> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Organisation: Acme Inc

Project: nextjs-saas-example

Services Monitored: 8

Generated: 2026-03-19

> This dashboard defines Key Performance Indicators (KPIs) for measuring the effectiveness of your compliance program. Regular measurement and reporting against these KPIs demonstrates accountability under GDPR, supports SOC 2 monitoring requirements, and aligns with ISO 27001 performance evaluation (Clause 9).

## KPI Overview

ID | KPI | Target | Frequency | Regulation
--- | --- | --- | --- | ---
KPI-01 | DSAR Response Time | < 25 days (GDPR allows 30) | Monthly | GDPR Art. 12(3), CCPA §1798.130
KPI-02 | DSAR Completion Rate | > 98% | Monthly | GDPR Art. 12(3)
KPI-03 | Breach Notification Speed | < 48 hours (GDPR requires 72) | Quarterly | GDPR Art. 33, NIS2 Art. 23
KPI-04 | Security Training Completion | > 95% | Quarterly | ISO 27001 A.6.3, SOC 2 CC1.4
KPI-05 | Privacy Training Completion | > 95% | Quarterly | GDPR Art. 39(1)(b)
KPI-06 | Vendor Risk Assessment Completion | > 90% | Quarterly | GDPR Art. 28, SOC 2 CC9.2
KPI-07 | Policy Document Freshness | > 90% | Quarterly | ISO 27001 7.5, SOC 2 CC1.3
KPI-08 | Consent Collection Rate | > 99% | Monthly | GDPR Art. 7, ePrivacy Directive
KPI-09 | Incident Response Time | < 60 minutes | Monthly | ISO 27001 A.5.24, NIST CSF RS.RP-1
KPI-10 | Vulnerability Remediation Time | Critical: < 1 day, High: < 7 days, Medium: < 30 days | Monthly | SOC 2 CC7.1, ISO 27001 A.8.8
KPI-11 | Data Retention Compliance | > 95% | Quarterly | GDPR Art. 5(1)(e), CCPA
KPI-12 | Access Review Completion | > 95% | Quarterly | SOC 2 CC6.1, ISO 27001 A.5.18
KPI-AI-01 | AI Model Accuracy | > 90% (application-specific) | Monthly | EU AI Act Art. 15
KPI-AI-02 | AI Bias Audit Frequency | > 1 per quarter | Quarterly | EU AI Act Art. 9, Colorado AI Act
KPI-AI-03 | AI Incident Rate | < 5 per 1000 | Monthly | EU AI Act Art. 62
KPI-AI-04 | Prompt Injection Block Rate | > 95% | Monthly | EU AI Act Art. 15, OWASP LLM01

## Core Compliance KPIs

### KPI-01: DSAR Response Time

Description: Average time to respond to Data Subject Access Requests from receipt to fulfilment

Metric: Days

Target: < 25 days (GDPR allows 30)

Measurement Frequency: Monthly

Regulatory Basis: GDPR Art. 12(3), CCPA §1798.130

Formula: `Sum of response times / Number of DSARs completed`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | < 25 days (GDPR allows 30) | ⬜ | — |
Month 2 | _ | < 25 days (GDPR allows 30) | ⬜ | — |
Month 3 | _ | < 25 days (GDPR allows 30) | ⬜ | — |

### KPI-02: DSAR Completion Rate

Description: Percentage of DSARs completed within the statutory deadline

Metric: Percentage

Target: > 98%

Measurement Frequency: Monthly

Regulatory Basis: GDPR Art. 12(3)

Formula: `(DSARs completed on time / Total DSARs received) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 98% | ⬜ | — |
Month 2 | _ | > 98% | ⬜ | — |
Month 3 | _ | > 98% | ⬜ | — |

### KPI-03: Breach Notification Speed

Description: Time from breach detection to supervisory authority notification

Metric: Hours

Target: < 48 hours (GDPR requires 72)

Measurement Frequency: Quarterly

Regulatory Basis: GDPR Art. 33, NIS2 Art. 23

Formula: `Time of notification - Time of detection`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | < 48 hours (GDPR requires 72) | ⬜ | — |
Month 2 | _ | < 48 hours (GDPR requires 72) | ⬜ | — |
Month 3 | _ | < 48 hours (GDPR requires 72) | ⬜ | — |

### KPI-04: Security Training Completion

Description: Percentage of employees who completed mandatory security awareness training

Metric: Percentage

Target: > 95%

Measurement Frequency: Quarterly

Regulatory Basis: ISO 27001 A.6.3, SOC 2 CC1.4

Formula: `(Employees completed training / Total employees) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 95% | ⬜ | — |
Month 2 | _ | > 95% | ⬜ | — |
Month 3 | _ | > 95% | ⬜ | — |

### KPI-05: Privacy Training Completion

Description: Percentage of relevant staff who completed data protection training

Metric: Percentage

Target: > 95%

Measurement Frequency: Quarterly

Regulatory Basis: GDPR Art. 39(1)(b)

Formula: `(Staff completed privacy training / Total relevant staff) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 95% | ⬜ | — |
Month 2 | _ | > 95% | ⬜ | — |
Month 3 | _ | > 95% | ⬜ | — |

### KPI-06: Vendor Risk Assessment Completion

Description: Percentage of active vendors with completed risk assessments

Metric: Percentage

Target: > 90%

Measurement Frequency: Quarterly

Regulatory Basis: GDPR Art. 28, SOC 2 CC9.2

Formula: `(Vendors assessed / Total active vendors) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 90% | ⬜ | — |
Month 2 | _ | > 90% | ⬜ | — |
Month 3 | _ | > 90% | ⬜ | — |

### KPI-07: Policy Document Freshness

Description: Percentage of compliance documents reviewed within the past 12 months

Metric: Percentage

Target: > 90%

Measurement Frequency: Quarterly

Regulatory Basis: ISO 27001 7.5, SOC 2 CC1.3

Formula: `(Documents reviewed in last 12 months / Total documents) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 90% | ⬜ | — |
Month 2 | _ | > 90% | ⬜ | — |
Month 3 | _ | > 90% | ⬜ | — |

### KPI-08: Consent Collection Rate

Description: Percentage of data processing activities with valid consent records

Metric: Percentage

Target: > 99%

Measurement Frequency: Monthly

Regulatory Basis: GDPR Art. 7, ePrivacy Directive

Formula: `(Processing activities with consent / Consent-required activities) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 99% | ⬜ | — |
Month 2 | _ | > 99% | ⬜ | — |
Month 3 | _ | > 99% | ⬜ | — |

### KPI-09: Incident Response Time

Description: Average time from security incident detection to initial response

Metric: Minutes

Target: < 60 minutes

Measurement Frequency: Monthly

Regulatory Basis: ISO 27001 A.5.24, NIST CSF RS.RP-1

Formula: `Sum of response times / Number of incidents`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | < 60 minutes | ⬜ | — |
Month 2 | _ | < 60 minutes | ⬜ | — |
Month 3 | _ | < 60 minutes | ⬜ | — |

### KPI-10: Vulnerability Remediation Time

Description: Average time to remediate identified security vulnerabilities

Metric: Days

Target: Critical: < 1 day, High: < 7 days, Medium: < 30 days

Measurement Frequency: Monthly

Regulatory Basis: SOC 2 CC7.1, ISO 27001 A.8.8

Formula: `Sum of remediation times / Number of vulnerabilities`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ⬜ | — |
Month 2 | _ | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ⬜ | — |
Month 3 | _ | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ⬜ | — |

### KPI-11: Data Retention Compliance

Description: Percentage of data stores compliant with defined retention schedules

Metric: Percentage

Target: > 95%

Measurement Frequency: Quarterly

Regulatory Basis: GDPR Art. 5(1)(e), CCPA

Formula: `(Compliant data stores / Total data stores) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 95% | ⬜ | — |
Month 2 | _ | > 95% | ⬜ | — |
Month 3 | _ | > 95% | ⬜ | — |

### KPI-12: Access Review Completion

Description: Percentage of user access reviews completed on schedule

Metric: Percentage

Target: > 95%

Measurement Frequency: Quarterly

Regulatory Basis: SOC 2 CC6.1, ISO 27001 A.5.18

Formula: `(Access reviews completed / Scheduled reviews) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 95% | ⬜ | — |
Month 2 | _ | > 95% | ⬜ | — |
Month 3 | _ | > 95% | ⬜ | — |

## AI-Specific KPIs

> The following KPIs are included because AI services were detected in your application: openai

### KPI-AI-01: AI Model Accuracy

Description: Measured accuracy of AI model outputs against ground truth

Metric: Percentage

Target: > 90% (application-specific)

Measurement Frequency: Monthly

Regulatory Basis: EU AI Act Art. 15

Formula: `(Correct predictions / Total predictions) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 90% (application-specific) | ⬜ | — |
Month 2 | _ | > 90% (application-specific) | ⬜ | — |
Month 3 | _ | > 90% (application-specific) | ⬜ | — |

### KPI-AI-02: AI Bias Audit Frequency

Description: Number of bias audits conducted on AI systems

Metric: Count

Target: > 1 per quarter

Measurement Frequency: Quarterly

Regulatory Basis: EU AI Act Art. 9, Colorado AI Act

Formula: `Count of completed bias audits in period`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 1 per quarter | ⬜ | — |
Month 2 | _ | > 1 per quarter | ⬜ | — |
Month 3 | _ | > 1 per quarter | ⬜ | — |

### KPI-AI-03: AI Incident Rate

Description: Number of AI-related incidents (hallucinations, bias events, safety triggers)

Metric: Count per 1000 interactions

Target: < 5 per 1000

Measurement Frequency: Monthly

Regulatory Basis: EU AI Act Art. 62

Formula: `(AI incidents / Total AI interactions) × 1000`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | < 5 per 1000 | ⬜ | — |
Month 2 | _ | < 5 per 1000 | ⬜ | — |
Month 3 | _ | < 5 per 1000 | ⬜ | — |

### KPI-AI-04: Prompt Injection Block Rate

Description: Percentage of prompt injection attempts successfully blocked

Metric: Percentage

Target: > 95%

Measurement Frequency: Monthly

Regulatory Basis: EU AI Act Art. 15, OWASP LLM01

Formula: `(Blocked injection attempts / Total injection attempts) × 100`

#### Tracking Template

Period | Actual | Target | Status | Trend | Notes
--- | --- | --- | --- | --- | ---
Month 1 | _ | > 95% | ⬜ | — |
Month 2 | _ | > 95% | ⬜ | — |
Month 3 | _ | > 95% | ⬜ | — |

## Monthly Reporting Template

> Copy this template each month to track your compliance KPIs.

### Month: Year:

# | KPI | Target | Actual | Status | Action Required
--- | --- | --- | --- | --- | ---
1 | DSAR Response Time | < 25 days (GDPR allows 30) | _ | ⬜ |
2 | DSAR Completion Rate | > 98% | _ | ⬜ |
3 | Consent Collection Rate | > 99% | _ | ⬜ |
4 | Incident Response Time | < 60 minutes | _ | ⬜ |
5 | Vulnerability Remediation Time | Critical: < 1 day, High: < 7 days, Medium: < 30 days | _ | ⬜ |
6 | AI Model Accuracy | > 90% (application-specific) | _ | ⬜ |
7 | AI Incident Rate | < 5 per 1000 | _ | ⬜ |
8 | Prompt Injection Block Rate | > 95% | _ | ⬜ |

Monthly Summary:

- Total KPIs meeting target: _ / 8
- KPIs trending up: _
- KPIs trending down: _
- Action items for next month:

1. _
2. _
3. _

Reported by: _

Date: _

## Quarterly Reporting Template

> Copy this template each quarter to track quarterly KPIs and provide management reporting.

### Quarter: Q Year: __

#### Quarterly KPIs

# | KPI | Target | Actual | Status | Trend vs Last Quarter
--- | --- | --- | --- | --- | ---
1 | Breach Notification Speed | < 48 hours (GDPR requires 72) | _ | ⬜ |
2 | Security Training Completion | > 95% | _ | ⬜ |
3 | Privacy Training Completion | > 95% | _ | ⬜ |
4 | Vendor Risk Assessment Completion | > 90% | _ | ⬜ |
5 | Policy Document Freshness | > 90% | _ | ⬜ |
6 | Data Retention Compliance | > 95% | _ | ⬜ |
7 | Access Review Completion | > 95% | _ | ⬜ |
8 | AI Bias Audit Frequency | > 1 per quarter | _ | ⬜ |

#### Monthly KPI Trend (Quarter)

KPI | Month 1 | Month 2 | Month 3 | Quarter Avg | Target
--- | --- | --- | --- | --- | ---
DSAR Response Time | _ | _ | _ | _ | < 25 days (GDPR allows 30)
DSAR Completion Rate | _ | _ | _ | _ | > 98%
Consent Collection Rate | _ | _ | _ | _ | > 99%
Incident Response Time | _ | _ | _ | _ | < 60 minutes
Vulnerability Remediation Time | _ | _ | _ | _ | Critical: < 1 day, High: < 7 days, Medium: < 30 days
AI Model Accuracy | _ | _ | _ | _ | > 90% (application-specific)
AI Incident Rate | _ | _ | _ | _ | < 5 per 1000
Prompt Injection Block Rate | _ | _ | _ | _ | > 95%

#### Quarterly Executive Summary

- Overall compliance posture: ⬜ Green / ⬜ Amber / ⬜ Red
- KPIs meeting target: / 16 (%)
- Key achievements this quarter:

1. _
2. _

- Key risks and concerns:

1. _
2. _

- Budget utilisation: _% of quarterly allocation
- Recommended actions for next quarter:

1. _
2. _

Reviewed by: _

Date: _

## Annual KPI Review

### Year-over-Year Comparison

KPI | Q1 | Q2 | Q3 | Q4 | Annual Avg | Target | Status
--- | --- | --- | --- | --- | --- | --- | ---
DSAR Response Time | _ | _ | _ | _ | _ | < 25 days (GDPR allows 30) | ⬜
DSAR Completion Rate | _ | _ | _ | _ | _ | > 98% | ⬜
Breach Notification Speed | _ | _ | _ | _ | _ | < 48 hours (GDPR requires 72) | ⬜
Security Training Completion | _ | _ | _ | _ | _ | > 95% | ⬜
Privacy Training Completion | _ | _ | _ | _ | _ | > 95% | ⬜
Vendor Risk Assessment Completion | _ | _ | _ | _ | _ | > 90% | ⬜
Policy Document Freshness | _ | _ | _ | _ | _ | > 90% | ⬜
Consent Collection Rate | _ | _ | _ | _ | _ | > 99% | ⬜
Incident Response Time | _ | _ | _ | _ | _ | < 60 minutes | ⬜
Vulnerability Remediation Time | _ | _ | _ | _ | _ | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ⬜
Data Retention Compliance | _ | _ | _ | _ | _ | > 95% | ⬜
Access Review Completion | _ | _ | _ | _ | _ | > 95% | ⬜
AI Model Accuracy | _ | _ | _ | _ | _ | > 90% (application-specific) | ⬜
AI Bias Audit Frequency | _ | _ | _ | _ | _ | > 1 per quarter | ⬜
AI Incident Rate | _ | _ | _ | _ | _ | < 5 per 1000 | ⬜
Prompt Injection Block Rate | _ | _ | _ | _ | _ | > 95% | ⬜

### Annual Compliance Program Score

Category | Weight | Score (1-5) | Weighted Score
--- | --- | --- | ---
Data Subject Rights | 20% | _ | _
Incident Response | 20% | _ | _
Vendor Management | 15% | _ | _
Training & Awareness | 15% | _ | _
Documentation | 15% | _ | _
Technical Controls | 15% | _ | _
AI Governance | 10% | _ | _
Total | 100% |  | _

> Score Guide: 1 = Not Implemented, 2 = Ad Hoc, 3 = Defined, 4 = Managed, 5 = Optimised

## Dashboard Implementation Guide

### Recommended Dashboard Tools

Tool | Type | Cost | Integration
--- | --- | --- | ---
Google Sheets | Spreadsheet | Free | Manual entry
Notion | Wiki/Database | Free-$10/user | Manual entry
Grafana | Dashboard | Free (OSS) | API integration
Power BI | BI Platform | $10/user | API integration
Datadog | Monitoring | $15/host | Automated

### Data Collection Automation

Where possible, automate KPI data collection:

    # Example: Run Codepliant scan as a KPI data source
    codepliant scan /path/to/project --json > compliance-scan-$(date +%Y-%m-%d).json

    # Extract compliance score
    codepliant score /path/to/project --json | jq '.score'

    # Count generated documents vs recommended
    codepliant completeness /path/to/project --json

### Alert Thresholds

KPI | Warning Threshold | Critical Threshold | Action
--- | --- | --- | ---
DSAR Response Time | > 20 days | > 27 days | Escalate to DPO
Breach Notification | > 48 hours | > 60 hours | Emergency response
Training Completion | < 90% | < 80% | Mandatory training push
Vendor Assessment | < 85% | < 75% | Vendor review sprint
Vulnerability Remediation | > SLA | > 2× SLA | Security escalation

## Contact

For questions about compliance KPIs:

- Email: legal@acme.com
- Data Protection Officer: dpo@acme-saas.com

This Compliance KPI Dashboard was generated by Codepliant based on automated code analysis. KPI targets are based on regulatory requirements and industry best practices. Adjust targets to match your organisation's risk appetite, regulatory obligations, and operational capacity. This document should be reviewed by your compliance team.