CI-PDP: A Framework for LLM-Based Privacy Policy Evaluation under Contextual Integrity and Indonesia’s PDP Law

Le résumé fourni par la source

In today’s electronic society, privacy policies are critical for communicating how personal data is collected and used. However, their complexity often limits user understanding and informed consent. Existing studies largely focus on Western regulatory frameworks such as the GDPR, with limited attention to non-Western legal and linguistic contexts. This paper addresses this gap by introducing the CI-PDP framework, which integrates Contextual Integrity (CI) theory with Indonesia’s Personal Data Protection Law (PDP Law) to support structured, regulation-aligned privacy policy analysis. We then developed an 11-parameter framework based on CI and Article 21 of the PDP Law. Privacy policies from three major Indonesian banks were manually annotated to build a benchmark dataset. Two large language models (LLMs), ChatGPT and Perplexity, were employed for automatic annotation through prompt engineering aligned with the CI-PDP schema. Model outputs were evaluated using ROUGE-L metrics, including precision, recall, and F1-score. Results show that Perplexity consistently outperforms ChatGPT, particularly in capturing complex elements such as user rights and data retention clauses. These findings demonstrate the potential of LLMs for automating privacy compliance assessment in non-Western settings. This work contributes a context-sensitive evaluation framework, a curated Indonesian-language benchmark dataset, and empirical insights into the practical use of LLMs for aligning privacy policy interpretation with local legal standards.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.