  Data protection and privacy is becoming increasingly crucial in the digital
era. Numerous companies depend on third-party vendors and service providers to
carry out critical functions within their operations, encompassing tasks such
as data handling and storage. However, this reliance introduces potential
vulnerabilities, as these vendors' security measures and practices may not
always align with the standards expected by regulatory bodies. Businesses are
required, often under the penalty of law, to ensure compliance with the
evolving regulatory rules. Interpreting and implementing these regulations pose
challenges due to their complexity. Regulatory documents are extensive,
demanding significant effort for interpretation, while vendor-drafted privacy
policies often lack the detail required for full legal compliance, leading to
ambiguity. To ensure a concise interpretation of the regulatory requirements
and compliance of organizational privacy policy with said regulations, we
propose a Large Language Model (LLM) and Semantic Web based approach for
privacy compliance. In this paper, we develop the novel Privacy Policy
Compliance Verification Knowledge Graph, PrivComp-KG. It is designed to
efficiently store and retrieve comprehensive information concerning privacy
policies, regulatory frameworks, and domain-specific knowledge pertaining to
the legal landscape of privacy. Using Retrieval Augmented Generation, we
identify the relevant sections in a privacy policy with corresponding
regulatory rules. This information about individual privacy policies is
populated into the PrivComp-KG. Combining this with the domain context and
rules, the PrivComp-KG can be queried to check for compliance with privacy
policies by each vendor against relevant policy regulations. We demonstrate the
relevance of the PrivComp-KG, by verifying compliance of privacy policy
documents for various organizations.
