> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last updated: 2026-03-19

Project: nextjs-saas-example

Organization: Acme Inc

Privacy contact: legal@acme.com

DPO: Jane Mueller (dpo@acme-saas.com)

Reporting period: 2026

## Executive Summary

This dashboard tracks key performance indicators (KPIs) for the Acme Inc privacy program. It provides monthly metrics for DSAR handling, consent management, data subject complaints, breach incidents, and vendor compliance. Use this dashboard for board reporting, regulatory evidence, and continuous improvement of the privacy program.

Detected stack: 8 third-party services across 7 categories.

## KPI Targets

KPI | Target | Regulatory Basis
--- | --- | ---
DSAR Response Time (avg) | < 15 business days | Best practice: 30 days
DSAR Completion Rate | 100% | Regulatory requirement
Consent Opt-in Rate | > 70% | Industry benchmark
Consent Withdrawal Processing | < 48 hours | Best practice
Data Subject Complaints | < 5/month | Internal target
Breach Notification Time | < 72 hours | Best practice
Vendor DPA Coverage | 100% | Best practice
Privacy Training Completion | 100% | Best practice
Data Deletion Backlog | 0 | Regulatory requirement
AI Processing Opt-out Rate | < 10% | EU AI Act / Best practice

## 1. DSAR (Data Subject Access Request) Metrics

### Monthly DSAR Tracking — 2026

Month | Received | Completed | Pending | Avg Response (days) | Within SLA | Overdue
--- | --- | --- | --- | --- | --- | ---
Jan | _ | _ | _ | _ | _ | _
Feb | _ | _ | _ | _ | _ | _
Mar | _ | _ | _ | _ | _ | _
Apr | _ | _ | _ | _ | _ | _
May | _ | _ | _ | _ | _ | _
Jun | _ | _ | _ | _ | _ | _
Jul | _ | _ | _ | _ | _ | _
Aug | _ | _ | _ | _ | _ | _
Sep | _ | _ | _ | _ | _ | _
Oct | _ | _ | _ | _ | _ | _
Nov | _ | _ | _ | _ | _ | _
Dec | _ | _ | _ | _ | _ | _
YTD Total | _ | _ | _ | _ | _ | _

### DSAR by Request Type

Request Type | Count | Avg Processing Time | Target
--- | --- | --- | ---
Access Request | _ | _ days | 15 days
Deletion Request | _ | _ days | 15 days
Portability Request | _ | _ days | 15 days
Rectification Request | _ | _ days | 10 days
Objection to Processing | _ | _ days | 10 days
Restrict Processing | _ | _ days | 10 days

## 2. Consent Management Metrics

### Monthly Consent Tracking — 2026

Month | Total Users | Consented | Declined | Withdrawn | Opt-in Rate | Withdrawal Rate
--- | --- | --- | --- | --- | --- | ---
Jan | _ | _ | _ | _ | _% | _%
Feb | _ | _ | _ | _ | _% | _%
Mar | _ | _ | _ | _ | _% | _%
Apr | _ | _ | _ | _ | _% | _%
May | _ | _ | _ | _ | _% | _%
Jun | _ | _ | _ | _ | _% | _%
Jul | _ | _ | _ | _ | _% | _%
Aug | _ | _ | _ | _ | _% | _%
Sep | _ | _ | _ | _ | _% | _%
Oct | _ | _ | _ | _ | _% | _%
Nov | _ | _ | _ | _ | _% | _%
Dec | _ | _ | _ | _ | _% | _%
YTD Avg | _ | _ | _ | _ | _% | _%

### Consent by Purpose

Purpose | Opt-in Rate | Target
--- | --- | ---
Essential / Strictly Necessary | N/A (required) | N/A
Analytics & Performance | _% | > 60%
Marketing & Advertising | _% | > 40%
Personalization | _% | > 50%
AI / ML Processing | _% | > 50%
Third-party Sharing | _% | > 30%

## 3. Data Subject Complaints

### Monthly Complaint Tracking — 2026

Month | Received | Resolved | Escalated | Avg Resolution (days) | Satisfaction
--- | --- | --- | --- | --- | ---
Jan | _ | _ | _ | _ | _%
Feb | _ | _ | _ | _ | _%
Mar | _ | _ | _ | _ | _%
Apr | _ | _ | _ | _ | _%
May | _ | _ | _ | _ | _%
Jun | _ | _ | _ | _ | _%
Jul | _ | _ | _ | _ | _%
Aug | _ | _ | _ | _ | _%
Sep | _ | _ | _ | _ | _%
Oct | _ | _ | _ | _ | _%
Nov | _ | _ | _ | _ | _%
Dec | _ | _ | _ | _ | _%
YTD Total | _ | _ | _ | _ | _%

### Complaints by Category

Category | Count | Resolution Rate | Avg Time
--- | --- | --- | ---
Unwanted communications | _ | _% | _ days
Data accuracy | _ | _% | _ days
Delayed DSAR response | _ | _% | _ days
Unauthorized data sharing | _ | _% | _ days
Consent not respected | _ | _% | _ days
Other | _ | _% | _ days

## 4. Breach & Incident Metrics

### Monthly Incident Tracking — 2026

Month | Incidents | Breaches (notifiable) | Avg Detection (hrs) | Avg Notification (hrs) | Records Affected
--- | --- | --- | --- | --- | ---
Jan | _ | _ | _ | _ | _
Feb | _ | _ | _ | _ | _
Mar | _ | _ | _ | _ | _
Apr | _ | _ | _ | _ | _
May | _ | _ | _ | _ | _
Jun | _ | _ | _ | _ | _
Jul | _ | _ | _ | _ | _
Aug | _ | _ | _ | _ | _
Sep | _ | _ | _ | _ | _
Oct | _ | _ | _ | _ | _
Nov | _ | _ | _ | _ | _
Dec | _ | _ | _ | _ | _
YTD Total | _ | _ | _ | _ | _

### Incident Response SLA Performance

Metric | Target | Actual | Status
--- | --- | --- | ---
Time to detect | < 24 hours | _ hrs | _
Time to contain | < 48 hours | _ hrs | _
Time to notify regulator | < 72 hours | _ hrs | _
Time to notify data subjects | < 7 days | _ days | _
Post-incident review completed | < 14 days | _ days | _

## 5. Vendor Compliance Metrics

### Vendor DPA Status

Metric | Count | Percentage | Target
--- | --- | --- | ---
Total vendors detected | 8 | — | —
DPA signed and current | _ | _% | 100%
DPA pending signature | _ | _% | 0%
DPA expired / due for renewal | _ | _% | 0%
No DPA in place | _ | _% | 0%

### Vendor Review Status

Metric | Count | Status
--- | --- | ---
Reviews completed (YTD) | _ | _
Reviews overdue | _ | _
New vendors onboarded (YTD) | _ | _
Vendors offboarded (YTD) | _ | _

## 6. Privacy Training Metrics

### Training Completion — 2026

Quarter | Eligible Staff | Completed | Completion Rate | Target
--- | --- | --- | --- | ---
Q1 | _ | _ | _% | 100%
Q2 | _ | _ | _% | 100%
Q3 | _ | _ | _% | 100%
Q4 | _ | _ | _% | 100%

### Training by Topic

Topic | Completions | Pass Rate
--- | --- | ---
GDPR Fundamentals | _ | _%
Data Handling Procedures | _ | _%
Breach Response | _ | _%
Vendor Management | _ | _%
Responsible AI Use | _ | _%
DSAR Processing | _ | _%

## Monthly Privacy Scorecard Template

Use this template for monthly board/stakeholder reporting:

### Privacy Program Scorecard — [Month 2026]

KPI | Target | Actual | Trend | RAG Status
--- | --- | --- | --- | ---
DSAR Response Time | < 15 days | _ days | _ | _
DSAR Completion Rate | 100% | _% | _ | _
Consent Opt-in Rate | > 70% | _% | _ | _
Complaints Received | < 5 | _ | _ | _
Breach Incidents | 0 | _ | _ | _
Vendor DPA Coverage | 100% | _% | _ | _
Training Completion | 100% | _% | _ | _
Data Deletion Backlog | 0 | _ | _ | _

RAG Key: GREEN = On target | AMBER = Within 10% of target | RED = Exceeds target threshold

### Monthly Narrative

Highlights:

- _

Concerns:

- _

Actions for next month:

- _

## Trend Analysis

### Quarterly Comparison

KPI | Q1 | Q2 | Q3 | Q4 | YoY Change
--- | --- | --- | --- | --- | ---
DSARs Received | _ | _ | _ | _ | _%
Avg DSAR Response Time | _ | _ | _ | _ | _ days
Complaints | _ | _ | _ | _ | _%
Consent Rate | _% | _% | _% | _% | _ pts
Breaches | _ | _ | _ | _ | _
Vendor Reviews Completed | _ | _ | _ | _ | _

## Maintaining This Dashboard

- Update frequency: Monthly (first business day of each month)
- Ownership: Data Protection Officer / Privacy Team
- Data sources: DSAR log, consent management platform, incident log, vendor tracker, LMS
- Distribution: Privacy team, C-suite, board (quarterly summary)
- Automation: Re-run Codepliant to update vendor counts; manually update operational metrics

This privacy metrics dashboard was generated by Codepliant based on automated code analysis. Vendor counts and categories are auto-populated from the codebase. Operational metrics (DSAR counts, consent rates, etc.) must be manually tracked. This document does not constitute legal advice.