Privacy Metrics Dashboard

Privacy Metrics Dashboard

Overview

A privacy metrics dashboard provides quantitative visibility into the effectiveness and maturity of an organization's privacy program. This skill defines the key privacy performance indicators (KPIs), data collection methods, visualization patterns, and reporting cadences needed to measure, monitor, and continuously improve privacy operations.

Core Privacy KPI Categories

1. Data Subject Access Requests (DSARs)

2. Data Breaches

3. Privacy Impact Assessments (DPIAs)

4. Training and Awareness

5. Consent Management

6. Operational Metrics

Data Collection Architecture

Data Sources                    Collection Layer              Dashboard Layer
+------------------+
| DSAR Platform    |---+
+------------------+   |
                       |    +-------------------+    +-----------------------+
+------------------+   +--->|                   |    |                       |
| Breach Tracker   |------->| Data Integration  |--->| Visualization Engine  |
+------------------+   +--->| (ETL Pipeline)    |    | (Grafana / Tableau /  |
                       |    |                   |    |  Power BI / Metabase) |
+------------------+   |    +-------------------+    +-----------------------+
| DPIA Register    |---+           |                          |
+------------------+   |           v                          v
                       |    +-------------------+    +-----------------------+
+------------------+   |    | Metrics Database  |    | Alerting System       |
| LMS (Training)   |---+    | (Time-series /    |    | - Threshold breaches  |
+------------------+   |    |  PostgreSQL)      |    | - Trend deviations    |
                       |    +-------------------+    | - SLA warnings        |
+------------------+   |                              +-----------------------+
| Consent Platform |---+
+------------------+

Metric Collection Implementation

"""
Privacy metrics collection and aggregation engine.
Collects KPI data from multiple privacy operational systems
and computes dashboard-ready metrics.
"""

from dataclasses import dataclass
from datetime import datetime, timedelta
from typing import Optional
import statistics


@dataclass
class DSARMetrics:
    period_start: datetime
    period_end: datetime
    total_received: int
    total_completed: int
    total_overdue: int
    avg_response_days: float
    median_response_days: float
    p95_response_days: float
    on_time_rate: float
    by_type: dict[str, int]
    backlog: int
    automated_rate: float


@dataclass
class BreachMetrics:
    period_start: datetime
    period_end: datetime
    total_breaches: int
    by_severity: dict[str, int]
    avg_detection_hours: float
    avg_notification_hours: float
    avg_containment_hours: float
    total_records_affected: int
    repeat_breach_count: int


@dataclass
class ConsentMetrics:
    period_start: datetime
    period_end: datetime
    total_consent_events: int
    opt_in_rate: float
    withdrawal_rate: float
    consent_rate_by_purpose: dict[str, float]
    cookie_acceptance_rate: float
    consent_freshness_pct: float


class PrivacyMetricsCollector:
    """
    Collect and compute privacy KPIs from operational data sources.
    """

    def __init__(self, dsar_repo, breach_repo, dpia_repo, training_repo, consent_repo):
        self.dsar_repo = dsar_repo
        self.breach_repo = breach_repo
        self.dpia_repo = dpia_repo
        self.training_repo = training_repo
        self.consent_repo = consent_repo

    def compute_dsar_metrics(
        self,
        start_date: datetime,
        end_date: datetime,
        regulatory_deadline_days: int = 30
    ) -> DSARMetrics:
        """Compute DSAR KPIs for a given period."""
        dsars = self.dsar_repo.get_by_period(start_date, end_date)

        completed = [d for d in dsars if d.status == "completed"]
        response_times = [
            (d.completed_at - d.received_at).days
            for d in completed
            if d.completed_at and d.received_at
        ]

       
            d for d in completed
            if (d.completed_at - d.received_at).days <= regulatory_deadline_days
        ]

        automated = [d for d in completed if d.automated]
        open_dsars = [d for d in dsars if d.status in ("open", "in_progress")]

        by_type = {}
        for d in dsars:
            by_type[d.request_type] = by_type.get(d.request_type, 0) + 1

        return DSARMetrics(
            period_start=start_date,
            period_end=end_date,
            total_received=len(dsars),
            total_completed=len(completed),
            total_overdue=len(dsars) - len(on_time) - len(open_dsars),
            avg_response_days=statistics.mean(response_times) if response_times else 0,
            median_response_days=statistics.median(response_times) if response_times else 0,
            p95_response_days=(
                sorted(response_times)[int(len(response_times) * 0.95)]
                if len(response_times) >= 20 else
                max(response_times) if response_times else 0
            ),
            / len(completed) if completed else 1.0,
            by_type=by_type,
            backlog=len(open_dsars),
            automated_rate=len(automated) / len(completed) if completed else 0,
        )

    def compute_breach_metrics(
        self,
        start_date: datetime,
        end_date: datetime
    ) -> BreachMetrics:
        """Compute breach KPIs for a given period."""
        breaches = self.breach_repo.get_by_period(start_date, end_date)

        by_severity = {}
        detection_hours = []
        notification_hours = []
        containment_hours = []
        total_records = 0

        for b in breaches:
            by_severity[b.severity] = by_severity.get(b.severity, 0) + 1
            total_records += b.records_affected or 0

            if b.detected_at and b.occurred_at:
                detection_hours.append(
                    (b.detected_at - b.occurred_at).total_seconds() / 3600
                )
            if b.notified_at and b.detected_at:
                notification_hours.append(
                    (b.notified_at - b.detected_at).total_seconds() / 3600
                )
            if b.contained_at and b.detected_at:
                containment_hours.append(
                    (b.contained_at - b.detected_at).total_seconds() / 3600
                )

        # Count repeat breaches (same root cause as previous)
        root_causes = [b.root_cause for b in breaches if b.root_cause]
        repeat_count = len(root_causes) - len(set(root_causes))

        return BreachMetrics(
            period_start=start_date,
            period_end=end_date,
            total_breaches=len(breaches),
            by_severity=by_severity,
            avg_detection_hours=statistics.mean(detection_hours) if detection_hours else 0,
            avg_notification_hours=statistics.mean(notification_hours) if notification_hours else 0,
            avg_containment_hours=statistics.mean(containment_hours) if containment_hours else 0,
            total_records_affected=total_records,
            repeat_breach_count=repeat_count,
        )

    def generate_executive_report(
        self,
        period_start: datetime,
        period_end: datetime
    ) -> dict:
        """
        Generate a comprehensive executive privacy report.
        Combines all KPI categories into a single report structure.
        """
        dsar = self.compute_dsar_metrics(period_start, period_end)
        breach = self.compute_breach_metrics(period_start, period_end)

        # Calculate overall privacy health score (0-100)
        health_components = []

        # DSAR component (25% weight)
        dsar_score = min(100, dsar.on_time_rate * 100)
        health_components.append(("DSAR Compliance", dsar_score, 0.25))

        # Breach component (30% weight)
        breach_score = 100 if breach.total_breaches == 0 else max(0, 100 - breach.total_breaches * 20)
        health_components.append(("Breach Prevention", breach_score, 0.30))

        # Response time component (20% weight)
        response_score = min(100, max(0, (30 - dsar.avg_response_days) / 30 * 100))
        health_components.append(("Response Timeliness", response_score, 0.20))

        # Detection speed component (25% weight)
        detection_score = min(100, max(0, (72 - breach.avg_detection_hours) / 72 * 100)) if breach.total_breaches > 0 else 100
        health_components.append(("Detection Speed", detection_score, 0.25))

        overall_score = sum(score * weight for _, score, weight in health_components)

        return {
            "period": {
                "start": period_start.isoformat(),
                "end": period_end.isoformat()
            },
            "overall_privacy_health_score": round(overall_score, 1),
            "health_rating": (
                "Excellent" if overall_score >= 90 else
                "Good" if overall_score >= 75 else
                "Needs Improvement" if overall_score >= 60 else
                "Critical"
            ),
            "components": {
                name: {"score": round(score, 1), "weight": f"{weight*100:.0f}%"}
                for name, score, weight in health_components
            },
            "dsar_summary": {
                "volume": dsar.total_received,
                "on_time_rate": f"{dsar.on_time_rate*100:.1f}%",
                "avg_response_days": round(dsar.avg_response_days, 1),
                "backlog": dsar.backlog
            },
            "breach_summary": {
                "count": breach.total_breaches,
                "severity_distribution": breach.by_severity,
                "avg_detection_hours": round(breach.avg_detection_hours, 1),
                "records_affected": breach.total_records_affected
            },
        }

Dashboard Visualization Patterns

Executive Summary View

Operational View

Alerting Rules

Executive Reporting Template

Monthly Privacy Board Report Structure

1. Privacy Health Score: Overall score with trend arrow
2. Key Highlights: 3-5 bullet points on notable events
3. DSAR Performance: Volume, on-time rate, top request types
4. Breach Status: Count, severity, response times, lessons learned
5. Compliance Posture: DPIA coverage, training rates, policy updates
6. Risk Outlook: Emerging risks, regulatory developments, planned changes
7. Resource Needs: Budget requests, headcount, tooling

References

• IAPP Privacy Program Management Guide (CIPM Body of Knowledge)
• NIST Privacy Framework — GV.MT Monitoring and Review
• ISO/IEC 27701:2019 — Clause 9 (Performance Evaluation)
• EDPB Guidelines on Data Breach Notification (WP250 rev.01)
• Gartner Privacy Program Metrics Framework
• ISACA Privacy Audit and Assurance Program