How can you effectively report on data privacy metrics to the board of directors?

In my view, data privacy metrics also help to identify areas of potential and emerging compliance and operational risks. For example, a metric that reports number of DTIA processes during a period of time can be an indicator that risky data transfers are occurring regularly with high organizational impact. This metric, reported and measured overtime, is indicative of the amount of attention needed around safeguarding data transfers and monitoring trends related to cross border transfer of personal data. These metrics also matter for strategic organization planning and should prompt action by the board and necessary stakeholders.

Um ponto importante para a escolha das metas é o programa de privacidade ter uma ação consistente dentro da companhia e considerar três aspectos críticos 1- a estratégia do negócio. Sem saber os pontos de dor do negócio e a utilização de dados pessoais nessa abordagem, induz a métricas "soltas" e não trazem os Insights necessários. 2- riscos de privacidade. As métricas não são forma de identificar os riscos mas, precisam ajudar a monitorar esses riscos e auxiliar nosndirecionanebtia de planos de ação. 3- A abordagem de privacidade como parte do negócio, e não como um item externo a "ser adequado".

Another factor to consider is which information will trigger relevant action. Metrics are not just reported for the sake of reporting. They are carefully designed with the end result being appropriate action to mitigate any potential risk. Consider the pervasiveness and complexity of the area covered by the metric. A well designed metric will report on trends in high risk, widely pervasive and critical business areas.

Board members may not be the most technical people, especially around privacy. Presenting your data privacy metrics must be done in the language and manner understandable to the board and key decision makers. You should demonstrate the impact of the upward and downward trend of that metric and link to business goals and objectives. One thing that is useful to note that might drive actionability is tying those metrics back to strategic goals/ business pillars so that the board clearly understands how these metrics can enable or impede the fulfillment of this objective.