Compliance and Privacy Metrics, Monitoring and Reporting Questions

1. Consent Rate (active opt‑in percentage)

• Definition: % of eligible users who have given explicit consent for data processing (per-region, per-purpose).
• Data source: Consent management platform (CMP) logs + user profile flags in DB.
• Frequency: Daily, with hourly during rollout/changes.
• Alert thresholds: Warning if < 90% of historical baseline for a region; Critical if < 75% or drop of >10pp day‑over‑day.

2. Consent Coverage Completeness

• Definition: % of users with up‑to‑date consent metadata (version, timestamp, source).
• Data source: Data warehouse ETL job that compares active user list vs consent records.
• Frequency: Daily.
• Alert thresholds: Warning if coverage < 99%; Critical if < 97% or falling >1% week‑over‑week.

3. Deletion/Erasure SLA Compliance

• Definition: % of data deletion requests completed within contractual SLA (e.g., 30 days).
• Data source: Ticketing/DSAR system + background job logs.
• Frequency: Daily summary, weekly trend.
• Alert thresholds: Warning if compliance < 98%; Critical if < 95% or mean time to delete > SLA by >20%.

4. Data Access / Exfil Attempt Rate (anomalous exports)

• Definition: Number of high‑risk exports or unusually large data pulls per million requests.
• Data source: Access logs, DLP/monitoring systems, RBAC audit trails.
• Frequency: Real‑time with 15‑minute aggregation.
• Alert thresholds: Warning at 2× baseline variance; Critical at 5× or any unauthorized export detected.

5. Privacy Bug / Incident Backlog and Time‑to‑Remediate

• Definition: Count of open privacy bugs (severity ≥ medium) and median time to fix.
• Data source: Issue tracker (Jira) filtered by privacy labels + incident postmortems.
• Frequency: Daily backlog count, weekly median time.
• Alert thresholds: Warning if open privacy bugs > 5% of sprint capacity or median TTR > 7 days; Critical if any P0 privacy incident open > 24 hours or backlog exceeds 2 sprints capacity.

Notes: Tie thresholds to historical baselines and regulatory requirements; include drilldowns by region, product area, and user cohort. Combine automated alerts with SLOs and runbooks for on‑call response.