How do you benchmark and compare your data privacy metrics and indicators with your peers and competitors?

The use of privacy metrics is essential not only as a matter of planning towards compliance, but also because with these metrics it is possible to have more arguments to convince senior management of investments in the area of privacy. They can also be used to show data protection authorities that the company is doing its homework.

Organizations can follow a structured approach that involves defining relevant metrics, selecting appropriate benchmarks, and evaluating performance.

There are several reasons why privacy metrics are important, from most tactical to strategic: 1) Identify gaps and risks 2) Monitoring & evaluation 3) Audit and accountability 4) Benchmarking and improvement 5) Internal communication and culture change 6) External communication to build trust with stakeholders (customers, investors, partners) 7) Demonstrate regulatory compliance 8) Investment justification (or risk attenuation of a fine and impact on brand reputation)

The main metrics I work with are these: - Audits - Impact Assessments - Data Breaches - Incident Response - Data Subject Requests - Privacy Gaps Identified - 3rd Party Contracts - Training - Maturity Model - Value or ROI A good source of metrics is the Future of Privacy Forum's "Privacy Metrics Report".

In addition to standard documents such as DPIA, data mapping, and contract management, as well as the rules and operation of the crisis committee, I assess the criteria and privacy management processes as an integral part of the company's compliance

These metrics can include data security measures, compliance with regulations like GDPR, data breach incidents, privacy policy adherence, and data protection practices.

Now that we know why privacy metrics matter, which one should we use? Here are a few: • Data Inventory & Classification: volume of personal data collected (#), classification and location; • Protection & Security: encryption coverage (%), access control violations (success & failure %), incident response time, security & pentest frequency & results; • Governance & Compliance: historical tracking based on a selected auditing solution (score); • Quality & Accuracy: % of error-free data; • Rights & Ethics: DSRs (#), DSRs response time, PIAs completed (#)

KPIs should be aligned to the Organizational goals and objectives and should be evaluated as and when required to keep them on track as per the requirement of the organizational need. This will give the flexibility to adapt the changes if any required to meet the end goal as per the management decision to any program.

You can start by defining the key data privacy metrics that align with your organization's data privacy goals and objectives. These metrics can include data breach response time, data subject access request (DSAR) processing time, data inventory accuracy, privacy policy compliance rate, and more.

Reporting on data privacy metrics isn't very different from reporting any metrics... 1) Define objectives & KPIs. My preferred approach is based on "product thinking" rather than SMART objectives; 2) Establish baselines and targets - don't forget to conduct a privacy maturity assessment; 3) Collect data and conduct analysis: including data inventory and data flow mapping; 4) Visualize and communicate recommendations 5) Loop back for review & updates

To benchmark your data privacy practices, first define your scope—target peers or competitors in similar sectors, sizes, or regions, and decide on comparison metrics, aligning with industry standards. Collect data from credible sources like industry reports or third-party analytics services. Analyze this data with methods such as gap or SWOT analysis, or use statistical comparisons (average, median, quartiles). This analysis will reveal where you stand against your peers, uncovering improvement opportunities. Use these insights to adopt best practices, refine your strategies, or set new privacy targets, enhancing your data privacy framework.

Use benchmarking tools and techniques to compare your data privacy metrics with industry standards, peers, and competitors. This process helps in identifying strengths, weaknesses, and areas for improvement in your data privacy practices.

You can find reports from Cisco, TrustArc and many vendors. The IAPP also has some. But oftentimes, it's better to "benchmark against yourself". Use the AICPA Privacy Maturity Model or the more recent CNIL maturity model, or the New Zealand Privacy Maturity Assessment Framework (PMAF). (you can easily search for those)

The privacytech field is evolving very rapidly, so here are a few categories to consider to make your life as a privacy pro easier: • Data Mapping: automated discovery, classification, mapping, visualization. I'm on the advisory board of Opsware Data, which serve this purpose; • Data Protection: monitoring/implementing access control, encryption, etc. • Governance: tools that makes doing PIAs easier. I'm thinking of PrivacyDesigner.com, for example; • Quality: Accuracy, completeness, validation, cleansing, etc. For digital marketers, Verified-Data.com is great; • Rights: Managing DSR, CMPs...

Leveraging technology solutions like zero-trust architecture and privacy-preserving machine learning offers promising ways to safeguard sensitive information without compromising data privacy. These solutions help organizations protect data and maintain privacy in an increasingly digital landscape.

Gostaria de acrescentar que as empresas não aderindo muito o programa de privacidade de dados, acreditando que seja um "custo". Na verdade o programa baseado na LGPD, pode ajudar muito a empresa a ser mais organizada. Como por exemplo: o mapeamento de dados que pode se enxergar algum problema operacional.