version": 1, "PO": "['transparency', 'privacy by design']", "safeguard": "['safeguard-policy-031', 'safeguard-technology-004', 'safeguard-policy-001']", "chroma:document": "Young User: Ban on processing personal data of a consumer under 18 for targeted advertising"}


created_at: 2025-02-27 07:41:41
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 270eee43-6b32-43de-8c41-dfdeaabe2d64
encoding: FLOAT32
metadata:
{"index": 61, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-process-001', 'safeguard-people-003', 'safeguard-technology-006', 'safeguard-process-004', 'safeguard-technology-004']", "chroma:document": "Compliance with the APPs : Take reasonable steps to comply with Privacy Act requirements."}


created_at: 2025-02-27 07:41:43
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: fbf491b0-d22b-4f05-97ec-058f1550d228
encoding: FLOAT32
metadata:
{"index": 62, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-technology-001', 'safeguard-technology-003', 'safeguard-policy-001', 'safeguard-process-002', 'safeguard-policy-003']", "chroma:document": "APP Privacy Policy: Have a clear and up to date Privacy Policy."}


created_at: 2025-02-27 07:41:45
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 0bbe5424-0a64-4b07-8061-8fa46913a9d5
encoding: FLOAT32
metadata:
{"index": 63, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-technology-001', 'safeguard-policy-001']", "chroma:document": "APP Privacy Policy: Have a clear and up to date Privacy Policy that contains all required statutory items."}


created_at: 2025-02-27 07:41:46
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 7569da82-a474-418e-9176-45518c435155
encoding: FLOAT32
metadata:
{"index": 64, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-technology-086', 'safeguard-technology-001']", "chroma:document": "Availability of APP Privacy Policy: Have a clear and up to date Privacy Policy that is easily available to individuals."}


created_at: 2025-02-27 07:41:48
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: e328081f-1cca-4a11-b241-a48cf2a2c6d1
encoding: FLOAT32
metadata:
{"index": 65, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Availability of APP Privacy Policy: Take reasonable steps to give an individual a copy of the Privacy Policy if requested. "}


created_at: 2025-02-27 07:41:50
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 77beff5e-8135-449c-bd78-f9e5661bb8a3
encoding: FLOAT32
metadata:
{"index": 66, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-technology-075', 'safeguard-technology-078']", "chroma:document": "Automated decisions  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : If personal information is used in connection with automated decision-making (i.e. a computer program is used to make, or do a thing directly related to making, a decision), and the decision could significantly affect the rights or interests of an individual, the organisation's Privacy Policy must contain information about (a) the kinds of personal information used in the automated decision-making; and (b) the kinds of decisions made using automated decision-making."}


created_at: 2025-02-27 07:41:52
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 4d7bbb75-411f-46a2-b275-70802ed4a551
encoding: FLOAT32
metadata:
{"index": 67, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-policy-027']", "chroma:document": "Anonymity and pseudonymity: Provide individuals with the option of not identifying themselves (or using a pseudonym) unless its impracticable to do so or prevented by law."}


created_at: 2025-02-27 07:41:54
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: fa363eaf-63e1-4c51-a087-25781b66db66
encoding: FLOAT32
metadata:
{"index": 68, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-technology-010', 'safeguard-policy-004', 'safeguard-process-005']", "chroma:document": "Personal information other than sensitive information: Only collect personal information (other than sensitive information) if the collection is reasonably necessary for a function or activity of the organisation. "}


created_at: 2025-02-27 07:41:56
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 346ad70c-5761-4e59-b00a-515367146f4f
encoding: FLOAT32
metadata:
{"index": 69, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-005', 'safeguard-process-005']", "chroma:document": "Sensitive information : Do not collect sensitive information unless (a) the individual provides their consent to the collection and the collection is reasonably necessary for a function or activity of the organisation OR (b) another permitted legal basis exists for the collection."}


created_at: 2025-02-27 07:41:58
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 00776f2e-d23c-4830-8686-db32d2fef3a1
encoding: FLOAT32
metadata:
{"index": 70, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-technology-009', 'safeguard-policy-005', 'safeguard-technology-010', 'safeguard-process-005']", "chroma:document": "Means of collection: Only collect personal information by lawful and fair means."}


created_at: 2025-02-27 07:41:59
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 440b4ba5-e84d-4841-8c7d-7531f9280dfe
encoding: FLOAT32
metadata:
{"index": 71, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-process-006', 'safeguard-process-005']", "chroma:document": "Means of collection: Only collect personal information from the individual (and not a third party) unless its impracticable or unreasonable."}


created_at: 2025-02-27 07:42:01
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 733bb7c2-43a9-4f69-9545-969ea371e9c0
encoding: FLOAT32
metadata:
{"index": 72, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-012', 'safeguard-technology-013', 'safeguard-policy-004']", "chroma:document": "Dealing with unsolicited personal information : If unsolicited personal information is received, determine within a reasonable time whether or not that personal information could have been legally collected by the organisation. "}


created_at: 2025-02-27 07:42:03
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: ffea8de3-dad7-4c03-864d-e3e225c55e81
encoding: FLOAT32
metadata:
{"index": 73, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-012', 'safeguard-policy-020', 'safeguard-technology-013', 'safeguard-policy-004']", "chroma:document": "Dealing with unsolicited personal information : If unsolicited personal information is received that the organisation couldn't have legally collected, destroy or de-identify the personal information as soon as practicable."}


created_at: 2025-02-27 07:42:05
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 62576882-969c-4418-a14c-390e7dfc95a5
encoding: FLOAT32
metadata:
{"index": 74, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002', 'safeguard-policy-004']", "chroma:document": "Notification of the collection of personal information: Provide an individual with a collection notification at, before the time, or as soon as practicable after collecting their personal information."}


created_at: 2025-02-27 07:42:07
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: eb19d6c3-7e8a-4849-85b5-b8db2fa6b218
encoding: FLOAT32
metadata:
{"index": 75, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-policy-001', 'safeguard-process-002', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-policy-002', 'safeguard-policy-004']", "chroma:document": "Notification of the collection of personal information: Collection notifications provided to individuals must contain all required statutory items."}


created_at: 2025-02-27 07:42:09
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: f782f94a-f546-4523-8ce1-480169820840
encoding: FLOAT32
metadata:
{"index": 76, "version": 2, "PO": "['data minimization & purpose limitation', 'data sharing']", "safeguard": "['safeguard-policy-007', 'safeguard-process-059', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-technology-032', 'safeguard-policy-011', 'safeguard-technology-088']", "chroma:document": "Use or disclosure of personal information: Only use or disclose personal information (other than sensitive information) (a) for the purpose it was collected, OR (b) for a related purpose where the individual reasonably expects the information to be used for that purpose OR (c) another legal basis exists."}


created_at: 2025-02-27 07:42:11
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 1e93a4f8-042d-4bbc-8d40-395380d15084
encoding: FLOAT32
metadata:
{"index": 77, "version": 2, "PO": "['data minimization & purpose limitation', 'data sharing']", "safeguard": "['safeguard-policy-007', 'safeguard-process-059', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-technology-032', 'safeguard-policy-011', 'safeguard-technology-088']", "chroma:document": "Use or disclosure of sensitive information: Only use or disclose sensitive information (a) for the purpose it was collected, OR (b) for a directly related purpose where the individual reasonably expects the information to be used for that purpose OR (c) another legal basis exists."}


created_at: 2025-02-27 07:42:13
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: b417ae81-9910-4d8a-84f6-a7bcbaf5f3f8
encoding: FLOAT32
metadata:
{"index": 78, "version": 2, "PO": "['data sharing']", "safeguard": "['safeguard-policy-047', 'safeguard-policy-011', 'safeguard-process-062']", "chroma:document": "Written note of use or disclosure: If required to use/disclose personal information for one or more enforcement related activities, make a written note of the use or disclosure. "}


created_at: 2025-02-27 07:42:14
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 6961bf2e-6795-4689-84da-f737caaa1763
encoding: FLOAT32
metadata:
{"index": 79, "version": 2, "PO": "['data minimization & purpose limitation', 'data sharing']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-010', 'safeguard-policy-011', 'safeguard-technology-032', 'safeguard-process-017']", "chroma:document": "Related bodies corporate: Where the organisation collects personal information from a related body corporate, the purpose of collection is the same for both companies."}


created_at: 2025-02-27 07:42:16
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: c2c7e9ed-9444-472d-9f5b-0e2148822a39
encoding: FLOAT32
metadata:
{"index": 80, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Direct marketing of personal information collected from the individual: Only use or disclose personal information (other than sensitive information) collected from a third party where the individual (a) has consented to direct marketing and (b) the individual is given a simple means to opt-out of receiving direct marketing comms, (c) a prominent statement is included in each direct marketing comms that the individual can withdraw their consent and (d) the individual has not opted out of direct marketing comms."}


created_at: 2025-02-27 07:42:18
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 6347c32b-0076-470b-91e6-aba18687e63a
encoding: FLOAT32
metadata:
{"index": 81, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Direct marketing of personal information collected from the individual: Only use or disclose personal information (other than sensitive information) collected from the individual where the individual has given their consent OR the individual (a) reasonably expects the organisation to use or disclose it for direct marketing, (b) has been given a simple means to opt-out of receiving direct marketing comms and (c) has not previously opted out of direct marketing comms. "}


created_at: 2025-02-27 07:42:20
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 41153667-5434-4b39-975f-1de31b277700
encoding: FLOAT32
metadata:
{"index": 82, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Exceptions : Only use or disclose sensitive information where the individual has given their consent to direct marketing."}


created_at: 2025-02-27 07:42:22
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: bd60c752-8d2c-445d-9175-ec030d8b3e67
encoding: FLOAT32
metadata:
{"index": 83, "version": 2, "PO": "['transparency', 'individual rights']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-125', 'safeguard-policy-027', 'safeguard-policy-001', 'safeguard-technology-138', 'safeguard-process-003', 'safeguard-process-050', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Individual may request not to receive direct marketing communications etc. : Individuals must be able to request to opt-out of direct marketing comms from the organisation"}


created_at: 2025-02-27 07:42:24
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: a22dece1-3fdc-4261-9d47-60a9a5969b1a
encoding: FLOAT32
metadata:
{"index": 84, "version": 2, "PO": "['transparency', 'individual rights']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-124', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-137', 'safeguard-technology-125', 'safeguard-policy-027', 'safeguard-policy-001', 'safeguard-technology-138', 'safeguard-process-003', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002', 'safeguard-process-133']", "chroma:document": "Individual may request not to receive direct marketing communications facilitating direct marketing by another organisation: If the organisation facilitates direct marketing by another organisation, individuals must be able to request to opt-out of direct marketing comms from that other organisation and request the organisation provides information about the source of the personal information."}


created_at: 2025-02-27 07:42:25
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 71b2d42e-fd1a-4f0b-8d7d-6c0b2622c9c4
encoding: FLOAT32
metadata:
{"index": 85, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Individual may request not to receive direct marketing communications etc.: Give effect to a direct marketing opt-out request within a reasonable period of time. Do not charge an individual to opt out of direct marketing. "}


created_at: 2025-02-27 07:42:27
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 69630366-41d5-4c46-bb15-b4fc0691a9db
encoding: FLOAT32
metadata:
{"index": 86, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Individual may request not to receive direct marketing communications etc.: If the organisation facilitates direct marketing by another organisation, give effect to requests for sources of personal information within a reasonable period of time unless impracticable or unreasonable. Do not charge an individual to give effect to a request to provide its source of personal information."}


created_at: 2025-02-27 07:42:29
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 096f97f1-f848-4871-b93c-721b26b278fb
encoding: FLOAT32
metadata:
{"index": 87, "version": 2, "PO": "['data sharing']", "safeguard": "['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-014', 'safeguard-policy-042', 'safeguard-technology-129', 'safeguard-policy-013']", "chroma:document": "Cross-border disclosure of personal information: Only disclose personal information to a recipient outside Australia if (a) the organisation has taken reasonable steps to ensure that the recipient complies with the APPs or (b) another legal basis applies (see APP 8.2 and 8.3 below)."}


created_at: 2025-02-27 07:42:31
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: c6ddf1d0-3fab-433f-8cff-3b5f675f43cf
encoding: FLOAT32
metadata:
{"index": 88, "version": 2, "PO": "['data sharing']", "safeguard": "['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-042', 'safeguard-policy-014', 'safeguard-policy-013']", "chroma:document": "Cross-border disclosure of personal information: The organisation can disclose personal information to a recipient outside Australia if (a) the recipient is subject to privacy laws that are substantially similar to the Privacy Act and APP's and the individual can take action to enforce those laws, or (b) the individual has been informed APP 8.1 does not apply to the disclosure and they consent to the disclosure; or (c) another legal basis applies (such as 8.3 below)."}


created_at: 2025-02-27 07:42:33
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: e2f8e7fa-6520-40a1-a58a-e86b20d71b96
encoding: FLOAT32
metadata:
{"index": 89, "version": 2, "PO": "['data sharing']", "safeguard": "['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-042', 'safeguard-policy-014', 'safeguard-policy-013']", "chroma:document": "Cross-border disclosure of personal information  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : The organisation can disclose personal information to a recipient outside Australia if (a) the recipient is subject to the laws of a country that is prescribed by the regulations, or (b) the recipient is a participant in a binding scheme that is prescribed by the regulations and (c) any other conditions prescribed under the regulations are satisfied."}


created_at: 2025-02-27 07:42:35
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: cac1e804-8556-4571-83b0-63b1866ea45e
encoding: FLOAT32
metadata:
{"index": 90, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-010']", "chroma:document": "Adoption of government related identifiers: Do not adopt a government related identifier of an individual for own purposes."}


created_at: 2025-02-27 07:42:36
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 780ace56-ca5f-4d35-9291-d4e6ce9b8bd3
encoding: FLOAT32
metadata:
{"index": 91, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-010']", "chroma:document": "Use or disclosure of government related identifiers: Do not use or disclose a government related identifier unless a statutory exemption applies. "}


created_at: 2025-02-27 07:42:38
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: d13fbbdb-1f0a-42ea-8415-f7319e5b6c34
encoding: FLOAT32
metadata:
{"index": 92, "version": 2, "PO": "['data accuracy']", "safeguard": "['safeguard-process-036', 'safeguard-technology-051', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047']", "chroma:document": "Quality of personal information: Take reasonable steps to ensure the personal information that is collected is accurate, up-to-date and complete. "}


created_at: 2025-02-27 07:42:40
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 08501b46-5f71-4418-a520-54f5f2fc6cfd
encoding: FLOAT32
metadata:
{"index": 93, "version": 2, "PO": "['data accuracy']", "safeguard": "['safeguard-process-036', 'safeguard-technology-046', 'safeguard-technology-051', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047']", "chroma:document": "Quality of personal information: Take reasonable steps to ensure the personal information that is used or disclosed is accurate, up-to-date, complete and relevant."}


created_at: 2025-02-27 07:42:42
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 8bc8f2d8-4b56-4460-b0b5-1d57d11386f3
encoding: FLOAT32
metadata:
{"index": 94, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-technology-135']", "chroma:document": "Security of personal information : Take reasonable steps (including technical and organisational measures) to protect personal information from misuse, interference, loss, unauthorised access, unauthorised modification, unauthorised disclosure. "}


created_at: 2025-02-27 07:42:44
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 60910cef-1a31-4cd8-9f25-1908d572f497
encoding: FLOAT32
metadata:
{"index": 95, "version": 2, "PO": "['data retention']", "safeguard": "['safeguard-process-016', 'safeguard-technology-017', 'safeguard-policy-008', 'safeguard-technology-020', 'safeguard-technology-024']", "chroma:document": "Security of personal information  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : Take reasonable steps (including technical and organisational measures) to destroy or de-identify personal information that isn't needed for any purpose for which it may be used or disclosed under the APPs and is not required to be retained under law."}


created_at: 2025-02-27 07:42:46
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 51c8f2dc-3520-4353-abe1-e19e99c8d406
encoding: FLOAT32
metadata:
{"index": 96, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-policy-027', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-077', 'safeguard-process-051']", "chroma:document": "Access to personal information: Give individuals access to their personal information on request unless the request is frivolous or vexatious; it would have an unreasonable impact on the privacy of others; it reveals information in connection with a commercially sensitive decision-making process; the information relates to legal proceedings or negotiations between the organisation and the individual; or another legal exception applies."}


created_at: 2025-02-27 07:42:48
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: f221c33c-22ec-42e5-abf1-346ca0dcd1c8
encoding: FLOAT32
metadata:
{"index": 97, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-technology-077', 'safeguard-technology-084', 'safeguard-policy-027']", "chroma:document": "Dealing with requests for access: Respond to a request from an individual to access their personal information within a reasonable period. Give access to the information in the manner requested if reasonable and practicable."}


created_at: 2025-02-27 07:42:50
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 9cfb01aa-c1f8-4a8c-ba30-a7f38964ceb5
encoding: FLOAT32
metadata:
{"index": 98, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-technology-077', 'safeguard-technology-084', 'safeguard-policy-027']", "chroma:document": "Other means of access: If the organisation refuses to give access to personal information in a particular manner, take reasonable steps to give access in a way that meets the needs of the organisation and the individual. "}


created_at: 2025-02-27 07:42:51
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: c8656d74-e08f-4617-acd1-4567e4908023
encoding: FLOAT32
metadata:
{"index": 99, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-technology-077', 'safeguard-policy-027']", "chroma:document": "Access charges: If charging an individual for giving access to personal information, do not make the charge excessive and do not charge for the act of making of the request."}


created_at: 2025-02-27 07:42:53
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 3f4a3bbe-b801-4716-aa5a-957f6e99a603
encoding: FLOAT32
metadata:
{"index": 100, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-technology-077', 'safeguard-technology-084', 'safeguard-policy-027']", "chroma:document": "Refusal to give access: If the organisation refuses to give access to the personal information, provide a written notice to the individual that complies with the statutory requirements."}


created_at: 2025-02-27 07:42:55
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 262ecb8e-a7ad-433b-84f8-d00199778cfa
encoding: FLOAT32
metadata:
{"index": 101, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-policy-027', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-077', 'safeguard-process-051']", "chroma:document": "Refusal to give access: If the organisation is refusing to give access to the personal information because access would reveal evaluative information in connection with commercially sensitive decisions, the reasons for the refusal may include an explanation for the commercially sensitive decision."}


created_at: 2025-02-27 07:42:57
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 2ff9e820-38ce-4279-9f57-b996d4539267
encoding: FLOAT32
metadata:
{"index": 102, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-process-050', 'safeguard-policy-019']", "chroma:document": "Correction: Take reasonable steps to correct personal information (to ensure it is accurate, up to date, complete, relevant and not misleading) where an individual requests the personal information be corrected. "}


created_at: 2025-02-27 07:42:59
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 00c48821-3a5b-442d-9dde-53f12983a6d5
encoding: FLOAT32
metadata:
{"index": 103, "version": 2, "PO": "['data accuracy']", "safeguard": "['safeguard-process-036', 'safeguard-technology-096', 'safeguard-technology-051', 'safeguard-technology-094', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047', 'safeguard-technology-093', 'safeguard-technology-045', 'safeguard-process-046']", "chroma:document": "Correction: The organisation must take reasonable steps to correct personal information that, having regard to a purpose for which the personal information is held, is inaccurate, out of date, incomplete, irrelevant or misleading."}


created_at: 2025-02-27 07:43:01
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 0729c6c9-f447-4e01-832e-2fb6ba32e5e2
encoding: FLOAT32
metadata:
{"index": 104, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-policy-019', 'safeguard-process-050', 'safeguard-process-133']", "chroma:document": "Notification of correction to third parties: If an individual requests a correction to their personal information that the organisation has previously disclosed to another organisation and the individual requests the organisation notify that organisation of the correction, the organisation must take reasonable steps to notify them of the correction request unless impracticable or unlawful to do so."}


created_at: 2025-02-27 07:43:03
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 33cfa39f-29d0-42c0-8614-f96924989586
encoding: FLOAT32
metadata:
{"index": 105, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-technology-084', 'safeguard-policy-019', 'safeguard-process-050']", "chroma:document": "Refusal to correct information: If the organisation refuses to correct personal information, must provide a written notice to the individual setting out statutory details."}


created_at: 2025-02-27 07:43:04
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 14f5f586-c228-457a-8fc5-65d1aa65e2a9
encoding: FLOAT32
metadata:
{"index": 106, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-technology-084', 'safeguard-policy-019', 'safeguard-process-050']", "chroma:document": "Request to associate a statement: If the organisation refuses to correct personal information and the individual requests a statement the information is not right, include a statement so that is apparent to users of the information."}


created_at: 2025-02-27 07:43:06
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 3bf01f1b-a5ac-4e6f-8eb2-31f3fda813f9
encoding: FLOAT32
metadata:
{"index": 107, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-technology-084', 'safeguard-policy-019', 'safeguard-process-050']", "chroma:document": "Dealing with requests: Respond to an individual's request to correct personal information within a reasonable period. "}


created_at: 2025-02-27 07:43:08
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: ca5f5e28-0907-4ba1-9f70-353a8e3e827d
encoding: FLOAT32
metadata:
{"index": 108, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-process-050', 'safeguard-policy-019']", "chroma:document": "Dealing with requests: Do not charge the individual for correcting personal information or making a request to correct personal information."}


created_at: 2025-02-27 07:43:10
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 6e10682b-9677-4ef6-b620-ecb50482658f
encoding: FLOAT32
metadata:
{"index": 109, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-process-100', 'safeguard-policy-050', 'safeguard-technology-133', 'safeguard-process-101']", "chroma:document": "Notification of eligible data breaches: Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if there are reasonable grounds to believe that an eligible data breach has happened (or if the OAIC directs the organisation to notify)."}


created_at: 2025-02-27 07:43:12
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: b1a4e269-5523-425c-a192-4488c1021833
encoding: FLOAT32
metadata:
{"index": 110, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-technology-135', 'safeguard-policy-050', 'safeguard-process-098']", "chroma:document": "Assessment of suspected eligible data breach: Where the organisation has reasonable grounds to suspect there may be an eligible data breach but is not yet aware of reasonable grounds to believe there is an eligible data breach, take all reasonable steps to complete (within 30 days) a reasonable and expeditious assessment of whether an eligible data breach may have occurred in accordance with statutory requirements."}


created_at: 2025-02-27 07:43:14
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: 864d0fca-5527-4e4f-b0d7-947d72d94e74
encoding: FLOAT32
metadata:
{"index": 111, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-policy-050', 'safeguard-process-103', 'safeguard-technology-132', 'safeguard-process-105', 'safeguard-process-101']", "chroma:document": "Statement about eligible data breach: Where the organisation has reasonable grounds to believe there has been an eligible data breach, the organisation must give a statement about the eligible data breach to the OAIC that meets the statutory requirements, as soon as practicable after becoming aware of the eligible data breach."}


created_at: 2025-02-27 07:43:16
topic: persistent://default/default/dcb6a0cb-e5db-4bd5-b344-48e817e863ca
id: d22f6bff-872b-4e69-8ce9-0bd2f67fbf44
encoding: FLOAT32
metadata:
{"index": 112, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-process-100', 'safeguard-policy-050', 'safeguard-technology-133']", "chroma:document": "Entity must notify eligible data breach: Where the organisation has reasonable grounds to believe there been have been an eligible data breach, and the organisation has provided a statement about the eligible data breach to the OAIC, the organisation should take reasonable steps to notify the contents of the statement to each of the individuals at risk from the eligible data breach."}


# collections

id: dcb6a0cb-e5db-4bd5-b344-48e817e863ca
name: requirement_full_database
database_id: 00000000-0000-0000-0000-000000000000
config_json_str:
{"hnsw_configuration": {"space": "l2", "ef_construction": 100, "ef_search": 100, "num_threads": 9, "M": 16, "resize_factor": 1.2, "batch_size": 100, "sync_threshold": 1000, "_type": "HNSWConfigurationInternal"}, "_type": "CollectionConfigurationInternal"}


# embedding_metadata

key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-010', 'safeguard-policy-001', 'safeguard-technology-004', 'safeguard-process-010']


key: chroma:document
string_value:
Data Minimization Consent for incompatible purposes: Require consent for additional use of personal information not reasonably necessary to or incompatible with original purpose disclosure.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-process-003', 'safeguard-process-001', 'safeguard-technology-011', 'safeguard-process-010']


key: chroma:document
string_value:
Notice for incompatible purposes: Require notice for additional collection or use of personal information incompatible with original disclosure.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-process-005', 'safeguard-process-008', 'safeguard-technology-009', 'safeguard-policy-004']


key: chroma:document
string_value:
Purpose limitation : Require business to limit collection & use to what is adequate, relevant, and reasonably necessary for the disclosed processing purposes


key: safeguard
string_value:
['safeguard-technology-009', 'safeguard-policy-007', 'safeguard-policy-004', 'safeguard-process-005']


key: chroma:document
string_value:
Purpose limitation : Require business to limit collection to what is "reasonably necessary and proportionate" to provide or maintain a specific product or service requested by the consumer to whom the data pertains


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-policy-024', 'safeguard-technology-012', 'safeguard will finalized in q4', 'safeguard-technology-069', 'safeguard-technology-013', 'safeguard-policy-004']


key: chroma:document
string_value:
Sensitive Data Analysis Required: Requirement that businesses use certain types of sensitive personal information only for limited purposes; which includes the following categories: Data revealing racial or ethnic origin, data revealing religious beliefs, data revealing sex life or sexual orientation or similar terms, data revealing revealing citizenship or immigration status or similar terms, genetic data, biometric data, data revealing a mental or physical health condition or diagnosis or similar terms, precise geolocation data, data revealing status as transgender or nonbinary, data revealing national origin, consumer health data, status as the victim of a crime, children's data (child defined as younger than 13), children's data (child defined as younger than 18), financial information including account information plus log-in information, data revealing social security, drivers license, state identification card, or passport number, data revealing philosophical beliefs, data revealing union membership, contents of mail, email, and text messages not sent to the controller.


key: chroma:document
string_value:
Exceptions to use of SPI: Personal data revealing an individuals racial or ethnic origin if processed by a video communication service; Processing data for short-term, transient use; Processing data to prevent bad actors from committing illegal actions directed at the business (and prosecute those who do), Processing data to ensuring physical safety, Personal data processed by a person licensed to provided health care under state laws, The content of communications or data generated by utility systems or equiptment, When processed to avoid discrimination under state or federal law: racial or ethnic origin, religious eliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, Processing data to provide goods/services reasonably expected by an average consumer who requests those goods or services, Processing data to prevent, detect, and investigate security incidents, Processing data to ensuring physical safety, Processing data to maintain or improve the business's products, services, or devices, Sensitive personal information collected or processed without the purpose of inferring characterisitics about a consumer, Sensitive information that is publicly available, Processing data for short-term, transient use, Processing data to perform services on behalf of the business


key: chroma:document
string_value:
Require business to provide an Opt-In: Requires controllers to obtain consumer consent before processing sensitive data or, with regards to known children, process such data in accordance with the federal Children’s Online Privacy Protection Act (COPPA).  


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-002', 'safeguard-technology-125', 'safeguard-technology-138', 'safeguard-technology-004']


key: chroma:document
string_value:
Require business to provide an Opt-Out: Requires controllers to provide consumers with the right to limit the use and disclosure of their sensitive personal information “to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.” Where required, organizations must provide a “Limit the Use of My Sensitive Personal Information” link on their homepage that consumers can use to exercise this right to opt out of sensitive data processing.


key: chroma:document
string_value:
Require business to provide an Opt-Out: Restrict collection, processing, sharing of sensitive data except where the collection or processing is strictly necessary to provide or maintain a specific product or service requested by the consumer


key: chroma:document
string_value:
Broad deletion rights : Includes: Personal data "about" the consumer and Personal data the controller obtained from another source and derived data.


key: chroma:document
string_value:
Retention of sensitive data : Require business to delete or anonymize sensitive data that it no longer has consent to process within a reasonable period of the withdrawal of consentRequire annual review of biometric identifiers and similar data to determine if storage is still necessary


key: chroma:document
string_value:
Prescriptive retention timeline requirements: Require business to retain data for only as long as needed to satisfy the purpose for which it was collected, the expiration/termination of the contract for collecting the data, or two years after the consumer's last interaction with business (exceptions apply)


key: chroma:document
string_value:
Principles based retention timeline requirements: Require business to retain personal information for what is "reasonably necessary and proportionate" to the disclosed processing purposes for which it was collected


key: safeguard
string_value:
['safeguard-process-059', 'safeguard-technology-026', 'safeguard-process-025', 'safeguard-technology-031', 'safeguard-technology-089', 'safeguard-policy-029', 'safeguard-technology-032', 'safeguard-process-060', 'safeguard-process-021', 'safeguard-technology-088']


key: chroma:document
string_value:
Contracts - Controller Contractual Updates Required: Identify specific business purpose for processing, and specify that is the only purpose, Set out processing instructions, including, nature and purpose of processing, type of data subject to processing, and duration of processing, Prohibit processor from selling or sharing personal information collected pursuant to the contract, Prohibit the processor from retaining, using, or disclosing the personal information for any purpose other than the business purpose identified in the contract or outside of the direct relationship with the controller, unless otherwise permitted by law, Require processor to return or delete personal information at the end of the services (as requested by controller), Require processor to implement reasonable technical and organizational security measures, Prohibit the processor from combining personal information it recieves from the controller with personal information from other sources, Require processor to comply with applicable privacy law, Require processor to enable controller in complying with data rights requests, including those recieved by business or by processor, Require processor to notify controller if processor can no longer meet obligations under applicable privacy law, Require processor to ensure all personnel processing personal information is subject to duty of confidentiality, Require processor to engage subprocessors pursuant to contract that binds subprocessor to processor's obligations, Requires processor to give business opportunity to object to subprocessors, Grant controller the right to take reasonable and appropriate steps to ensure that the processor uses the personal information consistent with controllers' obligations under applicable privacy laws, or right to receive information necessary to confirm compliance upon reasonable request, Permit controller to monitor processor's contract compliance through reasonable measures, including through reasonable assessment by controller or independent auditor, Grant controller the right to take reasonable and appropriate steps to stop and remediate processor's unauthorized use of personal information,Certify that contractor understands restrictions and will comply , Require processor to stop processing data on request by controller made in accordance with a consumer's authenticated request, Requires a binding contract between controllers and third parties where there is a "sell" or "share" (and arguments required even where no sale, share), Set out "limited and specified purpose" the personal information is made available to the third party, Require compliance with CCPA and Regs and notification to business if cannot comply, Grant business right to take reasonable and appropriate steps to (a) ensure using data in accordance with CCPA and Regs and (b) remediate unauthorized use, Contractual requirements for de-identification (e.g., prohibit recipient from associating data with an individuals; publicly commit to mantain and use in deidentified form, and not attempt to reidentify), Monitor and address breaches of contractual commitments with respect to de-identified data.


key: safeguard
string_value:
['safeguard-technology-029', 'safeguard-process-059', 'safeguard-technology-030', 'safeguard-technology-027', 'safeguard-technology-031', 'safeguard-process-020', 'safeguard-policy-030', 'safeguard-policy-029', 'safeguard-technology-034', 'safeguard-technology-088', 'safeguard-technology-032', 'safeguard-technology-026']


key: chroma:document
string_value:
Contracts - Processor Contractual Obligations: Service providers/Processors are contractually required to:Not sell and share personal information. Not retain, use, or disclose personal information for any other business purpose, commercial purpose, or outside the direct business relationship except as permitted by the CCPA and Regs, and not combine data obtained from the business with other personal information; Require compliance with CCPA and Regs and notification to business if cannot comply; Grant business right to take reasonable and appropriate steps to (a) ensure using data in accordance with CCPA and Regs and (b) remediate unauthorized use; Comply with consumer requests; Ensure all personnel processing the personal data be subject to a duty of confidentiality; Engage a subcontractor after giving the controller an opportunity to object; Implement technical and organizational security measures; Return or delete all personal data at the end of the requested services; Allow for and contribute to reasonable audits; Ensure all subcontractors are under written agreement that obligates them to uphold the processor's obligations with respect to the personal data. Cooperate with reasonable assessments by the controller (or independent assessor), Implement appropriate technical and organizational security measures and establish clear implementation responsibilities between controller and processor. Stop processing data on request by the controller in connection with a consumer's authenticated request;


key: safeguard
string_value:
['safeguard-technology-136', 'safeguard-process-099', 'safeguard-technology-027', 'safeguard-technology-026', 'safeguard-process-071', 'safeguard-process-067', 'safeguard-policy-030', 'safeguard-technology-032', 'safeguard-technology-088']


key: chroma:document
string_value:
Contracts - Processor Obligations - Non-Contractual: A service provider/Processor must:For advertising or marketing, not combine the personal information of opted-out consumers that the service provider receives from the buisness with personal information that the service provider receives from/on behalf of another person or collects from its own interaction with consumers; Not contract with a controller to provide cross-contextual behavioral advertising; Notify the business if it engages any other person to assist in processing personal information, and engage that other person pursuant to a written contract that requires the person to observe the same requirements that the service provider must follow; Honor consumer requests received by the controller to limit the use of sensitive personal information; Adhere to the controller's instructions and assist the controller in meeting its statutory obligations; Take appropriate technical and organizational measures to assist the controller in responding to consumer rights requests; Assist controllers in meeting obligations regarding the security of processing and data breach notifications; Implement technical and organizational measures appropriate to the risk of processing and allocate responsibilities between the controller and processor; Adopt technical and physical Safeguards to protect the security and confidentiality of processed personal data;


key: chroma:document
string_value:
List of Third-Parties the Consumer's PI is disclosed to: Individuals are entitled to receive a list of specific third parties to whom the controller has disclosed personal information or any personal data.


key: chroma:document
string_value:
Best efforts to authenticate consumer: Make a reasonable effort to request that the consumer provide additional information reasonably necessary to authenticate the consumer


key: chroma:document
string_value:
Notice re: Basis of Denial : Require notice to consumer before denial of a right's request based on an inability to authenticate


key: chroma:document
string_value:
Free of Charge (Generally): Information must be given free of charge generally, unless "manifestly unfounded or excessive."


key: chroma:document
string_value:
Methods for exercising data subject rights must include one or more methods: Must establish secure and reliable means for exercising data rights and describe such means in privacy Policy


key: chroma:document
string_value:
Methods for exercising data subject rights must include two methods (one being a toll-free phone number unless exempted): One of two methods must be a toll-free number, and these methods must be described in privacy policy. If business maintains internet website, one method must be website. However, if business operates exclusively online and has direct relationship with consumers about whom it collects personal information - then the business may provide only an email address.


key: chroma:document
string_value:
Verification of data rights requests: Business must use commercially reasonable efforts to verify consumer identity 


key: chroma:document
string_value:
Consumer: Appeals: If the business denies a consumer request, it must inform the consumer of the reasons for not taking action and any right to appeal the decision to the business


key: chroma:document
string_value:
Procedural Requirement: Appeal process must be similar to the process consumers use to submit initial requests


key: chroma:document
string_value:
Consumer: Right to Access / Right to Know: The right to know (request disclosure of) personal information collected by the business about the consumer, from whom it was collected, why it was collected, and, if sold, to whom.


key: chroma:document
string_value:
Additional Obligation: Third Party Recipients: Consumers have the right to obtain list of third parties that received the consumer's data


key: chroma:document
string_value:
Inferred Data: As part of the right to know, consumers have the right to know the business’ internally generated inferences about that consumer, unless a business can demonstrate that a statutory exception applies.


key: chroma:document
string_value:
Consumer: Right to Correct: The right to ask businesses to correct inaccurate information that they have about you.


key: chroma:document
string_value:
Consumer: Right to Delete: The right to request that a business delete any personal information of the consumer (includes information "about" or "concerning" the consumer and information collected from the consumer)


key: chroma:document
string_value:
Disclosure of data retained and not deleted: If deletion is via opting out of processing, Controller must provide categories of personal data that were not deleted along with any applicable exception. Controller may also not use personal data retained for any secondary purpose


key: safeguard
string_value:
['safeguard-process-056', 'safeguard-policy-027', 'safeguard-process-050', 'safeguard-process-055', 'safeguard-process-051']


key: chroma:document
string_value:
Consumer: Right to Non-Discrimination: Right prohibits a business from discriminating against California consumers for exercising their rights under the law.


key: chroma:document
string_value:
Price Control: Businesses can not increase the cost or decrease the availablity of a product or service "based solely on the exercise of a right and unrelated to feasibility or the value of a service." 


key: chroma:document
string_value:
Consumer: Right to Portability: Right to request the specific pieces of personal information, in a format that is easily understandable and in a machine-readable which may also be transmitted to another entity at the consumer’s request.


key: chroma:document
string_value:
Limited Right to Portability: Only data that was provided by the consumer is covered by the portability right. 


key: chroma:document
string_value:
DSAR Third Party: Request to Delete: If the business obtains personal data from third parties, the business can respond to requests to delete in one of two ways: 1) by retaining a record of the deletion request and the minimum data required to ensure that the data remains deleted AND not using the retained data for other purposes. 2) by opting the consumer out of personal data processing for any purpose except those permitted by the statute.


key: chroma:document
string_value:
DSAR Training Requirements: Document & implement our training policies for US state privacy law compliance specific to consumer rights + sale/share requirements


key: chroma:document
string_value:
General personnel training regarding compliance with state privacy law : Establish, document, and comply with a training policy to ensure that all employees responsible for handling consumer requests or state law privacy compliance are informed of the law's requirements (if the business "knows or reasonably should know" that it, alone or in combination, buys, receives for the business's commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year).


key: chroma:document
string_value:
Training for employees on teams operationalizing consumer rights requirements: Inform employees responsible for handling the business's information practices or privacy compliance of the state privacy law's requirements and how to direct consumers to exercise their rights.


key: chroma:document
string_value:
DPIA Specifications: - Short summary of processing activity- Categories of personal data being processed (including sensitive data and personal data from a known child)- Context of the processing activity, including relationship between consumer and controller and reasonable expectations of consumers- Nature and operational elements (e.g., sources of personal data, Technology used, recipients, purpose for disclosure) of the processing activity (specificity to be determined by considering type, amount, and sensitivity of the personal data processed, impacts operational elements will have on risk of processing activity, and relevant unique relationships). - Core purposes of processing activity, including benefits to stakeholders and public- Source and nature of risks to the rights of consumers (e.g., unfair treatment, privacy harms, constitutional harms)- Measures and Safeguards business will employ to reduce identified risks (e.g., use of deidentified data)- Description of how benefits outweigh risks, as mitigated by Safeguards and considering the use of de-identified data, reasonable expectations of consumers, context of the processing and controller/consumer relationship- Relevant internal and external parties contributing to DPIA- Details regarding any internal or external audit in connection with the DPIA- Names, positions, signatures of approvers, and dates DPIA was reviewed and approvedIf processing sensitive data inferences subject to exception in Colorado Regulations, Rule 6.10 (e.g., processing would be obvious to reasonable consumer), DPIA must also include details of the process implemented to ensure that personal data and Sensitive Data Inferences are not transferred and are deleted within twenty-four (24) hours.


key: chroma:document
string_value:
DPIA Requirements Minors: - Purpose of the online service, product, or feature- Categories of minors' personal data that such online service, product or feature processes,"- Purposes for which controller processes minors' personal data- Reasonably foreseeable heightened risk(s) of harm to minors 


key: chroma:document
string_value:
DPIA Requirements Profiling : -Profiling when profiling presents a reasonably foreseeable risk of substantial injury to consumers (risks enumerated in statutes; includes unfair/deceptive treatment, disparate impact, financial/physical/reputational injury, unreasonable intrusion)- Specific types of personal data used- Decision being made using profiling- Benefits of automated processing over manual processing for purpose- Plain language explanation of why profiling directly and reasonably relates to goods/services- Explanation of training data and logic used to create profiling system, including statistics used in analysis- If profiling is conducted by third-party software, name of software and copies of internal or external evaluations sufficient to show accuracy and reliability- Plain language description of outputs- Plain language description of how outputs are used, including whether and how used to make decisions to: provide or deny financial or lending services, housing, insurance, education, enrollment or opportunity, criminal justic, employment opportunities, health-care services, access to essential goods/services - Degree and details of human involvement- Decription and results of evaluation for fairness and disparate impact- Safeguards used to reduce risk of identified harms, including for data sets produced or derived from profiling


key: chroma:document
string_value:
Privacy Policy Notice at or Before Collection (In Product): The business must give consumers notice at or before the point at which the business collects personal information from the consumer. This notice should include a number of statements, including:(1) A list of the categories of personal information about consumers, including categories of sensitive personal information to be collected(2) The purpose(s) of collection and processing(3) Whether each category of personal information is sold or shared(4) The length of time the business intends to retain each category of personal information (or if that is not possible, criteria to determine retention)(5) If the business sells or shares personal information, the link to the Notice of Right to Opt-out of Sale/Sharing(6) A link to the the business' privacy policy.(7) The notice must be made available in the languages that the business provides web pages and types of other information to consumers. (8) Categories of personal data processed(9) Processing purposes(10) Categories of data shared with third parties(11) Categories of third parties with whom data is shared(12) Methods for consumers to exercise their rights (13) Categories of personal data collected(14) An online mechanism where the business can be contacted(15) Statement on whether the business engages in targeted advertising or sharing as applicable(16) Method to opt out of targeted advertising or sharing as applicable(17) Statement on whether the business engages in profiling which results in legal/similarly significant effects(18) Date last updated 


key: chroma:document
string_value:
Privacy Policy : ByteDance's identity, which includes the business name ByteDance registered with the Secretary of State and any assumed business names


key: chroma:document
string_value:
Privacy Policy : Privacy Policy should be conspicuously posted online via a link that says "privacy" on controller's home page and should be available in printable format


key: chroma:document
string_value:
Privacy Policy : Privacy Policy must state whether the business has sold or shared personal information in previous 12 months and the categories shared, categories of third-party recipients, and business or commercial purposes and opt out method


key: chroma:document
string_value:
Privacy Policy : If business does not sell or share personal information, require business Privacy Policy to state that it does not sell or share personal information


key: chroma:document
string_value:
Privacy Policy : The privacy notice must include the "categories of sensitive data" that the controller processes and the categories of sensitive data shared with third parties. 


key: chroma:document
string_value:
Privacy Policy : The privacy notice must include whether the personal data of a child or other sensitive data is processed.The privacy notice must also include whether the business will delete sensitive data inferences within twelve (12) hours, a description of the sensitive data inferences and the retention and deletion timeline for such sensitive data inferences. 


key: chroma:document
string_value:
Privacy Policy : If applicable, the business must provide a statement on whether sensitive data is used or disclosed.


key: chroma:document
string_value:
Transparency Metrics : Businesses that buy, receive, sell, share, or make available the personal information of at least 10 million consumers in a calendar year must disclose additional transparency metrics. The business must compile the following metrics for the previous calendar year:(A) The number of requests to delete that ByteDance received, complied with in whole or in part, and denied;(B) The number of requests to correct that ByteDance received, complied with in whole or in part, and denied;(C) The number of requests to know that ByteDance received, complied with in whole or in part, and denied;(D) The number of requests to opt-out of sale/sharing that ByteDance received, complied with in whole or in part, and denied;(E) The number of requests to limit that ByteDance received, complied with in whole or in part, and denied; and(F) The median or mean number of days within which ByteDance substantively responded to requests to delete, requests to correct, requests to know, requests to opt-out of sale/sharing, and requests to limit.Before July 1 each year, ByteDance must include the information above in ByteDance's privacy policy or posted on ByteDance's website and accessible from a link included in ByteDance's privacy policy. If preferable, ByteDance may choose to compile and disclose the information above for requests received from all individuals, rather than requests received from consumers. If ByteDance does this, it must state whether it has done so in its disclosure and be prepared to compile and provide to the Attorney General the information above for requests received from consumers as needed.


key: chroma:document
string_value:
Privacy Policy : The business must disclose whether it processes personal data from children under the age of 13.


key: safeguard
string_value:
['safeguard-process-001', 'safeguard-people-003', 'safeguard-technology-006', 'safeguard-process-004', 'safeguard-technology-004']


key: safeguard
string_value:
['safeguard-technology-001', 'safeguard-technology-003', 'safeguard-policy-001', 'safeguard-process-002', 'safeguard-policy-003']


key: chroma:document
string_value:
APP Privacy Policy: Have a clear and up to date Privacy Policy that contains all required statutory items.


key: chroma:document
string_value:
Availability of APP Privacy Policy: Have a clear and up to date Privacy Policy that is easily available to individuals.


key: chroma:document
string_value:
Availability of APP Privacy Policy: Take reasonable steps to give an individual a copy of the Privacy Policy if requested. 


key: chroma:document
string_value:
Automated decisions  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : If personal information is used in connection with automated decision-making (i.e. a computer program is used to make, or do a thing directly related to making, a decision), and the decision could significantly affect the rights or interests of an individual, the organisation's Privacy Policy must contain information about (a) the kinds of personal information used in the automated decision-making; and (b) the kinds of decisions made using automated decision-making.


key: chroma:document
string_value:
Anonymity and pseudonymity: Provide individuals with the option of not identifying themselves (or using a pseudonym) unless its impracticable to do so or prevented by law.


key: chroma:document
string_value:
Personal information other than sensitive information: Only collect personal information (other than sensitive information) if the collection is reasonably necessary for a function or activity of the organisation. 


key: chroma:document
string_value:
Sensitive information : Do not collect sensitive information unless (a) the individual provides their consent to the collection and the collection is reasonably necessary for a function or activity of the organisation OR (b) another permitted legal basis exists for the collection.


key: safeguard
string_value:
['safeguard-technology-009', 'safeguard-policy-005', 'safeguard-technology-010', 'safeguard-process-005']


key: chroma:document
string_value:
Means of collection: Only collect personal information from the individual (and not a third party) unless its impracticable or unreasonable.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-012', 'safeguard-technology-013', 'safeguard-policy-004']


key: chroma:document
string_value:
Dealing with unsolicited personal information : If unsolicited personal information is received, determine within a reasonable time whether or not that personal information could have been legally collected by the organisation. 


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-012', 'safeguard-policy-020', 'safeguard-technology-013', 'safeguard-policy-004']


key: chroma:document
string_value:
Dealing with unsolicited personal information : If unsolicited personal information is received that the organisation couldn't have legally collected, destroy or de-identify the personal information as soon as practicable.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002', 'safeguard-policy-004']


key: chroma:document
string_value:
Notification of the collection of personal information: Provide an individual with a collection notification at, before the time, or as soon as practicable after collecting their personal information.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-policy-001', 'safeguard-process-002', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-policy-002', 'safeguard-policy-004']


key: chroma:document
string_value:
Notification of the collection of personal information: Collection notifications provided to individuals must contain all required statutory items.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-process-059', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-technology-032', 'safeguard-policy-011', 'safeguard-technology-088']


key: chroma:document
string_value:
Use or disclosure of personal information: Only use or disclose personal information (other than sensitive information) (a) for the purpose it was collected, OR (b) for a related purpose where the individual reasonably expects the information to be used for that purpose OR (c) another legal basis exists.


key: chroma:document
string_value:
Use or disclosure of sensitive information: Only use or disclose sensitive information (a) for the purpose it was collected, OR (b) for a directly related purpose where the individual reasonably expects the information to be used for that purpose OR (c) another legal basis exists.


key: chroma:document
string_value:
Written note of use or disclosure: If required to use/disclose personal information for one or more enforcement related activities, make a written note of the use or disclosure. 


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-010', 'safeguard-policy-011', 'safeguard-technology-032', 'safeguard-process-017']


key: chroma:document
string_value:
Related bodies corporate: Where the organisation collects personal information from a related body corporate, the purpose of collection is the same for both companies.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Direct marketing of personal information collected from the individual: Only use or disclose personal information (other than sensitive information) collected from a third party where the individual (a) has consented to direct marketing and (b) the individual is given a simple means to opt-out of receiving direct marketing comms, (c) a prominent statement is included in each direct marketing comms that the individual can withdraw their consent and (d) the individual has not opted out of direct marketing comms.


key: chroma:document
string_value:
Direct marketing of personal information collected from the individual: Only use or disclose personal information (other than sensitive information) collected from the individual where the individual has given their consent OR the individual (a) reasonably expects the organisation to use or disclose it for direct marketing, (b) has been given a simple means to opt-out of receiving direct marketing comms and (c) has not previously opted out of direct marketing comms. 


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Exceptions : Only use or disclose sensitive information where the individual has given their consent to direct marketing.


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-125', 'safeguard-policy-027', 'safeguard-policy-001', 'safeguard-technology-138', 'safeguard-process-003', 'safeguard-process-050', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Individual may request not to receive direct marketing communications etc. : Individuals must be able to request to opt-out of direct marketing comms from the organisation


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-124', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-137', 'safeguard-technology-125', 'safeguard-policy-027', 'safeguard-policy-001', 'safeguard-technology-138', 'safeguard-process-003', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002', 'safeguard-process-133']


key: chroma:document
string_value:
Individual may request not to receive direct marketing communications facilitating direct marketing by another organisation: If the organisation facilitates direct marketing by another organisation, individuals must be able to request to opt-out of direct marketing comms from that other organisation and request the organisation provides information about the source of the personal information.


key: safeguard
string_value:
['safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Individual may request not to receive direct marketing communications etc.: Give effect to a direct marketing opt-out request within a reasonable period of time. Do not charge an individual to opt out of direct marketing. 


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Individual may request not to receive direct marketing communications etc.: If the organisation facilitates direct marketing by another organisation, give effect to requests for sources of personal information within a reasonable period of time unless impracticable or unreasonable. Do not charge an individual to give effect to a request to provide its source of personal information.


key: safeguard
string_value:
['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-014', 'safeguard-policy-042', 'safeguard-technology-129', 'safeguard-policy-013']


key: chroma:document
string_value:
Cross-border disclosure of personal information: Only disclose personal information to a recipient outside Australia if (a) the organisation has taken reasonable steps to ensure that the recipient complies with the APPs or (b) another legal basis applies (see APP 8.2 and 8.3 below).


key: safeguard
string_value:
['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-042', 'safeguard-policy-014', 'safeguard-policy-013']


key: chroma:document
string_value:
Cross-border disclosure of personal information: The organisation can disclose personal information to a recipient outside Australia if (a) the recipient is subject to privacy laws that are substantially similar to the Privacy Act and APP's and the individual can take action to enforce those laws, or (b) the individual has been informed APP 8.1 does not apply to the disclosure and they consent to the disclosure; or (c) another legal basis applies (such as 8.3 below).


key: chroma:document
string_value:
Cross-border disclosure of personal information  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : The organisation can disclose personal information to a recipient outside Australia if (a) the recipient is subject to the laws of a country that is prescribed by the regulations, or (b) the recipient is a participant in a binding scheme that is prescribed by the regulations and (c) any other conditions prescribed under the regulations are satisfied.


key: chroma:document
string_value:
Adoption of government related identifiers: Do not adopt a government related identifier of an individual for own purposes.


key: chroma:document
string_value:
Use or disclosure of government related identifiers: Do not use or disclose a government related identifier unless a statutory exemption applies. 


key: safeguard
string_value:
['safeguard-process-036', 'safeguard-technology-051', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047']


key: chroma:document
string_value:
Quality of personal information: Take reasonable steps to ensure the personal information that is collected is accurate, up-to-date and complete. 


key: safeguard
string_value:
['safeguard-process-036', 'safeguard-technology-046', 'safeguard-technology-051', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047']


key: chroma:document
string_value:
Quality of personal information: Take reasonable steps to ensure the personal information that is used or disclosed is accurate, up-to-date, complete and relevant.


key: chroma:document
string_value:
Security of personal information : Take reasonable steps (including technical and organisational measures) to protect personal information from misuse, interference, loss, unauthorised access, unauthorised modification, unauthorised disclosure. 


key: safeguard
string_value:
['safeguard-process-016', 'safeguard-technology-017', 'safeguard-policy-008', 'safeguard-technology-020', 'safeguard-technology-024']


key: chroma:document
string_value:
Security of personal information  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : Take reasonable steps (including technical and organisational measures) to destroy or de-identify personal information that isn't needed for any purpose for which it may be used or disclosed under the APPs and is not required to be retained under law.


key: safeguard
string_value:
['safeguard-policy-027', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-077', 'safeguard-process-051']


key: chroma:document
string_value:
Access to personal information: Give individuals access to their personal information on request unless the request is frivolous or vexatious; it would have an unreasonable impact on the privacy of others; it reveals information in connection with a commercially sensitive decision-making process; the information relates to legal proceedings or negotiations between the organisation and the individual; or another legal exception applies.


key: safeguard
string_value:
['safeguard-process-050', 'safeguard-technology-077', 'safeguard-technology-084', 'safeguard-policy-027']


key: chroma:document
string_value:
Dealing with requests for access: Respond to a request from an individual to access their personal information within a reasonable period. Give access to the information in the manner requested if reasonable and practicable.


key: chroma:document
string_value:
Other means of access: If the organisation refuses to give access to personal information in a particular manner, take reasonable steps to give access in a way that meets the needs of the organisation and the individual. 


key: chroma:document
string_value:
Access charges: If charging an individual for giving access to personal information, do not make the charge excessive and do not charge for the act of making of the request.


key: chroma:document
string_value:
Refusal to give access: If the organisation refuses to give access to the personal information, provide a written notice to the individual that complies with the statutory requirements.


key: chroma:document
string_value:
Refusal to give access: If the organisation is refusing to give access to the personal information because access would reveal evaluative information in connection with commercially sensitive decisions, the reasons for the refusal may include an explanation for the commercially sensitive decision.


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-process-050', 'safeguard-policy-019']


key: chroma:document
string_value:
Correction: Take reasonable steps to correct personal information (to ensure it is accurate, up to date, complete, relevant and not misleading) where an individual requests the personal information be corrected. 


key: safeguard
string_value:
['safeguard-process-036', 'safeguard-technology-096', 'safeguard-technology-051', 'safeguard-technology-094', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047', 'safeguard-technology-093', 'safeguard-technology-045', 'safeguard-process-046']


key: chroma:document
string_value:
Correction: The organisation must take reasonable steps to correct personal information that, having regard to a purpose for which the personal information is held, is inaccurate, out of date, incomplete, irrelevant or misleading.


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-policy-019', 'safeguard-process-050', 'safeguard-process-133']


key: chroma:document
string_value:
Notification of correction to third parties: If an individual requests a correction to their personal information that the organisation has previously disclosed to another organisation and the individual requests the organisation notify that organisation of the correction, the organisation must take reasonable steps to notify them of the correction request unless impracticable or unlawful to do so.


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-technology-084', 'safeguard-policy-019', 'safeguard-process-050']


key: chroma:document
string_value:
Refusal to correct information: If the organisation refuses to correct personal information, must provide a written notice to the individual setting out statutory details.


key: chroma:document
string_value:
Request to associate a statement: If the organisation refuses to correct personal information and the individual requests a statement the information is not right, include a statement so that is apparent to users of the information.


key: chroma:document
string_value:
Dealing with requests: Respond to an individual's request to correct personal information within a reasonable period. 


key: chroma:document
string_value:
Dealing with requests: Do not charge the individual for correcting personal information or making a request to correct personal information.


key: safeguard
string_value:
['safeguard-process-100', 'safeguard-policy-050', 'safeguard-technology-133', 'safeguard-process-101']


key: chroma:document
string_value:
Notification of eligible data breaches: Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if there are reasonable grounds to believe that an eligible data breach has happened (or if the OAIC directs the organisation to notify).


key: chroma:document
string_value:
Assessment of suspected eligible data breach: Where the organisation has reasonable grounds to suspect there may be an eligible data breach but is not yet aware of reasonable grounds to believe there is an eligible data breach, take all reasonable steps to complete (within 30 days) a reasonable and expeditious assessment of whether an eligible data breach may have occurred in accordance with statutory requirements.


key: safeguard
string_value:
['safeguard-policy-050', 'safeguard-process-103', 'safeguard-technology-132', 'safeguard-process-105', 'safeguard-process-101']


key: chroma:document
string_value:
Statement about eligible data breach: Where the organisation has reasonable grounds to believe there has been an eligible data breach, the organisation must give a statement about the eligible data breach to the OAIC that meets the statutory requirements, as soon as practicable after becoming aware of the eligible data breach.


key: chroma:document
string_value:
Entity must notify eligible data breach: Where the organisation has reasonable grounds to believe there been have been an eligible data breach, and the organisation has provided a statement about the eligible data breach to the OAIC, the organisation should take reasonable steps to notify the contents of the statement to each of the individuals at risk from the eligible data breach.


