# Compliance KPI Dashboard

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**Organisation:** Acme Inc
**Project:** nextjs-saas-example
**Services Monitored:** 8
**Generated:** 2026-03-19

---

> This dashboard defines Key Performance Indicators (KPIs) for measuring the effectiveness of your compliance program. Regular measurement and reporting against these KPIs demonstrates accountability under GDPR, supports SOC 2 monitoring requirements, and aligns with ISO 27001 performance evaluation (Clause 9).

## KPI Overview

| ID | KPI | Target | Frequency | Regulation |
|----|-----|--------|-----------|------------|
| KPI-01 | DSAR Response Time | < 25 days (GDPR allows 30) | Monthly | GDPR Art. 12(3), CCPA §1798.130 |
| KPI-02 | DSAR Completion Rate | > 98% | Monthly | GDPR Art. 12(3) |
| KPI-03 | Breach Notification Speed | < 48 hours (GDPR requires 72) | Quarterly | GDPR Art. 33, NIS2 Art. 23 |
| KPI-04 | Security Training Completion | > 95% | Quarterly | ISO 27001 A.6.3, SOC 2 CC1.4 |
| KPI-05 | Privacy Training Completion | > 95% | Quarterly | GDPR Art. 39(1)(b) |
| KPI-06 | Vendor Risk Assessment Completion | > 90% | Quarterly | GDPR Art. 28, SOC 2 CC9.2 |
| KPI-07 | Policy Document Freshness | > 90% | Quarterly | ISO 27001 7.5, SOC 2 CC1.3 |
| KPI-08 | Consent Collection Rate | > 99% | Monthly | GDPR Art. 7, ePrivacy Directive |
| KPI-09 | Incident Response Time | < 60 minutes | Monthly | ISO 27001 A.5.24, NIST CSF RS.RP-1 |
| KPI-10 | Vulnerability Remediation Time | Critical: < 1 day, High: < 7 days, Medium: < 30 days | Monthly | SOC 2 CC7.1, ISO 27001 A.8.8 |
| KPI-11 | Data Retention Compliance | > 95% | Quarterly | GDPR Art. 5(1)(e), CCPA |
| KPI-12 | Access Review Completion | > 95% | Quarterly | SOC 2 CC6.1, ISO 27001 A.5.18 |
| KPI-AI-01 | AI Model Accuracy | > 90% (application-specific) | Monthly | EU AI Act Art. 15 |
| KPI-AI-02 | AI Bias Audit Frequency | > 1 per quarter | Quarterly | EU AI Act Art. 9, Colorado AI Act |
| KPI-AI-03 | AI Incident Rate | < 5 per 1000 | Monthly | EU AI Act Art. 62 |
| KPI-AI-04 | Prompt Injection Block Rate | > 95% | Monthly | EU AI Act Art. 15, OWASP LLM01 |

## Core Compliance KPIs

### KPI-01: DSAR Response Time

**Description:** Average time to respond to Data Subject Access Requests from receipt to fulfilment
**Metric:** Days
**Target:** < 25 days (GDPR allows 30)
**Measurement Frequency:** Monthly
**Regulatory Basis:** GDPR Art. 12(3), CCPA §1798.130
**Formula:** `Sum of response times / Number of DSARs completed`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | < 25 days (GDPR allows 30) | ⬜ | — | |
| Month 2 | ___ | < 25 days (GDPR allows 30) | ⬜ | — | |
| Month 3 | ___ | < 25 days (GDPR allows 30) | ⬜ | — | |

### KPI-02: DSAR Completion Rate

**Description:** Percentage of DSARs completed within the statutory deadline
**Metric:** Percentage
**Target:** > 98%
**Measurement Frequency:** Monthly
**Regulatory Basis:** GDPR Art. 12(3)
**Formula:** `(DSARs completed on time / Total DSARs received) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 98% | ⬜ | — | |
| Month 2 | ___ | > 98% | ⬜ | — | |
| Month 3 | ___ | > 98% | ⬜ | — | |

### KPI-03: Breach Notification Speed

**Description:** Time from breach detection to supervisory authority notification
**Metric:** Hours
**Target:** < 48 hours (GDPR requires 72)
**Measurement Frequency:** Quarterly
**Regulatory Basis:** GDPR Art. 33, NIS2 Art. 23
**Formula:** `Time of notification - Time of detection`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | < 48 hours (GDPR requires 72) | ⬜ | — | |
| Month 2 | ___ | < 48 hours (GDPR requires 72) | ⬜ | — | |
| Month 3 | ___ | < 48 hours (GDPR requires 72) | ⬜ | — | |

### KPI-04: Security Training Completion

**Description:** Percentage of employees who completed mandatory security awareness training
**Metric:** Percentage
**Target:** > 95%
**Measurement Frequency:** Quarterly
**Regulatory Basis:** ISO 27001 A.6.3, SOC 2 CC1.4
**Formula:** `(Employees completed training / Total employees) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 95% | ⬜ | — | |
| Month 2 | ___ | > 95% | ⬜ | — | |
| Month 3 | ___ | > 95% | ⬜ | — | |

### KPI-05: Privacy Training Completion

**Description:** Percentage of relevant staff who completed data protection training
**Metric:** Percentage
**Target:** > 95%
**Measurement Frequency:** Quarterly
**Regulatory Basis:** GDPR Art. 39(1)(b)
**Formula:** `(Staff completed privacy training / Total relevant staff) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 95% | ⬜ | — | |
| Month 2 | ___ | > 95% | ⬜ | — | |
| Month 3 | ___ | > 95% | ⬜ | — | |

### KPI-06: Vendor Risk Assessment Completion

**Description:** Percentage of active vendors with completed risk assessments
**Metric:** Percentage
**Target:** > 90%
**Measurement Frequency:** Quarterly
**Regulatory Basis:** GDPR Art. 28, SOC 2 CC9.2
**Formula:** `(Vendors assessed / Total active vendors) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 90% | ⬜ | — | |
| Month 2 | ___ | > 90% | ⬜ | — | |
| Month 3 | ___ | > 90% | ⬜ | — | |

### KPI-07: Policy Document Freshness

**Description:** Percentage of compliance documents reviewed within the past 12 months
**Metric:** Percentage
**Target:** > 90%
**Measurement Frequency:** Quarterly
**Regulatory Basis:** ISO 27001 7.5, SOC 2 CC1.3
**Formula:** `(Documents reviewed in last 12 months / Total documents) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 90% | ⬜ | — | |
| Month 2 | ___ | > 90% | ⬜ | — | |
| Month 3 | ___ | > 90% | ⬜ | — | |

### KPI-08: Consent Collection Rate

**Description:** Percentage of data processing activities with valid consent records
**Metric:** Percentage
**Target:** > 99%
**Measurement Frequency:** Monthly
**Regulatory Basis:** GDPR Art. 7, ePrivacy Directive
**Formula:** `(Processing activities with consent / Consent-required activities) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 99% | ⬜ | — | |
| Month 2 | ___ | > 99% | ⬜ | — | |
| Month 3 | ___ | > 99% | ⬜ | — | |

### KPI-09: Incident Response Time

**Description:** Average time from security incident detection to initial response
**Metric:** Minutes
**Target:** < 60 minutes
**Measurement Frequency:** Monthly
**Regulatory Basis:** ISO 27001 A.5.24, NIST CSF RS.RP-1
**Formula:** `Sum of response times / Number of incidents`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | < 60 minutes | ⬜ | — | |
| Month 2 | ___ | < 60 minutes | ⬜ | — | |
| Month 3 | ___ | < 60 minutes | ⬜ | — | |

### KPI-10: Vulnerability Remediation Time

**Description:** Average time to remediate identified security vulnerabilities
**Metric:** Days
**Target:** Critical: < 1 day, High: < 7 days, Medium: < 30 days
**Measurement Frequency:** Monthly
**Regulatory Basis:** SOC 2 CC7.1, ISO 27001 A.8.8
**Formula:** `Sum of remediation times / Number of vulnerabilities`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ⬜ | — | |
| Month 2 | ___ | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ⬜ | — | |
| Month 3 | ___ | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ⬜ | — | |

### KPI-11: Data Retention Compliance

**Description:** Percentage of data stores compliant with defined retention schedules
**Metric:** Percentage
**Target:** > 95%
**Measurement Frequency:** Quarterly
**Regulatory Basis:** GDPR Art. 5(1)(e), CCPA
**Formula:** `(Compliant data stores / Total data stores) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 95% | ⬜ | — | |
| Month 2 | ___ | > 95% | ⬜ | — | |
| Month 3 | ___ | > 95% | ⬜ | — | |

### KPI-12: Access Review Completion

**Description:** Percentage of user access reviews completed on schedule
**Metric:** Percentage
**Target:** > 95%
**Measurement Frequency:** Quarterly
**Regulatory Basis:** SOC 2 CC6.1, ISO 27001 A.5.18
**Formula:** `(Access reviews completed / Scheduled reviews) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 95% | ⬜ | — | |
| Month 2 | ___ | > 95% | ⬜ | — | |
| Month 3 | ___ | > 95% | ⬜ | — | |

## AI-Specific KPIs

> The following KPIs are included because AI services were detected in your application: openai

### KPI-AI-01: AI Model Accuracy

**Description:** Measured accuracy of AI model outputs against ground truth
**Metric:** Percentage
**Target:** > 90% (application-specific)
**Measurement Frequency:** Monthly
**Regulatory Basis:** EU AI Act Art. 15
**Formula:** `(Correct predictions / Total predictions) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 90% (application-specific) | ⬜ | — | |
| Month 2 | ___ | > 90% (application-specific) | ⬜ | — | |
| Month 3 | ___ | > 90% (application-specific) | ⬜ | — | |

### KPI-AI-02: AI Bias Audit Frequency

**Description:** Number of bias audits conducted on AI systems
**Metric:** Count
**Target:** > 1 per quarter
**Measurement Frequency:** Quarterly
**Regulatory Basis:** EU AI Act Art. 9, Colorado AI Act
**Formula:** `Count of completed bias audits in period`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 1 per quarter | ⬜ | — | |
| Month 2 | ___ | > 1 per quarter | ⬜ | — | |
| Month 3 | ___ | > 1 per quarter | ⬜ | — | |

### KPI-AI-03: AI Incident Rate

**Description:** Number of AI-related incidents (hallucinations, bias events, safety triggers)
**Metric:** Count per 1000 interactions
**Target:** < 5 per 1000
**Measurement Frequency:** Monthly
**Regulatory Basis:** EU AI Act Art. 62
**Formula:** `(AI incidents / Total AI interactions) × 1000`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | < 5 per 1000 | ⬜ | — | |
| Month 2 | ___ | < 5 per 1000 | ⬜ | — | |
| Month 3 | ___ | < 5 per 1000 | ⬜ | — | |

### KPI-AI-04: Prompt Injection Block Rate

**Description:** Percentage of prompt injection attempts successfully blocked
**Metric:** Percentage
**Target:** > 95%
**Measurement Frequency:** Monthly
**Regulatory Basis:** EU AI Act Art. 15, OWASP LLM01
**Formula:** `(Blocked injection attempts / Total injection attempts) × 100`

#### Tracking Template

| Period | Actual | Target | Status | Trend | Notes |
|--------|--------|--------|--------|-------|-------|
| Month 1 | ___ | > 95% | ⬜ | — | |
| Month 2 | ___ | > 95% | ⬜ | — | |
| Month 3 | ___ | > 95% | ⬜ | — | |

## Monthly Reporting Template

> Copy this template each month to track your compliance KPIs.

### Month: __________ Year: __________

| # | KPI | Target | Actual | Status | Action Required |
|---|-----|--------|--------|--------|-----------------|
| 1 | DSAR Response Time | < 25 days (GDPR allows 30) | ___ | ⬜ | |
| 2 | DSAR Completion Rate | > 98% | ___ | ⬜ | |
| 3 | Consent Collection Rate | > 99% | ___ | ⬜ | |
| 4 | Incident Response Time | < 60 minutes | ___ | ⬜ | |
| 5 | Vulnerability Remediation Time | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ___ | ⬜ | |
| 6 | AI Model Accuracy | > 90% (application-specific) | ___ | ⬜ | |
| 7 | AI Incident Rate | < 5 per 1000 | ___ | ⬜ | |
| 8 | Prompt Injection Block Rate | > 95% | ___ | ⬜ | |

**Monthly Summary:**
- Total KPIs meeting target: ___ / 8
- KPIs trending up: ___
- KPIs trending down: ___
- Action items for next month:
  1. ___
  2. ___
  3. ___

**Reported by:** _______________
**Date:** _______________

## Quarterly Reporting Template

> Copy this template each quarter to track quarterly KPIs and provide management reporting.

### Quarter: Q__ Year: __________

#### Quarterly KPIs

| # | KPI | Target | Actual | Status | Trend vs Last Quarter |
|---|-----|--------|--------|--------|----------------------|
| 1 | Breach Notification Speed | < 48 hours (GDPR requires 72) | ___ | ⬜ | |
| 2 | Security Training Completion | > 95% | ___ | ⬜ | |
| 3 | Privacy Training Completion | > 95% | ___ | ⬜ | |
| 4 | Vendor Risk Assessment Completion | > 90% | ___ | ⬜ | |
| 5 | Policy Document Freshness | > 90% | ___ | ⬜ | |
| 6 | Data Retention Compliance | > 95% | ___ | ⬜ | |
| 7 | Access Review Completion | > 95% | ___ | ⬜ | |
| 8 | AI Bias Audit Frequency | > 1 per quarter | ___ | ⬜ | |

#### Monthly KPI Trend (Quarter)

| KPI | Month 1 | Month 2 | Month 3 | Quarter Avg | Target |
|-----|---------|---------|---------|-------------|--------|
| DSAR Response Time | ___ | ___ | ___ | ___ | < 25 days (GDPR allows 30) |
| DSAR Completion Rate | ___ | ___ | ___ | ___ | > 98% |
| Consent Collection Rate | ___ | ___ | ___ | ___ | > 99% |
| Incident Response Time | ___ | ___ | ___ | ___ | < 60 minutes |
| Vulnerability Remediation Time | ___ | ___ | ___ | ___ | Critical: < 1 day, High: < 7 days, Medium: < 30 days |
| AI Model Accuracy | ___ | ___ | ___ | ___ | > 90% (application-specific) |
| AI Incident Rate | ___ | ___ | ___ | ___ | < 5 per 1000 |
| Prompt Injection Block Rate | ___ | ___ | ___ | ___ | > 95% |

#### Quarterly Executive Summary

- **Overall compliance posture:** ⬜ Green / ⬜ Amber / ⬜ Red
- **KPIs meeting target:** ___ / 16 (___%)
- **Key achievements this quarter:**
  1. ___
  2. ___
- **Key risks and concerns:**
  1. ___
  2. ___
- **Budget utilisation:** ___% of quarterly allocation
- **Recommended actions for next quarter:**
  1. ___
  2. ___

**Reviewed by:** _______________
**Date:** _______________

## Annual KPI Review

### Year-over-Year Comparison

| KPI | Q1 | Q2 | Q3 | Q4 | Annual Avg | Target | Status |
|-----|----|----|----|----|------------|--------|--------|
| DSAR Response Time | ___ | ___ | ___ | ___ | ___ | < 25 days (GDPR allows 30) | ⬜ |
| DSAR Completion Rate | ___ | ___ | ___ | ___ | ___ | > 98% | ⬜ |
| Breach Notification Speed | ___ | ___ | ___ | ___ | ___ | < 48 hours (GDPR requires 72) | ⬜ |
| Security Training Completion | ___ | ___ | ___ | ___ | ___ | > 95% | ⬜ |
| Privacy Training Completion | ___ | ___ | ___ | ___ | ___ | > 95% | ⬜ |
| Vendor Risk Assessment Completion | ___ | ___ | ___ | ___ | ___ | > 90% | ⬜ |
| Policy Document Freshness | ___ | ___ | ___ | ___ | ___ | > 90% | ⬜ |
| Consent Collection Rate | ___ | ___ | ___ | ___ | ___ | > 99% | ⬜ |
| Incident Response Time | ___ | ___ | ___ | ___ | ___ | < 60 minutes | ⬜ |
| Vulnerability Remediation Time | ___ | ___ | ___ | ___ | ___ | Critical: < 1 day, High: < 7 days, Medium: < 30 days | ⬜ |
| Data Retention Compliance | ___ | ___ | ___ | ___ | ___ | > 95% | ⬜ |
| Access Review Completion | ___ | ___ | ___ | ___ | ___ | > 95% | ⬜ |
| AI Model Accuracy | ___ | ___ | ___ | ___ | ___ | > 90% (application-specific) | ⬜ |
| AI Bias Audit Frequency | ___ | ___ | ___ | ___ | ___ | > 1 per quarter | ⬜ |
| AI Incident Rate | ___ | ___ | ___ | ___ | ___ | < 5 per 1000 | ⬜ |
| Prompt Injection Block Rate | ___ | ___ | ___ | ___ | ___ | > 95% | ⬜ |

### Annual Compliance Program Score

| Category | Weight | Score (1-5) | Weighted Score |
|----------|--------|-------------|----------------|
| Data Subject Rights | 20% | ___ | ___ |
| Incident Response | 20% | ___ | ___ |
| Vendor Management | 15% | ___ | ___ |
| Training & Awareness | 15% | ___ | ___ |
| Documentation | 15% | ___ | ___ |
| Technical Controls | 15% | ___ | ___ |
| AI Governance | 10% | ___ | ___ |
| **Total** | **100%** | | **___** |

> **Score Guide:** 1 = Not Implemented, 2 = Ad Hoc, 3 = Defined, 4 = Managed, 5 = Optimised

## Dashboard Implementation Guide

### Recommended Dashboard Tools

| Tool | Type | Cost | Integration |
|------|------|------|-------------|
| Google Sheets | Spreadsheet | Free | Manual entry |
| Notion | Wiki/Database | Free-$10/user | Manual entry |
| Grafana | Dashboard | Free (OSS) | API integration |
| Power BI | BI Platform | $10/user | API integration |
| Datadog | Monitoring | $15/host | Automated |

### Data Collection Automation

Where possible, automate KPI data collection:

```
# Example: Run Codepliant scan as a KPI data source
codepliant scan /path/to/project --json > compliance-scan-$(date +%Y-%m-%d).json

# Extract compliance score
codepliant score /path/to/project --json | jq '.score'

# Count generated documents vs recommended
codepliant completeness /path/to/project --json
```

### Alert Thresholds

| KPI | Warning Threshold | Critical Threshold | Action |
|-----|------------------|--------------------|--------|
| DSAR Response Time | > 20 days | > 27 days | Escalate to DPO |
| Breach Notification | > 48 hours | > 60 hours | Emergency response |
| Training Completion | < 90% | < 80% | Mandatory training push |
| Vendor Assessment | < 85% | < 75% | Vendor review sprint |
| Vulnerability Remediation | > SLA | > 2× SLA | Security escalation |

## Contact

For questions about compliance KPIs:

- **Email:** legal@acme.com
- **Data Protection Officer:** dpo@acme-saas.com

---

*This Compliance KPI Dashboard was generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on automated code analysis. KPI targets are based on regulatory requirements and industry best practices. Adjust targets to match your organisation's risk appetite, regulatory obligations, and operational capacity. This document should be reviewed by your compliance team.*