APPI — Act on the Protection of Personal Information

APPI — Act on the Protection of Personal Information — 90% of in-scope requirements covered.

5 requirements · 5 in scope (4 enforced · 1 designed). The 90% is weighted over the in-scope base.

APPI: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. purpose-of-use · enforced

    APPI Articles 17-18 — specify the purpose of use of personal information as far as possible and do not handle…

    Audit events: kye.purpose.request.v1, kye.purpose.admissibility.v1 · Constitution: 12 purpose permission

  2. security-control-measures · enforced

    APPI Article 23 — take necessary and appropriate measures for the security control of personal data…

    Audit events: kye.risk.authority_register.v1, kye.evidence.tool_call.v1 · Constitution: 31 data governance pack, 12 purpose permission

  3. cross-border-transfer · enforced

    APPI Articles 28 + 31 — provide personal data to a third party in a foreign country only with consent or an…

    Audit events: kye.evidence.tool_call.v1, kye.evidence.decision_map.v1 · Constitution: 21 delegated auditability

  4. disclosure-access-rights · enforced

    APPI Articles 33-35 — respond to a data subject's request for disclosure, correction, suspension of use or…

    Audit events: kye.replay.proof.v1, kye.evidence.pack.v1 · Constitution: 21 delegated auditability, 13 resilience loop

  5. breach-reporting · designed

    APPI Article 26 — report a leakage of personal data that is likely to harm individuals' rights and interests…

    Audit events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1 · Constitution: 13 resilience loop

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: Act on the Protection of Personal Information (APPI, Act No. 57 of 2003), as amended (2020 amendment in force 1 April 2022), supervised by the Personal Information Protection Commission (PPC). KYE™ maps the purpose-of-use, security-control, cross-border-transfer, disclosure-and-access, and breach-reporting obligations that touch an AI-supported action onto runtime evidence; the customer's organisational privacy programme stays out of scope.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Purpose of use & consent11000100%
Security control measures11000100%
Cross-border transfer11000100%
Disclosure & access rights11000100%
Breach reporting1010050%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
appi.purpose-of-useAPPI Articles 17-18 — specify the purpose of use of personal information as far as possible and do not handle personal information beyond the specified purpose without consentenforcedaudit_events: kye.purpose.request.v1, kye.purpose.admissibility.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md
appi.security-control-measuresAPPI Article 23 — take necessary and appropriate measures for the security control of personal data, including access control and the prevention of leakageenforcedaudit_events: kye.risk.authority_register.v1, kye.evidence.tool_call.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md, constitution/12-PURPOSE-PERMISSION.md
appi.cross-border-transferAPPI Articles 28 + 31 — provide personal data to a third party in a foreign country only with consent or an adequate-protection basis, and supply information on the recipient's data-handling regimeenforcedaudit_events: kye.evidence.tool_call.v1, kye.evidence.decision_map.v1
engines: internal, internal
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md
appi.disclosure-access-rightsAPPI Articles 33-35 — respond to a data subject's request for disclosure, correction, suspension of use or erasure of their retained personal dataenforcedaudit_events: kye.replay.proof.v1, kye.evidence.pack.v1
engines: internal, internal
constitution_refs: constitution/21-DELEGATED-AUDITABILITY.md, constitution/13-RESILIENCE-LOOP.md
appi.breach-reportingAPPI Article 26 — report a leakage of personal data that is likely to harm individuals' rights and interests to the PPC and notify affected individualsdesignedaudit_events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.