# migrations

dir: embeddings_queue
filename: 00001-embeddings.sqlite.sql
hash: d3755dfd232be8e8301f4d7fcfb3a486
sql:
CREATE TABLE embeddings_queue (
    seq_id INTEGER PRIMARY KEY,
    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    operation INTEGER NOT NULL,
    topic TEXT NOT NULL,
    id TEXT NOT NULL,
    vector BLOB,
    encoding TEXT,
    metadata TEXT
);


dir: sysdb
filename: 00001-collections.sqlite.sql
hash: 38352d725ad1c16074fac420b22b4633
sql:
CREATE TABLE collections (
    id TEXT PRIMARY KEY,
    name TEXT NOT NULL,
    topic TEXT NOT NULL,
    UNIQUE (name)
);

CREATE TABLE collection_metadata (
    collection_id TEXT REFERENCES collections(id) ON DELETE CASCADE,
    key TEXT NOT NULL,
    str_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (collection_id, key)
);


dir: sysdb
filename: 00002-segments.sqlite.sql
hash: 2913cb6a503055a95f625448037e8912
sql:
CREATE TABLE segments (
    id TEXT PRIMARY KEY,
    type TEXT NOT NULL,
    scope TEXT NOT NULL,
    topic TEXT,
    collection TEXT REFERENCES collection(id)
);

CREATE TABLE segment_metadata (
    segment_id TEXT  REFERENCES segments(id) ON DELETE CASCADE,
    key TEXT NOT NULL,
    str_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (segment_id, key)
);


dir: sysdb
filename: 00004-tenants-databases.sqlite.sql
hash: 048867ce8fcdefe4023c7110e4433591
sql:
CREATE TABLE IF NOT EXISTS tenants (
    id TEXT PRIMARY KEY,
    UNIQUE (id)
);

CREATE TABLE IF NOT EXISTS databases (
    id TEXT PRIMARY KEY, -- unique globally
    name TEXT NOT NULL, -- unique per tenant
    tenant_id TEXT NOT NULL REFERENCES tenants(id) ON DELETE CASCADE,
    UNIQUE (tenant_id, name) -- Ensure that a tenant has only one database with a given name
);

CREATE TABLE IF NOT EXISTS collections_tmp (
    id TEXT PRIMARY KEY, -- unique globally
    name TEXT NOT NULL, -- unique per database
    topic TEXT NOT NULL,
    dimension INTEGER,
    database_id TEXT NOT NULL REFERENCES databases(id) ON DELETE CASCADE,
    UNIQUE (name, database_id)
);

-- Create default tenant and database
INSERT OR REPLACE INTO tenants (id) VALUES ('default_tenant'); -- The default tenant id is 'default_tenant' others are UUIDs
INSERT OR REPLACE INTO databases (id, name, tenant_id) VALUES ('00000000-0000-0000-0000-000000000000', 'default_database', 'default_tenant');

INSERT OR REPLACE INTO collections_tmp (id, name, topic, dimension, database_id)
    SELECT id, name, topic, dimension, '00000000-0000-0000-0000-000000000000' FROM collections;
DROP TABLE collections;
ALTER TABLE collections_tmp RENAME TO collections;


dir: sysdb
filename: 00005-remove-topic.sqlite.sql
hash: b1367c826b8fba5f96f27befdc1d42d2
sql:
-- Remove the topic column from the Collections and Segments tables

ALTER TABLE collections DROP COLUMN topic;
ALTER TABLE segments DROP COLUMN topic;


dir: sysdb
filename: 00006-collection-segment-metadata.sqlite.sql
hash: 4eea7468935bf25d4604a0fed2366116
sql:
-- SQLite does not support adding check with alter table, as a result, adding a check
-- involve creating a new table and copying the data over. It is over kill with adding
-- a boolean type column. The application write to the table needs to ensure the data
-- integrity.
ALTER TABLE collection_metadata ADD COLUMN bool_value INTEGER;
ALTER TABLE segment_metadata ADD COLUMN bool_value INTEGER;


dir: sysdb
filename: 00007-collection-config.sqlite.sql
hash: 1c7e63bba346a42a18b6ab7f1c989bed
sql:
-- Stores collection configuration dictionaries.
ALTER TABLE collections ADD COLUMN config_json_str TEXT;


dir: sysdb
filename: 00008-maintenance-log.sqlite.sql
hash: 0a0e7e93111a01789addf64961c6127c
sql:
-- Records when database maintenance operations are performed.
-- At time of creation, this table is only used to record vacuum operations.
CREATE TABLE maintenance_log (
  id INT PRIMARY KEY,
  timestamp INT NOT NULL,
  operation TEXT NOT NULL
);


dir: sysdb
filename: 00009-segment-collection-not-null.sqlite.sql
hash: 054355aef9e63702bf54ea29e61563f1
sql:
-- This makes segments.collection non-nullable.
CREATE TABLE segments_temp (
    id TEXT PRIMARY KEY,
    type TEXT NOT NULL,
    scope TEXT NOT NULL,
    collection TEXT REFERENCES collection(id) NOT NULL
);

INSERT INTO segments_temp SELECT * FROM segments;
DROP TABLE segments;
ALTER TABLE segments_temp RENAME TO segments;


dir: metadb
filename: 00001-embedding-metadata.sqlite.sql
hash: 2b4cf52c4bb2676e21d6860a4409f856
sql:
CREATE TABLE embeddings (
    id INTEGER PRIMARY KEY,
    segment_id TEXT NOT NULL,
    embedding_id TEXT NOT NULL,
    seq_id BLOB NOT NULL,
    created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
    UNIQUE (segment_id, embedding_id)
);

CREATE TABLE embedding_metadata (
    id INTEGER REFERENCES embeddings(id),
    key TEXT NOT NULL,
    string_value TEXT,
    int_value INTEGER,
    float_value REAL,
    PRIMARY KEY (id, key)
);

CREATE TABLE max_seq_id (
    segment_id TEXT PRIMARY KEY,
    seq_id BLOB NOT NULL
);

CREATE VIRTUAL TABLE embedding_fulltext USING fts5(id, string_value);


dir: metadb
filename: 00002-embedding-metadata.sqlite.sql
hash: 12a570f7121b3a8ce750a2a7c36da20f
sql:
-- SQLite does not support adding check with alter table, as a result, adding a check
-- involve creating a new table and copying the data over. It is over kill with adding
-- a boolean type column. The application write to the table needs to ensure the data
-- integrity.
ALTER TABLE embedding_metadata ADD COLUMN bool_value INTEGER


dir: metadb
filename: 00003-full-text-tokenize.sqlite.sql
hash: f97ad6334aeaa8f419f01110b648b97a
sql:
CREATE VIRTUAL TABLE embedding_fulltext_search USING fts5(string_value, tokenize='trigram');
INSERT INTO embedding_fulltext_search (rowid, string_value) SELECT rowid, string_value FROM embedding_metadata;
DROP TABLE embedding_fulltext;


dir: metadb
filename: 00004-metadata-indices.sqlite.sql
hash: fb36603a45ee2cd0254cef3ef86585e8
sql:
CREATE INDEX IF NOT EXISTS embedding_metadata_int_value ON embedding_metadata (key, int_value) WHERE int_value IS NOT NULL;
CREATE INDEX IF NOT EXISTS embedding_metadata_float_value ON embedding_metadata (key, float_value) WHERE float_value IS NOT NULL;
CREATE INDEX IF NOT EXISTS embedding_metadata_string_value ON embedding_metadata (key, string_value) WHERE string_value IS NOT NULL;


# embeddings_queue

created_at: 2025-02-27 07:35:51
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 81ad5fb0-80bd-4e86-b322-9dd208d6312e
encoding: FLOAT32
metadata:
{"index": 0, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-process-001', 'safeguard-people-003', 'safeguard-technology-006', 'safeguard-process-004', 'safeguard-technology-004']", "chroma:document": "Compliance with the APPs : Take reasonable steps to comply with Privacy Act requirements."}


created_at: 2025-02-27 07:35:52
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 6aaa1c32-782d-4935-b55c-a3cb0af27e1b
encoding: FLOAT32
metadata:
{"index": 1, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-technology-001', 'safeguard-technology-003', 'safeguard-policy-001', 'safeguard-process-002', 'safeguard-policy-003']", "chroma:document": "APP Privacy Policy: Have a clear and up to date Privacy Policy."}


created_at: 2025-02-27 07:35:54
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 5c24362f-12ee-4b41-a64e-5a0da0766bf4
encoding: FLOAT32
metadata:
{"index": 2, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-technology-001', 'safeguard-policy-001']", "chroma:document": "APP Privacy Policy: Have a clear and up to date Privacy Policy that contains all required statutory items."}


created_at: 2025-02-27 07:35:56
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: f47d8e29-8ffb-4e0e-b3a2-2f2546a35971
encoding: FLOAT32
metadata:
{"index": 3, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-technology-086', 'safeguard-technology-001']", "chroma:document": "Availability of APP Privacy Policy: Have a clear and up to date Privacy Policy that is easily available to individuals."}


created_at: 2025-02-27 07:35:58
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 71ad3b6b-2d2f-43a9-ac27-abcd08917f3a
encoding: FLOAT32
metadata:
{"index": 4, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-policy-001']", "chroma:document": "Availability of APP Privacy Policy: Take reasonable steps to give an individual a copy of the Privacy Policy if requested. "}


created_at: 2025-02-27 07:36:00
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: a5b64acd-26a1-435e-a7d8-7a9bfe228785
encoding: FLOAT32
metadata:
{"index": 5, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-technology-075', 'safeguard-technology-078']", "chroma:document": "Automated decisions  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : If personal information is used in connection with automated decision-making (i.e. a computer program is used to make, or do a thing directly related to making, a decision), and the decision could significantly affect the rights or interests of an individual, the organisation's Privacy Policy must contain information about (a) the kinds of personal information used in the automated decision-making; and (b) the kinds of decisions made using automated decision-making."}


created_at: 2025-02-27 07:36:01
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 22d9af29-41ae-423c-aab4-38d6f69e9230
encoding: FLOAT32
metadata:
{"index": 6, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-policy-027']", "chroma:document": "Anonymity and pseudonymity: Provide individuals with the option of not identifying themselves (or using a pseudonym) unless its impracticable to do so or prevented by law."}


created_at: 2025-02-27 07:36:03
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 02189166-8294-45cd-b66e-f4f8601fdbdb
encoding: FLOAT32
metadata:
{"index": 7, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-technology-010', 'safeguard-policy-004', 'safeguard-process-005']", "chroma:document": "Personal information other than sensitive information: Only collect personal information (other than sensitive information) if the collection is reasonably necessary for a function or activity of the organisation. "}


created_at: 2025-02-27 07:36:05
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: e307615c-b7ca-4e91-b084-87ff40611230
encoding: FLOAT32
metadata:
{"index": 8, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-005', 'safeguard-process-005']", "chroma:document": "Sensitive information : Do not collect sensitive information unless (a) the individual provides their consent to the collection and the collection is reasonably necessary for a function or activity of the organisation OR (b) another permitted legal basis exists for the collection."}


created_at: 2025-02-27 07:36:07
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 630a8bc7-1884-4bbc-87bb-4b7cbabf2281
encoding: FLOAT32
metadata:
{"index": 9, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-technology-009', 'safeguard-policy-005', 'safeguard-technology-010', 'safeguard-process-005']", "chroma:document": "Means of collection: Only collect personal information by lawful and fair means."}


created_at: 2025-02-27 07:36:09
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: a139222b-15ed-457a-9715-1414a7098047
encoding: FLOAT32
metadata:
{"index": 10, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-process-006', 'safeguard-process-005']", "chroma:document": "Means of collection: Only collect personal information from the individual (and not a third party) unless its impracticable or unreasonable."}


created_at: 2025-02-27 07:36:10
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 50868713-4ff6-4042-a8ba-fbac20009d16
encoding: FLOAT32
metadata:
{"index": 11, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-012', 'safeguard-technology-013', 'safeguard-policy-004']", "chroma:document": "Dealing with unsolicited personal information : If unsolicited personal information is received, determine within a reasonable time whether or not that personal information could have been legally collected by the organisation. "}


created_at: 2025-02-27 07:36:12
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 174a182a-f4ce-49a0-b5b8-78b4264275b0
encoding: FLOAT32
metadata:
{"index": 12, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-012', 'safeguard-policy-020', 'safeguard-technology-013', 'safeguard-policy-004']", "chroma:document": "Dealing with unsolicited personal information : If unsolicited personal information is received that the organisation couldn't have legally collected, destroy or de-identify the personal information as soon as practicable."}


created_at: 2025-02-27 07:36:14
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 5926b522-706c-421c-aa0e-73cf21e4b3e7
encoding: FLOAT32
metadata:
{"index": 13, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002', 'safeguard-policy-004']", "chroma:document": "Notification of the collection of personal information: Provide an individual with a collection notification at, before the time, or as soon as practicable after collecting their personal information."}


created_at: 2025-02-27 07:36:16
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 29b2b965-2e01-4b75-833d-f92725dba30e
encoding: FLOAT32
metadata:
{"index": 14, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-policy-001', 'safeguard-process-002', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-policy-002', 'safeguard-policy-004']", "chroma:document": "Notification of the collection of personal information: Collection notifications provided to individuals must contain all required statutory items."}


created_at: 2025-02-27 07:36:18
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 0653023f-bf29-4901-a1a5-95142669d62c
encoding: FLOAT32
metadata:
{"index": 15, "version": 2, "PO": "['data minimization & purpose limitation', 'data sharing']", "safeguard": "['safeguard-policy-007', 'safeguard-process-059', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-technology-032', 'safeguard-policy-011', 'safeguard-technology-088']", "chroma:document": "Use or disclosure of personal information: Only use or disclose personal information (other than sensitive information) (a) for the purpose it was collected, OR (b) for a related purpose where the individual reasonably expects the information to be used for that purpose OR (c) another legal basis exists."}


created_at: 2025-02-27 07:36:19
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 05e3ab84-77c8-4d79-bbfc-ad15ddd1a19a
encoding: FLOAT32
metadata:
{"index": 16, "version": 2, "PO": "['data minimization & purpose limitation', 'data sharing']", "safeguard": "['safeguard-policy-007', 'safeguard-process-059', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-technology-032', 'safeguard-policy-011', 'safeguard-technology-088']", "chroma:document": "Use or disclosure of sensitive information: Only use or disclose sensitive information (a) for the purpose it was collected, OR (b) for a directly related purpose where the individual reasonably expects the information to be used for that purpose OR (c) another legal basis exists."}


created_at: 2025-02-27 07:36:21
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 09259d22-7d3b-4ba4-a930-5feb1580c287
encoding: FLOAT32
metadata:
{"index": 17, "version": 2, "PO": "['data sharing']", "safeguard": "['safeguard-policy-047', 'safeguard-policy-011', 'safeguard-process-062']", "chroma:document": "Written note of use or disclosure: If required to use/disclose personal information for one or more enforcement related activities, make a written note of the use or disclosure. "}


created_at: 2025-02-27 07:36:23
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 0b25937c-afbd-4553-a672-2d3ae197585c
encoding: FLOAT32
metadata:
{"index": 18, "version": 2, "PO": "['data minimization & purpose limitation', 'data sharing']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-010', 'safeguard-policy-011', 'safeguard-technology-032', 'safeguard-process-017']", "chroma:document": "Related bodies corporate: Where the organisation collects personal information from a related body corporate, the purpose of collection is the same for both companies."}


created_at: 2025-02-27 07:36:25
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 779dc093-7ee4-46e1-9aab-bfd91e08fcc7
encoding: FLOAT32
metadata:
{"index": 19, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Direct marketing of personal information collected from the individual: Only use or disclose personal information (other than sensitive information) collected from a third party where the individual (a) has consented to direct marketing and (b) the individual is given a simple means to opt-out of receiving direct marketing comms, (c) a prominent statement is included in each direct marketing comms that the individual can withdraw their consent and (d) the individual has not opted out of direct marketing comms."}


created_at: 2025-02-27 07:36:27
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: b8f0ccb2-ccb4-4508-b392-8b8f9c5a62ab
encoding: FLOAT32
metadata:
{"index": 20, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Direct marketing of personal information collected from the individual: Only use or disclose personal information (other than sensitive information) collected from the individual where the individual has given their consent OR the individual (a) reasonably expects the organisation to use or disclose it for direct marketing, (b) has been given a simple means to opt-out of receiving direct marketing comms and (c) has not previously opted out of direct marketing comms. "}


created_at: 2025-02-27 07:36:28
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 35f6af39-3504-4afd-afb5-7630da1b7abd
encoding: FLOAT32
metadata:
{"index": 21, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Exceptions : Only use or disclose sensitive information where the individual has given their consent to direct marketing."}


created_at: 2025-02-27 07:36:30
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 28564482-0068-4f8d-9929-26cf9012290f
encoding: FLOAT32
metadata:
{"index": 22, "version": 2, "PO": "['transparency', 'individual rights']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-125', 'safeguard-policy-027', 'safeguard-policy-001', 'safeguard-technology-138', 'safeguard-process-003', 'safeguard-process-050', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Individual may request not to receive direct marketing communications etc. : Individuals must be able to request to opt-out of direct marketing comms from the organisation"}


created_at: 2025-02-27 07:36:32
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 8b78c57b-f83d-4fe0-be7f-c74bb2adcb79
encoding: FLOAT32
metadata:
{"index": 23, "version": 2, "PO": "['transparency', 'individual rights']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-124', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-137', 'safeguard-technology-125', 'safeguard-policy-027', 'safeguard-policy-001', 'safeguard-technology-138', 'safeguard-process-003', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002', 'safeguard-process-133']", "chroma:document": "Individual may request not to receive direct marketing communications facilitating direct marketing by another organisation: If the organisation facilitates direct marketing by another organisation, individuals must be able to request to opt-out of direct marketing comms from that other organisation and request the organisation provides information about the source of the personal information."}


created_at: 2025-02-27 07:36:34
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 4a04a804-7ffa-416d-a8ec-282d70c03275
encoding: FLOAT32
metadata:
{"index": 24, "version": 2, "PO": "['transparency']", "safeguard": "['safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Individual may request not to receive direct marketing communications etc.: Give effect to a direct marketing opt-out request within a reasonable period of time. Do not charge an individual to opt out of direct marketing. "}


created_at: 2025-02-27 07:36:36
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 2c0066f0-085b-4aa5-9483-1ca43d93db39
encoding: FLOAT32
metadata:
{"index": 25, "version": 2, "PO": "['data minimization & purpose limitation', 'transparency']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']", "chroma:document": "Individual may request not to receive direct marketing communications etc.: If the organisation facilitates direct marketing by another organisation, give effect to requests for sources of personal information within a reasonable period of time unless impracticable or unreasonable. Do not charge an individual to give effect to a request to provide its source of personal information."}


created_at: 2025-02-27 07:36:38
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: ef2c0514-0ee8-417e-b278-aabeee1edce1
encoding: FLOAT32
metadata:
{"index": 26, "version": 2, "PO": "['data sharing']", "safeguard": "['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-014', 'safeguard-policy-042', 'safeguard-technology-129', 'safeguard-policy-013']", "chroma:document": "Cross-border disclosure of personal information: Only disclose personal information to a recipient outside Australia if (a) the organisation has taken reasonable steps to ensure that the recipient complies with the APPs or (b) another legal basis applies (see APP 8.2 and 8.3 below)."}


created_at: 2025-02-27 07:36:39
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: ebe01994-51f1-443b-bfd8-21b2b279b823
encoding: FLOAT32
metadata:
{"index": 27, "version": 2, "PO": "['data sharing']", "safeguard": "['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-042', 'safeguard-policy-014', 'safeguard-policy-013']", "chroma:document": "Cross-border disclosure of personal information: The organisation can disclose personal information to a recipient outside Australia if (a) the recipient is subject to privacy laws that are substantially similar to the Privacy Act and APP's and the individual can take action to enforce those laws, or (b) the individual has been informed APP 8.1 does not apply to the disclosure and they consent to the disclosure; or (c) another legal basis applies (such as 8.3 below)."}


created_at: 2025-02-27 07:36:41
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 6253b17e-7646-4881-87e7-977815db0f85
encoding: FLOAT32
metadata:
{"index": 28, "version": 2, "PO": "['data sharing']", "safeguard": "['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-042', 'safeguard-policy-014', 'safeguard-policy-013']", "chroma:document": "Cross-border disclosure of personal information  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : The organisation can disclose personal information to a recipient outside Australia if (a) the recipient is subject to the laws of a country that is prescribed by the regulations, or (b) the recipient is a participant in a binding scheme that is prescribed by the regulations and (c) any other conditions prescribed under the regulations are satisfied."}


created_at: 2025-02-27 07:36:43
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 88b3fdf5-2bfc-4698-b1a6-ba8f71d30402
encoding: FLOAT32
metadata:
{"index": 29, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-010']", "chroma:document": "Adoption of government related identifiers: Do not adopt a government related identifier of an individual for own purposes."}


created_at: 2025-02-27 07:36:45
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: b10e8fef-17ce-4d22-bfc6-b44864095f0e
encoding: FLOAT32
metadata:
{"index": 30, "version": 2, "PO": "['data minimization & purpose limitation']", "safeguard": "['safeguard-policy-007', 'safeguard-technology-010']", "chroma:document": "Use or disclosure of government related identifiers: Do not use or disclose a government related identifier unless a statutory exemption applies. "}


created_at: 2025-02-27 07:36:47
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 8c63084e-4dd7-4614-a6fa-234291531346
encoding: FLOAT32
metadata:
{"index": 31, "version": 2, "PO": "['data accuracy']", "safeguard": "['safeguard-process-036', 'safeguard-technology-051', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047']", "chroma:document": "Quality of personal information: Take reasonable steps to ensure the personal information that is collected is accurate, up-to-date and complete. "}


created_at: 2025-02-27 07:36:48
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 41e982bd-3e80-4ef5-bb37-9113d98c9c6f
encoding: FLOAT32
metadata:
{"index": 32, "version": 2, "PO": "['data accuracy']", "safeguard": "['safeguard-process-036', 'safeguard-technology-046', 'safeguard-technology-051', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047']", "chroma:document": "Quality of personal information: Take reasonable steps to ensure the personal information that is used or disclosed is accurate, up-to-date, complete and relevant."}


created_at: 2025-02-27 07:36:50
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 310ac335-895d-451b-b3e9-62ad7c08efb1
encoding: FLOAT32
metadata:
{"index": 33, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-technology-135']", "chroma:document": "Security of personal information : Take reasonable steps (including technical and organisational measures) to protect personal information from misuse, interference, loss, unauthorised access, unauthorised modification, unauthorised disclosure. "}


created_at: 2025-02-27 07:36:52
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: a6ba9e8d-e523-4377-9b88-39080ce2511a
encoding: FLOAT32
metadata:
{"index": 34, "version": 2, "PO": "['data retention']", "safeguard": "['safeguard-process-016', 'safeguard-technology-017', 'safeguard-policy-008', 'safeguard-technology-020', 'safeguard-technology-024']", "chroma:document": "Security of personal information  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : Take reasonable steps (including technical and organisational measures) to destroy or de-identify personal information that isn't needed for any purpose for which it may be used or disclosed under the APPs and is not required to be retained under law."}


created_at: 2025-02-27 07:36:54
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: a660c612-5891-4cbc-b10a-e4771b6c1728
encoding: FLOAT32
metadata:
{"index": 35, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-policy-027', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-077', 'safeguard-process-051']", "chroma:document": "Access to personal information: Give individuals access to their personal information on request unless the request is frivolous or vexatious; it would have an unreasonable impact on the privacy of others; it reveals information in connection with a commercially sensitive decision-making process; the information relates to legal proceedings or negotiations between the organisation and the individual; or another legal exception applies."}


created_at: 2025-02-27 07:36:56
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: ad48bf5e-b45f-41a2-a358-0ff17250b821
encoding: FLOAT32
metadata:
{"index": 36, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-technology-077', 'safeguard-technology-084', 'safeguard-policy-027']", "chroma:document": "Dealing with requests for access: Respond to a request from an individual to access their personal information within a reasonable period. Give access to the information in the manner requested if reasonable and practicable."}


created_at: 2025-02-27 07:36:58
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: e4294d2c-842c-4e38-a063-9092aa4b9638
encoding: FLOAT32
metadata:
{"index": 37, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-technology-077', 'safeguard-technology-084', 'safeguard-policy-027']", "chroma:document": "Other means of access: If the organisation refuses to give access to personal information in a particular manner, take reasonable steps to give access in a way that meets the needs of the organisation and the individual. "}


created_at: 2025-02-27 07:36:59
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 8de3f41a-a66d-4f05-96ac-d66e84b0aea5
encoding: FLOAT32
metadata:
{"index": 38, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-technology-077', 'safeguard-policy-027']", "chroma:document": "Access charges: If charging an individual for giving access to personal information, do not make the charge excessive and do not charge for the act of making of the request."}


created_at: 2025-02-27 07:37:01
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 65d79396-5353-4338-86f0-c0256e33671b
encoding: FLOAT32
metadata:
{"index": 39, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-process-050', 'safeguard-technology-077', 'safeguard-technology-084', 'safeguard-policy-027']", "chroma:document": "Refusal to give access: If the organisation refuses to give access to the personal information, provide a written notice to the individual that complies with the statutory requirements."}


created_at: 2025-02-27 07:37:03
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 5d6ae525-422f-41c8-aace-aa164307e75a
encoding: FLOAT32
metadata:
{"index": 40, "version": 2, "PO": "['individual rights']", "safeguard": "['safeguard-policy-027', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-077', 'safeguard-process-051']", "chroma:document": "Refusal to give access: If the organisation is refusing to give access to the personal information because access would reveal evaluative information in connection with commercially sensitive decisions, the reasons for the refusal may include an explanation for the commercially sensitive decision."}


created_at: 2025-02-27 07:37:05
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 44f2fda2-19fd-47b7-8dea-c26f24fbdaa9
encoding: FLOAT32
metadata:
{"index": 41, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-process-050', 'safeguard-policy-019']", "chroma:document": "Correction: Take reasonable steps to correct personal information (to ensure it is accurate, up to date, complete, relevant and not misleading) where an individual requests the personal information be corrected. "}


created_at: 2025-02-27 07:37:07
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 96102180-14f8-42c0-aedb-5d8b166ea6d1
encoding: FLOAT32
metadata:
{"index": 42, "version": 2, "PO": "['data accuracy']", "safeguard": "['safeguard-process-036', 'safeguard-technology-096', 'safeguard-technology-051', 'safeguard-technology-094', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047', 'safeguard-technology-093', 'safeguard-technology-045', 'safeguard-process-046']", "chroma:document": "Correction: The organisation must take reasonable steps to correct personal information that, having regard to a purpose for which the personal information is held, is inaccurate, out of date, incomplete, irrelevant or misleading."}


created_at: 2025-02-27 07:37:08
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: fa3f849c-b1b6-4936-9628-911c89a8d874
encoding: FLOAT32
metadata:
{"index": 43, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-policy-019', 'safeguard-process-050', 'safeguard-process-133']", "chroma:document": "Notification of correction to third parties: If an individual requests a correction to their personal information that the organisation has previously disclosed to another organisation and the individual requests the organisation notify that organisation of the correction, the organisation must take reasonable steps to notify them of the correction request unless impracticable or unlawful to do so."}


created_at: 2025-02-27 07:37:10
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 3b95dde2-745d-4f3c-a2e0-744719973a9a
encoding: FLOAT32
metadata:
{"index": 44, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-technology-084', 'safeguard-policy-019', 'safeguard-process-050']", "chroma:document": "Refusal to correct information: If the organisation refuses to correct personal information, must provide a written notice to the individual setting out statutory details."}


created_at: 2025-02-27 07:37:12
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 8fb0cc3f-3a64-4038-a119-85aca95fa3b0
encoding: FLOAT32
metadata:
{"index": 45, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-technology-084', 'safeguard-policy-019', 'safeguard-process-050']", "chroma:document": "Request to associate a statement: If the organisation refuses to correct personal information and the individual requests a statement the information is not right, include a statement so that is apparent to users of the information."}


created_at: 2025-02-27 07:37:14
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: bb9f09f9-238e-4869-9182-325435d5112f
encoding: FLOAT32
metadata:
{"index": 46, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-technology-084', 'safeguard-policy-019', 'safeguard-process-050']", "chroma:document": "Dealing with requests: Respond to an individual's request to correct personal information within a reasonable period. "}


created_at: 2025-02-27 07:37:16
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: c0b229a1-f8f1-4b0f-a154-16d94b333a1e
encoding: FLOAT32
metadata:
{"index": 47, "version": 2, "PO": "['individual rights', 'data accuracy']", "safeguard": "['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-process-050', 'safeguard-policy-019']", "chroma:document": "Dealing with requests: Do not charge the individual for correcting personal information or making a request to correct personal information."}


created_at: 2025-02-27 07:37:18
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 0ef41daf-f7bb-4e7b-980d-ebfe0537cee7
encoding: FLOAT32
metadata:
{"index": 48, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-process-100', 'safeguard-policy-050', 'safeguard-technology-133', 'safeguard-process-101']", "chroma:document": "Notification of eligible data breaches: Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if there are reasonable grounds to believe that an eligible data breach has happened (or if the OAIC directs the organisation to notify)."}


created_at: 2025-02-27 07:37:20
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: d2ee8e58-5ad0-49ad-aee5-72f691646117
encoding: FLOAT32
metadata:
{"index": 49, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-technology-135', 'safeguard-policy-050', 'safeguard-process-098']", "chroma:document": "Assessment of suspected eligible data breach: Where the organisation has reasonable grounds to suspect there may be an eligible data breach but is not yet aware of reasonable grounds to believe there is an eligible data breach, take all reasonable steps to complete (within 30 days) a reasonable and expeditious assessment of whether an eligible data breach may have occurred in accordance with statutory requirements."}


created_at: 2025-02-27 07:37:21
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: d05ee9f6-0478-42c6-8b55-7141005e2ce9
encoding: FLOAT32
metadata:
{"index": 50, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-policy-050', 'safeguard-process-103', 'safeguard-technology-132', 'safeguard-process-105', 'safeguard-process-101']", "chroma:document": "Statement about eligible data breach: Where the organisation has reasonable grounds to believe there has been an eligible data breach, the organisation must give a statement about the eligible data breach to the OAIC that meets the statutory requirements, as soon as practicable after becoming aware of the eligible data breach."}


created_at: 2025-02-27 07:37:23
topic: persistent://default/default/a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
id: 1b0ef830-8630-453a-8f5f-f8347b00469f
encoding: FLOAT32
metadata:
{"index": 51, "version": 2, "PO": "['data security']", "safeguard": "['safeguard-process-100', 'safeguard-policy-050', 'safeguard-technology-133']", "chroma:document": "Entity must notify eligible data breach: Where the organisation has reasonable grounds to believe there been have been an eligible data breach, and the organisation has provided a statement about the eligible data breach to the OAIC, the organisation should take reasonable steps to notify the contents of the statement to each of the individuals at risk from the eligible data breach."}


# collections

id: a239f0dd-cb8e-496a-a0ac-68c2ead6d97d
name: requirement_v2_database
database_id: 00000000-0000-0000-0000-000000000000
config_json_str:
{"hnsw_configuration": {"space": "l2", "ef_construction": 100, "ef_search": 100, "num_threads": 9, "M": 16, "resize_factor": 1.2, "batch_size": 100, "sync_threshold": 1000, "_type": "HNSWConfigurationInternal"}, "_type": "CollectionConfigurationInternal"}


# embedding_metadata

key: safeguard
string_value:
['safeguard-process-001', 'safeguard-people-003', 'safeguard-technology-006', 'safeguard-process-004', 'safeguard-technology-004']


key: safeguard
string_value:
['safeguard-technology-001', 'safeguard-technology-003', 'safeguard-policy-001', 'safeguard-process-002', 'safeguard-policy-003']


key: chroma:document
string_value:
APP Privacy Policy: Have a clear and up to date Privacy Policy that contains all required statutory items.


key: chroma:document
string_value:
Availability of APP Privacy Policy: Have a clear and up to date Privacy Policy that is easily available to individuals.


key: chroma:document
string_value:
Availability of APP Privacy Policy: Take reasonable steps to give an individual a copy of the Privacy Policy if requested. 


key: chroma:document
string_value:
Automated decisions  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : If personal information is used in connection with automated decision-making (i.e. a computer program is used to make, or do a thing directly related to making, a decision), and the decision could significantly affect the rights or interests of an individual, the organisation's Privacy Policy must contain information about (a) the kinds of personal information used in the automated decision-making; and (b) the kinds of decisions made using automated decision-making.


key: chroma:document
string_value:
Anonymity and pseudonymity: Provide individuals with the option of not identifying themselves (or using a pseudonym) unless its impracticable to do so or prevented by law.


key: chroma:document
string_value:
Personal information other than sensitive information: Only collect personal information (other than sensitive information) if the collection is reasonably necessary for a function or activity of the organisation. 


key: chroma:document
string_value:
Sensitive information : Do not collect sensitive information unless (a) the individual provides their consent to the collection and the collection is reasonably necessary for a function or activity of the organisation OR (b) another permitted legal basis exists for the collection.


key: safeguard
string_value:
['safeguard-technology-009', 'safeguard-policy-005', 'safeguard-technology-010', 'safeguard-process-005']


key: chroma:document
string_value:
Means of collection: Only collect personal information from the individual (and not a third party) unless its impracticable or unreasonable.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-012', 'safeguard-technology-013', 'safeguard-policy-004']


key: chroma:document
string_value:
Dealing with unsolicited personal information : If unsolicited personal information is received, determine within a reasonable time whether or not that personal information could have been legally collected by the organisation. 


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-012', 'safeguard-policy-020', 'safeguard-technology-013', 'safeguard-policy-004']


key: chroma:document
string_value:
Dealing with unsolicited personal information : If unsolicited personal information is received that the organisation couldn't have legally collected, destroy or de-identify the personal information as soon as practicable.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002', 'safeguard-policy-004']


key: chroma:document
string_value:
Notification of the collection of personal information: Provide an individual with a collection notification at, before the time, or as soon as practicable after collecting their personal information.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-policy-001', 'safeguard-process-002', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-policy-002', 'safeguard-policy-004']


key: chroma:document
string_value:
Notification of the collection of personal information: Collection notifications provided to individuals must contain all required statutory items.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-process-059', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-technology-032', 'safeguard-policy-011', 'safeguard-technology-088']


key: chroma:document
string_value:
Use or disclosure of personal information: Only use or disclose personal information (other than sensitive information) (a) for the purpose it was collected, OR (b) for a related purpose where the individual reasonably expects the information to be used for that purpose OR (c) another legal basis exists.


key: chroma:document
string_value:
Use or disclosure of sensitive information: Only use or disclose sensitive information (a) for the purpose it was collected, OR (b) for a directly related purpose where the individual reasonably expects the information to be used for that purpose OR (c) another legal basis exists.


key: chroma:document
string_value:
Written note of use or disclosure: If required to use/disclose personal information for one or more enforcement related activities, make a written note of the use or disclosure. 


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-010', 'safeguard-policy-011', 'safeguard-technology-032', 'safeguard-process-017']


key: chroma:document
string_value:
Related bodies corporate: Where the organisation collects personal information from a related body corporate, the purpose of collection is the same for both companies.


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Direct marketing of personal information collected from the individual: Only use or disclose personal information (other than sensitive information) collected from a third party where the individual (a) has consented to direct marketing and (b) the individual is given a simple means to opt-out of receiving direct marketing comms, (c) a prominent statement is included in each direct marketing comms that the individual can withdraw their consent and (d) the individual has not opted out of direct marketing comms.


key: chroma:document
string_value:
Direct marketing of personal information collected from the individual: Only use or disclose personal information (other than sensitive information) collected from the individual where the individual has given their consent OR the individual (a) reasonably expects the organisation to use or disclose it for direct marketing, (b) has been given a simple means to opt-out of receiving direct marketing comms and (c) has not previously opted out of direct marketing comms. 


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-010', 'safeguard-technology-012', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Exceptions : Only use or disclose sensitive information where the individual has given their consent to direct marketing.


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-125', 'safeguard-policy-027', 'safeguard-policy-001', 'safeguard-technology-138', 'safeguard-process-003', 'safeguard-process-050', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Individual may request not to receive direct marketing communications etc. : Individuals must be able to request to opt-out of direct marketing comms from the organisation


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-124', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-technology-137', 'safeguard-technology-125', 'safeguard-policy-027', 'safeguard-policy-001', 'safeguard-technology-138', 'safeguard-process-003', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002', 'safeguard-process-133']


key: chroma:document
string_value:
Individual may request not to receive direct marketing communications facilitating direct marketing by another organisation: If the organisation facilitates direct marketing by another organisation, individuals must be able to request to opt-out of direct marketing comms from that other organisation and request the organisation provides information about the source of the personal information.


key: safeguard
string_value:
['safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Individual may request not to receive direct marketing communications etc.: Give effect to a direct marketing opt-out request within a reasonable period of time. Do not charge an individual to opt out of direct marketing. 


key: safeguard
string_value:
['safeguard-policy-007', 'safeguard-technology-001', 'safeguard-technology-002', 'safeguard-policy-001', 'safeguard-process-003', 'safeguard-technology-086', 'safeguard-technology-004', 'safeguard-policy-002']


key: chroma:document
string_value:
Individual may request not to receive direct marketing communications etc.: If the organisation facilitates direct marketing by another organisation, give effect to requests for sources of personal information within a reasonable period of time unless impracticable or unreasonable. Do not charge an individual to give effect to a request to provide its source of personal information.


key: safeguard
string_value:
['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-014', 'safeguard-policy-042', 'safeguard-technology-129', 'safeguard-policy-013']


key: chroma:document
string_value:
Cross-border disclosure of personal information: Only disclose personal information to a recipient outside Australia if (a) the organisation has taken reasonable steps to ensure that the recipient complies with the APPs or (b) another legal basis applies (see APP 8.2 and 8.3 below).


key: safeguard
string_value:
['safeguard-technology-126', 'safeguard-process-095', 'safeguard-policy-044', 'safeguard-technology-127', 'safeguard-process-096', 'safeguard-process-093', 'safeguard-process-092', 'safeguard-policy-042', 'safeguard-policy-014', 'safeguard-policy-013']


key: chroma:document
string_value:
Cross-border disclosure of personal information: The organisation can disclose personal information to a recipient outside Australia if (a) the recipient is subject to privacy laws that are substantially similar to the Privacy Act and APP's and the individual can take action to enforce those laws, or (b) the individual has been informed APP 8.1 does not apply to the disclosure and they consent to the disclosure; or (c) another legal basis applies (such as 8.3 below).


key: chroma:document
string_value:
Cross-border disclosure of personal information  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : The organisation can disclose personal information to a recipient outside Australia if (a) the recipient is subject to the laws of a country that is prescribed by the regulations, or (b) the recipient is a participant in a binding scheme that is prescribed by the regulations and (c) any other conditions prescribed under the regulations are satisfied.


key: chroma:document
string_value:
Adoption of government related identifiers: Do not adopt a government related identifier of an individual for own purposes.


key: chroma:document
string_value:
Use or disclosure of government related identifiers: Do not use or disclose a government related identifier unless a statutory exemption applies. 


key: safeguard
string_value:
['safeguard-process-036', 'safeguard-technology-051', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047']


key: chroma:document
string_value:
Quality of personal information: Take reasonable steps to ensure the personal information that is collected is accurate, up-to-date and complete. 


key: safeguard
string_value:
['safeguard-process-036', 'safeguard-technology-046', 'safeguard-technology-051', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047']


key: chroma:document
string_value:
Quality of personal information: Take reasonable steps to ensure the personal information that is used or disclosed is accurate, up-to-date, complete and relevant.


key: chroma:document
string_value:
Security of personal information : Take reasonable steps (including technical and organisational measures) to protect personal information from misuse, interference, loss, unauthorised access, unauthorised modification, unauthorised disclosure. 


key: safeguard
string_value:
['safeguard-process-016', 'safeguard-technology-017', 'safeguard-policy-008', 'safeguard-technology-020', 'safeguard-technology-024']


key: chroma:document
string_value:
Security of personal information  (Inserted by Privacy and Other Legislation Amendment Bill 2024 : Take reasonable steps (including technical and organisational measures) to destroy or de-identify personal information that isn't needed for any purpose for which it may be used or disclosed under the APPs and is not required to be retained under law.


key: safeguard
string_value:
['safeguard-policy-027', 'safeguard-technology-084', 'safeguard-process-050', 'safeguard-technology-077', 'safeguard-process-051']


key: chroma:document
string_value:
Access to personal information: Give individuals access to their personal information on request unless the request is frivolous or vexatious; it would have an unreasonable impact on the privacy of others; it reveals information in connection with a commercially sensitive decision-making process; the information relates to legal proceedings or negotiations between the organisation and the individual; or another legal exception applies.


key: safeguard
string_value:
['safeguard-process-050', 'safeguard-technology-077', 'safeguard-technology-084', 'safeguard-policy-027']


key: chroma:document
string_value:
Dealing with requests for access: Respond to a request from an individual to access their personal information within a reasonable period. Give access to the information in the manner requested if reasonable and practicable.


key: chroma:document
string_value:
Other means of access: If the organisation refuses to give access to personal information in a particular manner, take reasonable steps to give access in a way that meets the needs of the organisation and the individual. 


key: chroma:document
string_value:
Access charges: If charging an individual for giving access to personal information, do not make the charge excessive and do not charge for the act of making of the request.


key: chroma:document
string_value:
Refusal to give access: If the organisation refuses to give access to the personal information, provide a written notice to the individual that complies with the statutory requirements.


key: chroma:document
string_value:
Refusal to give access: If the organisation is refusing to give access to the personal information because access would reveal evaluative information in connection with commercially sensitive decisions, the reasons for the refusal may include an explanation for the commercially sensitive decision.


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-process-050', 'safeguard-policy-019']


key: chroma:document
string_value:
Correction: Take reasonable steps to correct personal information (to ensure it is accurate, up to date, complete, relevant and not misleading) where an individual requests the personal information be corrected. 


key: safeguard
string_value:
['safeguard-process-036', 'safeguard-technology-096', 'safeguard-technology-051', 'safeguard-technology-094', 'safeguard-policy-019', 'safeguard-technology-048', 'safeguard-technology-047', 'safeguard-technology-093', 'safeguard-technology-045', 'safeguard-process-046']


key: chroma:document
string_value:
Correction: The organisation must take reasonable steps to correct personal information that, having regard to a purpose for which the personal information is held, is inaccurate, out of date, incomplete, irrelevant or misleading.


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-policy-019', 'safeguard-process-050', 'safeguard-process-133']


key: chroma:document
string_value:
Notification of correction to third parties: If an individual requests a correction to their personal information that the organisation has previously disclosed to another organisation and the individual requests the organisation notify that organisation of the correction, the organisation must take reasonable steps to notify them of the correction request unless impracticable or unlawful to do so.


key: safeguard
string_value:
['safeguard-technology-081', 'safeguard-technology-071', 'safeguard-policy-027', 'safeguard-technology-084', 'safeguard-policy-019', 'safeguard-process-050']


key: chroma:document
string_value:
Refusal to correct information: If the organisation refuses to correct personal information, must provide a written notice to the individual setting out statutory details.


key: chroma:document
string_value:
Request to associate a statement: If the organisation refuses to correct personal information and the individual requests a statement the information is not right, include a statement so that is apparent to users of the information.


key: chroma:document
string_value:
Dealing with requests: Respond to an individual's request to correct personal information within a reasonable period. 


key: chroma:document
string_value:
Dealing with requests: Do not charge the individual for correcting personal information or making a request to correct personal information.


key: safeguard
string_value:
['safeguard-process-100', 'safeguard-policy-050', 'safeguard-technology-133', 'safeguard-process-101']


key: chroma:document
string_value:
Notification of eligible data breaches: Notify the Office of the Australian Information Commissioner (OAIC) and affected individuals if there are reasonable grounds to believe that an eligible data breach has happened (or if the OAIC directs the organisation to notify).


key: chroma:document
string_value:
Assessment of suspected eligible data breach: Where the organisation has reasonable grounds to suspect there may be an eligible data breach but is not yet aware of reasonable grounds to believe there is an eligible data breach, take all reasonable steps to complete (within 30 days) a reasonable and expeditious assessment of whether an eligible data breach may have occurred in accordance with statutory requirements.


key: safeguard
string_value:
['safeguard-policy-050', 'safeguard-process-103', 'safeguard-technology-132', 'safeguard-process-105', 'safeguard-process-101']


key: chroma:document
string_value:
Statement about eligible data breach: Where the organisation has reasonable grounds to believe there has been an eligible data breach, the organisation must give a statement about the eligible data breach to the OAIC that meets the statutory requirements, as soon as practicable after becoming aware of the eligible data breach.


key: chroma:document
string_value:
Entity must notify eligible data breach: Where the organisation has reasonable grounds to believe there been have been an eligible data breach, and the organisation has provided a statement about the eligible data breach to the OAIC, the organisation should take reasonable steps to notify the contents of the statement to each of the individuals at risk from the eligible data breach.


