Measuring privacy work without inventing a compliance score

Imagine a dashboard claiming that an organisation is 92 per cent compliant. The number looks precise, but nobody can explain whether it counts policies, systems, legal provisions or completed tasks. A missing incident process might be averaged together with several easy documentation checks and disappear inside the score.

Measure privacy work in a way that preserves the question and the evidence. Operational measures can guide decisions without claiming to calculate a legal status that the underlying data cannot establish.

Choose a question before choosing a number

Useful questions are concrete: do withdrawals reach every sending system, are former users’ accounts removed, or can the team identify the retained copies after a provider exit? Each question suggests a population, a test and a decision.

As of 22 October 2026, the relevant substantive DPDP duties are scheduled for 13 May 2027 under the commencement notification. The future section 8 framework and rule 6 describe responsibilities and safeguards. They do not make an internally invented percentage a statutory compliance determination.

Use measures as evidence about particular operations. Keep the legal interpretation, the scope of the check and the remaining uncertainty visible alongside them.

Show the denominator

Suppose a hypothetical business checks eight active sending systems and finds that six apply a withdrawal correctly. Reporting six of eight is more useful than reporting a green completion badge. The two failures need to remain visible, particularly if one handles a large or consequential workflow.

Now suppose the business has twelve sending systems but only tested eight. ‘Six of eight tested systems passed; four remain untested’ is the honest statement. Calling the result 75 per cent complete without explaining the untested population would conceal a different question.

These figures are illustrative arithmetic, not a benchmark or a measured customer result. The lesson is to publish the population, sample and exclusions so the reader can understand what the number actually means.

Separate activity from outcome

Training delivered, policies approved and tasks closed are activity measures. They can be useful, but they do not prove that a workflow behaves as intended. Pair them with observations such as whether staff can recognise the right escalation route or whether the approved retention process changes the actual system state.

A request-response measure also needs a clear start and finish. Does the clock begin at receipt, identity resolution or assignment? Does completion mean an email was sent, a downstream action succeeded or the person received a substantive answer? Define the event rather than comparing numbers with different meanings.

Do not silently combine legal deadlines, internal service targets and measured averages. A low average can coexist with serious overdue cases. Report the exceptions and the applicable requirement separately.

A hypothetical monthly readout

A small company chooses three measures: withdrawal propagation across its sending systems, outstanding access-removal tasks and unresolved retention decisions. Each measure has an owner, a defined population and an evidence link.

The readout shows that a withdrawal test failed in an old export route. The team assigns the fix and retest. It also shows that several retention questions remain unresolved because the relevant obligation has not been confirmed. Those entries remain open rather than being counted as completed because a policy draft exists.

The meeting ends with actions tied to the findings. The team does not average the three measures into a single claim that the organisation is legally compliant.

Keep risk and severity visible

Not every failed check has the same consequence. Describe the affected data, people, use and control gap. A simple prioritisation method can help, but its criteria should be explicit and should not create a false impression of mathematically precise legal risk.

Inspect significant failures individually. A small number of cases can reveal an important boundary problem, while a high pass rate on easy cases may say little about difficult ones. Explain what the test did not cover.

Use the right review obligation

The additional assessment and audit provisions for Significant Data Fiduciaries arise through section 10 and rule 13. Do not turn them into a universal claim that every business must run the same annual audit or use a particular scorecard. Other applicable requirements may differ.

For an ordinary operational readout, keep the format tied to decisions the team can make. Revise a measure if it rewards paperwork completion while hiding an unresolved data flow.

A calculated number needs an explanation of what it can establish. A trustworthy measure states what was checked, what happened and what remains. That is enough to support useful action without inventing a compliance score.