Measurement
Part of Privacy-first measurement: measurement register template
Privacy first measurement metrics: defining journey completion and reconciliation coverage
Define three England measurement metrics with explicit events, populations, denominators, periods, owners, caveats, stop conditions and review triggers.
Privacy first measurement key metrics should expose their denominators and missing observations. Three diagnostic rates can answer whether a journey works, whether measurement records agree with an operational source and whether collection respects its approved test cases. None is an England benchmark.
This guide was researched on 5 September 2026 for organisations measuring activity in England. ICO sources apply across the UK. No account, dataset or consent route was tested. A named privacy reviewer and statistician must approve the live definitions.
What to take away
- Three diagnostic rates show whether a journey works, whether records match an operational source and whether collection respects approved test cases.
- Each rate needs a clear numerator, denominator, status, refresh time and definition version before publication.
- A zero denominator means the result is not calculable, so never report a percentage.
- One confirmed unapproved collection event is a stop condition even when the pass rate looks favourable.
- These measures diagnose the system and do not demonstrate causal impact, profit or compliance.
Journey completion rate
Event or measure: an approved journey start followed by its defined completion event. Numerator: eligible journeys with one valid completion. Denominator: eligible journeys with one valid start. Population: production journeys begun for the named England service, not unique people. Unit: percentage. Period: one calendar week by start date. Time zone: Europe/London. Inclusions: starts meeting the written eligibility rule. Exclusions: robots, staff, synthetic monitoring, duplicate retries and out-of-scope routes. Data owner: service performance analyst. Known caveat: delayed or cross-device completions may not join, and permission choices can create undercoverage.
Journey Completion Rate Formula
eligible completed journeys / eligible started journeys x 100
Return 'not calculable' when denominator is zero
Period: one calendar week by start date
Time zone: Europe/London
Return "not calculable" when the denominator is zero. GOV.UK's completion-rate guidance identifies starts, completions and genuine-user exclusions for government transactions. Other organisations must define their own journey and eligibility rather than copying its reporting duty.
Reconciliation coverage
Event or measure: an eligible operational outcome matched to a measurement record. Numerator: eligible outcomes with one accepted match. Denominator: all eligible outcomes in the independent operational system. Population: outcomes for the specified England operation, not customers. Unit: percentage. Period: the same calendar week after an approved maturation delay. Time zone: Europe/London in both sources. Inclusions: the documented service, geography and status. Exclusions: test records, reversals and cases assigned separate treatment. Data owner: reconciliation analyst with the operational owner accountable for the denominator. Known caveat: ambiguous or many-to-many joins can inflate the result.
Reconciliation Coverage Formula
accepted matched outcomes / eligible operational outcomes x 100
Stop publication when join growth is unexplained
Stop publication when source definition has changed
Period: same calendar week after maturation delay
reconciliation coverage (%) = accepted matched outcomes / eligible operational outcomes x 100
Inspect unmatched records in both directions. Stop publication when join growth is unexplained or a source definition has changed. ONS describes coherence, comparability, accuracy, timeliness and clarity as separate quality dimensions on its quality-defined page. That framework covers official statistics, but it usefully prevents one reconciliation result from being called total quality.
Where matched fields are personal information, check factual accuracy separately. The ICO's accuracy principle addresses incorrect or misleading personal data and challenges to it. A strong aggregate match cannot waive that duty.
Permission-state test pass rate
Event or measure: execution of a pre-approved synthetic case for acceptance, refusal or withdrawal. Numerator: required cases producing exactly the authorised collection behaviour. Denominator: all required cases executed for the candidate release. Population: the fixed browser, device and permission-state matrix, not live users. Unit: percentage. Period: one release test window. Time zone: Europe/London for logs. Inclusions: every mandatory case and destination. Exclusions: optional exploratory cases, reported separately. Data owner: quality lead; the privacy reviewer owns the expected behaviour. Known caveat: synthetic coverage cannot prove every live combination or settle the legal analysis.
test pass rate (%) = required cases with authorised behaviour / required cases executed x 100
A single confirmed unapproved collection event is a stop condition even when the percentage rounds favourably. The ICO's current storage and access guidance requires a behaviour-and-purpose assessment; a tool label cannot define the expected result.
Report all three rates with numerator, denominator, status, refresh time and definition version. Recheck after a changed journey, geography, permission design, source, join rule or release. These measures diagnose the system. They do not demonstrate causal impact, profit or compliance.
Before you act
- Define the journey, eligibility rule and completion event in writing.
- Name a data owner for each rate and its denominator.
- Exclude robots, staff, synthetic monitoring and duplicate retries.
- Inspect unmatched records in both directions before publishing.
- Recheck all three rates after any journey, source or release change.
- Get privacy reviewer and statistician approval for live definitions.
Common questions
What should happen when the denominator is zero?
Return not calculable. The article states that a zero denominator means the rate cannot be calculated, so no percentage should be produced. Reporting a figure in that situation would misrepresent the measurement, because there are no eligible journeys or outcomes to divide into.
Why is a strong reconciliation match not enough for personal data?
Where matched fields are personal information, factual accuracy must be checked separately. The ICO accuracy principle covers incorrect or misleading personal data and challenges to it. A strong aggregate match cannot waive that duty, so the reconciliation result alone does not settle the accuracy question.
When should the three rates be recalculated?
Recheck after a changed journey, geography, permission design, source, join rule or release. The article also says to stop publication when join growth is unexplained or a source definition has changed, because those events can alter the numerator, denominator or both.
