# Privacy Metrics Dashboard

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**Last updated:** 2026-03-19

**Project:** nextjs-saas-example

**Organization:** Acme Inc

**Privacy contact:** legal@acme.com

**DPO:** Jane Mueller (dpo@acme-saas.com)

**Reporting period:** 2026

---

## Executive Summary

This dashboard tracks key performance indicators (KPIs) for the **Acme Inc** privacy program. It provides monthly metrics for DSAR handling, consent management, data subject complaints, breach incidents, and vendor compliance. Use this dashboard for board reporting, regulatory evidence, and continuous improvement of the privacy program.

**Detected stack:** 8 third-party services across 7 categories.

---
## KPI Targets

| KPI | Target | Regulatory Basis |
|-----|--------|-----------------|
| DSAR Response Time (avg) | < 15 business days | Best practice: 30 days |
| DSAR Completion Rate | 100% | Regulatory requirement |
| Consent Opt-in Rate | > 70% | Industry benchmark |
| Consent Withdrawal Processing | < 48 hours | Best practice |
| Data Subject Complaints | < 5/month | Internal target |
| Breach Notification Time | < 72 hours | Best practice |
| Vendor DPA Coverage | 100% | Best practice |
| Privacy Training Completion | 100% | Best practice |
| Data Deletion Backlog | 0 | Regulatory requirement |
| AI Processing Opt-out Rate | < 10% | EU AI Act / Best practice |

---
## 1. DSAR (Data Subject Access Request) Metrics

### Monthly DSAR Tracking — 2026

| Month | Received | Completed | Pending | Avg Response (days) | Within SLA | Overdue |
|-------|----------|-----------|---------|-------------------|------------|---------|
| Jan | ___ | ___ | ___ | ___ | ___ | ___ |
| Feb | ___ | ___ | ___ | ___ | ___ | ___ |
| Mar | ___ | ___ | ___ | ___ | ___ | ___ |
| Apr | ___ | ___ | ___ | ___ | ___ | ___ |
| May | ___ | ___ | ___ | ___ | ___ | ___ |
| Jun | ___ | ___ | ___ | ___ | ___ | ___ |
| Jul | ___ | ___ | ___ | ___ | ___ | ___ |
| Aug | ___ | ___ | ___ | ___ | ___ | ___ |
| Sep | ___ | ___ | ___ | ___ | ___ | ___ |
| Oct | ___ | ___ | ___ | ___ | ___ | ___ |
| Nov | ___ | ___ | ___ | ___ | ___ | ___ |
| Dec | ___ | ___ | ___ | ___ | ___ | ___ |
| **YTD Total** | ___ | ___ | ___ | ___ | ___ | ___ |

### DSAR by Request Type

| Request Type | Count | Avg Processing Time | Target |
|-------------|-------|-------------------|--------|
| Access Request | ___ | ___ days | 15 days |
| Deletion Request | ___ | ___ days | 15 days |
| Portability Request | ___ | ___ days | 15 days |
| Rectification Request | ___ | ___ days | 10 days |
| Objection to Processing | ___ | ___ days | 10 days |
| Restrict Processing | ___ | ___ days | 10 days |


---
## 2. Consent Management Metrics

### Monthly Consent Tracking — 2026

| Month | Total Users | Consented | Declined | Withdrawn | Opt-in Rate | Withdrawal Rate |
|-------|------------|-----------|----------|-----------|-------------|----------------|
| Jan | ___ | ___ | ___ | ___ | ___% | ___% |
| Feb | ___ | ___ | ___ | ___ | ___% | ___% |
| Mar | ___ | ___ | ___ | ___ | ___% | ___% |
| Apr | ___ | ___ | ___ | ___ | ___% | ___% |
| May | ___ | ___ | ___ | ___ | ___% | ___% |
| Jun | ___ | ___ | ___ | ___ | ___% | ___% |
| Jul | ___ | ___ | ___ | ___ | ___% | ___% |
| Aug | ___ | ___ | ___ | ___ | ___% | ___% |
| Sep | ___ | ___ | ___ | ___ | ___% | ___% |
| Oct | ___ | ___ | ___ | ___ | ___% | ___% |
| Nov | ___ | ___ | ___ | ___ | ___% | ___% |
| Dec | ___ | ___ | ___ | ___ | ___% | ___% |
| **YTD Avg** | ___ | ___ | ___ | ___ | ___% | ___% |

### Consent by Purpose

| Purpose | Opt-in Rate | Target |
|---------|-------------|--------|
| Essential / Strictly Necessary | N/A (required) | N/A |
| Analytics & Performance | ___% | > 60% |
| Marketing & Advertising | ___% | > 40% |
| Personalization | ___% | > 50% |
| AI / ML Processing | ___% | > 50% |
| Third-party Sharing | ___% | > 30% |

---
## 3. Data Subject Complaints

### Monthly Complaint Tracking — 2026

| Month | Received | Resolved | Escalated | Avg Resolution (days) | Satisfaction |
|-------|----------|----------|-----------|---------------------|-------------|
| Jan | ___ | ___ | ___ | ___ | ___% |
| Feb | ___ | ___ | ___ | ___ | ___% |
| Mar | ___ | ___ | ___ | ___ | ___% |
| Apr | ___ | ___ | ___ | ___ | ___% |
| May | ___ | ___ | ___ | ___ | ___% |
| Jun | ___ | ___ | ___ | ___ | ___% |
| Jul | ___ | ___ | ___ | ___ | ___% |
| Aug | ___ | ___ | ___ | ___ | ___% |
| Sep | ___ | ___ | ___ | ___ | ___% |
| Oct | ___ | ___ | ___ | ___ | ___% |
| Nov | ___ | ___ | ___ | ___ | ___% |
| Dec | ___ | ___ | ___ | ___ | ___% |
| **YTD Total** | ___ | ___ | ___ | ___ | ___% |

### Complaints by Category

| Category | Count | Resolution Rate | Avg Time |
|----------|-------|----------------|----------|
| Unwanted communications | ___ | ___% | ___ days |
| Data accuracy | ___ | ___% | ___ days |
| Delayed DSAR response | ___ | ___% | ___ days |
| Unauthorized data sharing | ___ | ___% | ___ days |
| Consent not respected | ___ | ___% | ___ days |
| Other | ___ | ___% | ___ days |

---
## 4. Breach & Incident Metrics

### Monthly Incident Tracking — 2026

| Month | Incidents | Breaches (notifiable) | Avg Detection (hrs) | Avg Notification (hrs) | Records Affected |
|-------|-----------|----------------------|--------------------|-----------------------|-----------------|
| Jan | ___ | ___ | ___ | ___ | ___ |
| Feb | ___ | ___ | ___ | ___ | ___ |
| Mar | ___ | ___ | ___ | ___ | ___ |
| Apr | ___ | ___ | ___ | ___ | ___ |
| May | ___ | ___ | ___ | ___ | ___ |
| Jun | ___ | ___ | ___ | ___ | ___ |
| Jul | ___ | ___ | ___ | ___ | ___ |
| Aug | ___ | ___ | ___ | ___ | ___ |
| Sep | ___ | ___ | ___ | ___ | ___ |
| Oct | ___ | ___ | ___ | ___ | ___ |
| Nov | ___ | ___ | ___ | ___ | ___ |
| Dec | ___ | ___ | ___ | ___ | ___ |
| **YTD Total** | ___ | ___ | ___ | ___ | ___ |

### Incident Response SLA Performance

| Metric | Target | Actual | Status |
|--------|--------|--------|--------|
| Time to detect | < 24 hours | ___ hrs | ___ |
| Time to contain | < 48 hours | ___ hrs | ___ |
| Time to notify regulator | < 72 hours | ___ hrs | ___ |
| Time to notify data subjects | < 7 days | ___ days | ___ |
| Post-incident review completed | < 14 days | ___ days | ___ |

---
## 5. Vendor Compliance Metrics

### Vendor DPA Status

| Metric | Count | Percentage | Target |
|--------|-------|-----------|--------|
| Total vendors detected | 8 | — | — |
| DPA signed and current | ___ | ___% | 100% |
| DPA pending signature | ___ | ___% | 0% |
| DPA expired / due for renewal | ___ | ___% | 0% |
| No DPA in place | ___ | ___% | 0% |

### Vendor Review Status

| Metric | Count | Status |
|--------|-------|--------|
| Reviews completed (YTD) | ___ | ___ |
| Reviews overdue | ___ | ___ |
| New vendors onboarded (YTD) | ___ | ___ |
| Vendors offboarded (YTD) | ___ | ___ |

---
## 6. Privacy Training Metrics

### Training Completion — 2026

| Quarter | Eligible Staff | Completed | Completion Rate | Target |
|---------|---------------|-----------|----------------|--------|
| Q1 | ___ | ___ | ___% | 100% |
| Q2 | ___ | ___ | ___% | 100% |
| Q3 | ___ | ___ | ___% | 100% |
| Q4 | ___ | ___ | ___% | 100% |

### Training by Topic

| Topic | Completions | Pass Rate |
|-------|------------|-----------|
| GDPR Fundamentals | ___ | ___% |
| Data Handling Procedures | ___ | ___% |
| Breach Response | ___ | ___% |
| Vendor Management | ___ | ___% |
| Responsible AI Use | ___ | ___% |
| DSAR Processing | ___ | ___% |

---
## Monthly Privacy Scorecard Template

Use this template for monthly board/stakeholder reporting:

### Privacy Program Scorecard — [Month 2026]

| KPI | Target | Actual | Trend | RAG Status |
|-----|--------|--------|-------|-----------|
| DSAR Response Time | < 15 days | ___ days | ___ | ___ |
| DSAR Completion Rate | 100% | ___% | ___ | ___ |
| Consent Opt-in Rate | > 70% | ___% | ___ | ___ |
| Complaints Received | < 5 | ___ | ___ | ___ |
| Breach Incidents | 0 | ___ | ___ | ___ |
| Vendor DPA Coverage | 100% | ___% | ___ | ___ |
| Training Completion | 100% | ___% | ___ | ___ |
| Data Deletion Backlog | 0 | ___ | ___ | ___ |

**RAG Key:** GREEN = On target | AMBER = Within 10% of target | RED = Exceeds target threshold

### Monthly Narrative

**Highlights:**
- ___

**Concerns:**
- ___

**Actions for next month:**
- ___

---
## Trend Analysis

### Quarterly Comparison

| KPI | Q1 | Q2 | Q3 | Q4 | YoY Change |
|-----|----|----|----|----|-----------|
| DSARs Received | ___ | ___ | ___ | ___ | ___% |
| Avg DSAR Response Time | ___ | ___ | ___ | ___ | ___ days |
| Complaints | ___ | ___ | ___ | ___ | ___% |
| Consent Rate | ___% | ___% | ___% | ___% | ___ pts |
| Breaches | ___ | ___ | ___ | ___ | ___ |
| Vendor Reviews Completed | ___ | ___ | ___ | ___ | ___ |

---

## Maintaining This Dashboard

- **Update frequency:** Monthly (first business day of each month)
- **Ownership:** Data Protection Officer / Privacy Team
- **Data sources:** DSAR log, consent management platform, incident log, vendor tracker, LMS
- **Distribution:** Privacy team, C-suite, board (quarterly summary)
- **Automation:** Re-run Codepliant to update vendor counts; manually update operational metrics

---

*This privacy metrics dashboard was generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on automated code analysis. Vendor counts and categories are auto-populated from the codebase. Operational metrics (DSAR counts, consent rates, etc.) must be manually tracked. This document does not constitute legal advice.*