privacy-metrics-dashboard

Privacy Metrics Dashboard

Overview

A privacy metrics dashboard provides quantitative visibility into the effectiveness and maturity of an organization's privacy program. This skill defines the key privacy performance indicators (KPIs), data collection methods, visualization patterns, and reporting cadences needed to measure, monitor, and continuously improve privacy operations.

Core Privacy KPI Categories

1. Data Subject Access Requests (DSARs)

Metric	Definition	Target	Frequency
DSAR Volume	Total DSARs received per period	Trend monitoring	Monthly
DSAR by Type	Breakdown by right exercised (access, deletion, portability, rectification)	N/A (distribution)	Monthly
Average Response Time	Mean calendar days from receipt to completion	< 25 days (GDPR: 30 day limit)	Monthly
Median Response Time	Median calendar days from receipt to completion	< 20 days	Monthly
P95 Response Time	95th percentile response time	< 28 days	Monthly
On-Time Completion Rate	% completed within regulatory deadline	> 98%	Monthly
DSAR Backlog	Open DSARs at period end	< 10% of monthly volume	Weekly
Automated Fulfillment Rate	% of DSARs fulfilled without manual intervention	> 60%	Quarterly
Identity Verification Failure Rate	% of DSARs where identity could not be verified	< 5%	Monthly
Cost per DSAR	Average cost to process one DSAR	Trend reduction	Quarterly

2. Data Breaches

Metric	Definition	Target	Frequency
Breach Count	Total confirmed breaches per period	0 (minimize)	Monthly
Breach Severity Distribution	Count by severity level (low/medium/high/critical)	No critical breaches	Monthly
Mean Time to Detect (MTTD)	Average hours from breach occurrence to detection	< 24 hours	Per incident
Mean Time to Notify (MTTN)	Average hours from detection to regulatory notification	< 48 hours (GDPR: 72 hours)	Per incident
Mean Time to Contain (MTTC)	Average hours from detection to containment	< 12 hours	Per incident
Records Affected	Total data subject records affected	Minimize	Per incident
Repeat Breach Rate	% of breaches with same root cause as prior breach	0%	Quarterly
Regulatory Fines	Total fines imposed due to breaches	$0	Annual
Breach Simulation Score	Score from most recent tabletop exercise	> 85%	Semi-annual

3. Privacy Impact Assessments (DPIAs)

Metric	Definition	Target	Frequency
DPIA Completion Rate	% of high-risk processing with completed DPIA	100%	Quarterly
DPIA Backlog	DPIAs required but not yet started	0	Monthly
Average DPIA Duration	Mean days from initiation to sign-off	< 30 days	Quarterly
DPIA Findings Remediated	% of identified risks with implemented mitigations	> 90%	Quarterly
DPIA Review Rate	% of existing DPIAs reviewed within their review cycle	> 95%	Quarterly
New Processing Without DPIA	Count of new high-risk processing launched without DPIA	0	Monthly

4. Training and Awareness

Metric	Definition	Target	Frequency
Training Completion Rate	% of staff who completed required privacy training	> 95%	Quarterly
Training Pass Rate	% passing the assessment on first attempt	> 85%	Quarterly
New Hire Training Time	Average days from start date to training completion	< 14 days	Monthly
Specialist Certification Rate	% of privacy team with professional certification	> 80%	Annual
Privacy Champion Coverage	% of business units with designated privacy champion	100%	Quarterly
Phishing Simulation Pass Rate	% of staff correctly identifying privacy-related phishing	> 90%	Quarterly

5. Consent Management

Metric	Definition	Target	Frequency
Consent Rate	% of users providing consent (by purpose)	Trend monitoring	Monthly
Opt-in Rate	% choosing to opt in to optional processing	Trend monitoring	Monthly
Opt-out/Withdrawal Rate	% withdrawing previously given consent	< 5% monthly	Monthly
Consent Freshness	% of active consents collected within last 12 months	> 70%	Quarterly
Consent Collection Coverage	% of data processing with documented consent/legal basis	100%	Quarterly
Cookie Consent Rate	% of website visitors accepting cookies (by category)	Trend monitoring	Monthly
Consent Record Accuracy	% of consent records matching actual processing	> 99%	Quarterly

6. Operational Metrics

Metric	Definition	Target	Frequency
Privacy Incidents Reported	Internal privacy incidents reported (not just breaches)	Trend monitoring	Monthly
Vendor Privacy Assessments Completed	% of high-risk vendors assessed	100%	Quarterly
Data Inventory Completeness	% of processing activities documented in ROPA	> 95%	Quarterly
Policy Acknowledgment Rate	% of staff acknowledging updated privacy policies	> 98%	Per update
Privacy-by-Design Gate Pass Rate	% of projects passing privacy review at design gate	> 85%	Quarterly
Regulatory Inquiry Response Time	Average days to respond to regulatory inquiries	< 5 days	Per event

Data Collection Architecture

Data Sources                    Collection Layer              Dashboard Layer
+------------------+
| DSAR Platform    |---+
+------------------+   |
                       |    +-------------------+    +-----------------------+
+------------------+   +--->|                   |    |                       |
| Breach Tracker   |------->| Data Integration  |--->| Visualization Engine  |
+------------------+   +--->| (ETL Pipeline)    |    | (Grafana / Tableau /  |
                       |    |                   |    |  Power BI / Metabase) |
+------------------+   |    +-------------------+    +-----------------------+
| DPIA Register    |---+           |                          |
+------------------+   |           v                          v
                       |    +-------------------+    +-----------------------+
+------------------+   |    | Metrics Database  |    | Alerting System       |
| LMS (Training)   |---+    | (Time-series /    |    | - Threshold breaches  |
+------------------+   |    |  PostgreSQL)      |    | - Trend deviations    |
                       |    +-------------------+    | - SLA warnings        |
+------------------+   |                              +-----------------------+
| Consent Platform |---+
+------------------+

Metric Collection Implementation

"""
Privacy metrics collection and aggregation engine.
Collects KPI data from multiple privacy operational systems
and computes dashboard-ready metrics.
"""

from dataclasses import dataclass
from datetime import datetime, timedelta
from typing import Optional
import statistics


@dataclass
class DSARMetrics:
    period_start: datetime
    period_end: datetime
    total_received: int
    total_completed: int
    total_overdue: int
    avg_response_days: float
    median_response_days: float
    p95_response_days: float
    on_time_rate: float
    by_type: dict[str, int]
    backlog: int
    automated_rate: float


@dataclass
class BreachMetrics:
    period_start: datetime
    period_end: datetime
    total_breaches: int
    by_severity: dict[str, int]
    avg_detection_hours: float
    avg_notification_hours: float
    avg_containment_hours: float
    total_records_affected: int
    repeat_breach_count: int


@dataclass
class ConsentMetrics:
    period_start: datetime
    period_end: datetime
    total_consent_events: int
    opt_in_rate: float
    withdrawal_rate: float
    consent_rate_by_purpose: dict[str, float]
    cookie_acceptance_rate: float
    consent_freshness_pct: float


class PrivacyMetricsCollector:
    """
    Collect and compute privacy KPIs from operational data sources.
    """

    def __init__(self, dsar_repo, breach_repo, dpia_repo, training_repo, consent_repo):
        self.dsar_repo = dsar_repo
        self.breach_repo = breach_repo
        self.dpia_repo = dpia_repo
        self.training_repo = training_repo
        self.consent_repo = consent_repo

    def compute_dsar_metrics(
        self,
        start_date: datetime,
        end_date: datetime,
        regulatory_deadline_days: int = 30
    ) -> DSARMetrics:
        """Compute DSAR KPIs for a given period."""
        dsars = self.dsar_repo.get_by_period(start_date, end_date)

        completed = [d for d in dsars if d.status == "completed"]
        response_times = [
            (d.completed_at - d.received_at).days
            for d in completed
            if d.completed_at and d.received_at
        ]

        on_time = [
            d for d in completed
            if (d.completed_at - d.received_at).days <= regulatory_deadline_days
        ]

        automated = [d for d in completed if d.automated]
        open_dsars = [d for d in dsars if d.status in ("open", "in_progress")]

        by_type = {}
        for d in dsars:
            by_type[d.request_type] = by_type.get(d.request_type, 0) + 1

        return DSARMetrics(
            period_start=start_date,
            period_end=end_date,
            total_received=len(dsars),
            total_completed=len(completed),
            total_overdue=len(dsars) - len(on_time) - len(open_dsars),
            avg_response_days=statistics.mean(response_times) if response_times else 0,
            median_response_days=statistics.median(response_times) if response_times else 0,
            p95_response_days=(
                sorted(response_times)[int(len(response_times) * 0.95)]
                if len(response_times) >= 20 else
                max(response_times) if response_times else 0
            ),
            on_time_rate=len(on_time) / len(completed) if completed else 1.0,
            by_type=by_type,
            backlog=len(open_dsars),
            automated_rate=len(automated) / len(completed) if completed else 0,
        )

    def compute_breach_metrics(
        self,
        start_date: datetime,
        end_date: datetime
    ) -> BreachMetrics:
        """Compute breach KPIs for a given period."""
        breaches = self.breach_repo.get_by_period(start_date, end_date)

        by_severity = {}
        detection_hours = []
        notification_hours = []
        containment_hours = []
        total_records = 0

        for b in breaches:
            by_severity[b.severity] = by_severity.get(b.severity, 0) + 1
            total_records += b.records_affected or 0

            if b.detected_at and b.occurred_at:
                detection_hours.append(
                    (b.detected_at - b.occurred_at).total_seconds() / 3600
                )
            if b.notified_at and b.detected_at:
                notification_hours.append(
                    (b.notified_at - b.detected_at).total_seconds() / 3600
                )
            if b.contained_at and b.detected_at:
                containment_hours.append(
                    (b.contained_at - b.detected_at).total_seconds() / 3600
                )

        # Count repeat breaches (same root cause as previous)
        root_causes = [b.root_cause for b in breaches if b.root_cause]
        repeat_count = len(root_causes) - len(set(root_causes))

        return BreachMetrics(
            period_start=start_date,
            period_end=end_date,
            total_breaches=len(breaches),
            by_severity=by_severity,
            avg_detection_hours=statistics.mean(detection_hours) if detection_hours else 0,
            avg_notification_hours=statistics.mean(notification_hours) if notification_hours else 0,
            avg_containment_hours=statistics.mean(containment_hours) if containment_hours else 0,
            total_records_affected=total_records,
            repeat_breach_count=repeat_count,
        )

    def generate_executive_report(
        self,
        period_start: datetime,
        period_end: datetime
    ) -> dict:
        """
        Generate a comprehensive executive privacy report.
        Combines all KPI categories into a single report structure.
        """
        dsar = self.compute_dsar_metrics(period_start, period_end)
        breach = self.compute_breach_metrics(period_start, period_end)

        # Calculate overall privacy health score (0-100)
        health_components = []

        # DSAR component (25% weight)
        dsar_score = min(100, dsar.on_time_rate * 100)
        health_components.append(("DSAR Compliance", dsar_score, 0.25))

        # Breach component (30% weight)
        breach_score = 100 if breach.total_breaches == 0 else max(0, 100 - breach.total_breaches * 20)
        health_components.append(("Breach Prevention", breach_score, 0.30))

        # Response time component (20% weight)
        response_score = min(100, max(0, (30 - dsar.avg_response_days) / 30 * 100))
        health_components.append(("Response Timeliness", response_score, 0.20))

        # Detection speed component (25% weight)
        detection_score = min(100, max(0, (72 - breach.avg_detection_hours) / 72 * 100)) if breach.total_breaches > 0 else 100
        health_components.append(("Detection Speed", detection_score, 0.25))

        overall_score = sum(score * weight for _, score, weight in health_components)

        return {
            "period": {
                "start": period_start.isoformat(),
                "end": period_end.isoformat()
            },
            "overall_privacy_health_score": round(overall_score, 1),
            "health_rating": (
                "Excellent" if overall_score >= 90 else
                "Good" if overall_score >= 75 else
                "Needs Improvement" if overall_score >= 60 else
                "Critical"
            ),
            "components": {
                name: {"score": round(score, 1), "weight": f"{weight*100:.0f}%"}
                for name, score, weight in health_components
            },
            "dsar_summary": {
                "volume": dsar.total_received,
                "on_time_rate": f"{dsar.on_time_rate*100:.1f}%",
                "avg_response_days": round(dsar.avg_response_days, 1),
                "backlog": dsar.backlog
            },
            "breach_summary": {
                "count": breach.total_breaches,
                "severity_distribution": breach.by_severity,
                "avg_detection_hours": round(breach.avg_detection_hours, 1),
                "records_affected": breach.total_records_affected
            },
        }

Dashboard Visualization Patterns

Executive Summary View

Panel	Chart Type	Metrics Displayed	Refresh Rate
Privacy Health Score	Gauge (0-100)	Overall weighted score	Daily
DSAR Volume Trend	Line chart	Monthly DSAR count (12-month rolling)	Daily
Breach Timeline	Event timeline	Breaches by severity over time	Real-time
On-Time Rate	Single stat with spark line	DSAR on-time completion %	Daily
Training Coverage	Horizontal bar	Completion rate by department	Weekly
Consent Rate Trend	Multi-line chart	Opt-in rate by purpose (6-month)	Daily

Operational View

Panel	Chart Type	Metrics Displayed	Refresh Rate
Active DSARs	Table with status	Open requests with deadlines	Hourly
DSAR Aging	Histogram	Distribution of open DSAR ages	Daily
Response Time Box Plot	Box plot	Response time distribution by month	Daily
Breach Detection Funnel	Funnel chart	Detection > Assessment > Notification > Resolution	Per event
DPIA Pipeline	Kanban	DPIAs by status (draft, review, approved)	Daily
Vendor Risk Heat Map	Heat map	Vendors by risk score and last assessment date	Weekly

Alerting Rules

Alert	Condition	Severity	Recipient
DSAR SLA Warning	Any DSAR open > 21 days	Warning	DSAR team
DSAR SLA Breach	Any DSAR open > 28 days	Critical	CPO + Legal
Breach Detected	New breach record created	Critical	Incident team + CPO
Training Compliance Drop	Department completion < 90%	Warning	HR + Privacy
Consent Rate Anomaly	Opt-in rate drops > 20% in a week	Warning	Privacy + Marketing
DPIA Overdue	DPIA review past scheduled date	Warning	DPIA owner + CPO
Vendor Assessment Due	High-risk vendor assessment > 11 months old	Warning	Procurement + Privacy

Executive Reporting Template

Monthly Privacy Board Report Structure

Privacy Health Score: Overall score with trend arrow
Key Highlights: 3-5 bullet points on notable events
DSAR Performance: Volume, on-time rate, top request types
Breach Status: Count, severity, response times, lessons learned
Compliance Posture: DPIA coverage, training rates, policy updates
Risk Outlook: Emerging risks, regulatory developments, planned changes
Resource Needs: Budget requests, headcount, tooling

References

IAPP Privacy Program Management Guide (CIPM Body of Knowledge)
NIST Privacy Framework — GV.MT Monitoring and Review
ISO/IEC 27701:2019 — Clause 9 (Performance Evaluation)
EDPB Guidelines on Data Breach Notification (WP250 rev.01)
Gartner Privacy Program Metrics Framework
ISACA Privacy Audit and Assurance Program