Privacy-first measurement: measurement register template

Privacy-first measurement: measurement registers begin with a decision and a metric contract, not a dashboard. The contract states exactly what was observed, how it became a number and when that number is too weak to use.

This stops a count of recorded events being mistaken for people, attributed conversions being treated as incremental sales, or a modelled estimate appearing as an observation.

This guide is written for organisations measuring activity in England. ICO requirements cited here are UK-wide. Government analytical guidance is an operating reference, not a private-sector mandate. Research closed on 5 September 2026. No dataset, model, consent mechanism or report was tested. Named privacy, PECR, statistical, causal-inference and accessibility reviewers must examine the live implementation.

What to take away

A metric contract must state what was observed, how it became a number and when that number is too weak to use.
Approval of a collection record does not approve the calculation, the report or the proposed decision.
Permission logic stays outside the arithmetic; missing observations are not corrected by assuming non-recorded people behaved like recorded ones.
Verification checks the calculation against its specification, while validation checks whether the analysis fits the intended use.
The zero-denominator result is not calculable, never zero per cent.

Begin with the decision record

Write the proposed decision in one sentence. Name the decision owner, the available choices and the date by which evidence is needed. Then state what new information could reasonably change the choice. If the only planned response is to admire a chart, the measure has no operational purpose.

Separate four records:

Collection record:: what is collected, from where and under which permission and processing rules.
Calculation record:: how eligible inputs are transformed into a metric.
Reporting record:: how values, caveats, revisions and status are presented.
Decision record:: the choice, owner, evidence threshold and action.

Four separate records

Collection

Contains: Events, fields, permissions
Approval: Separate
Proves: Route only

Calculation

Contains: Transforms, joins, formula
Approval: Separate
Proves: Calculation only

Reporting

Contains: Value, caveat, revision
Approval: Separate
Proves: Readability only

Decision

Contains: Interpretation, threshold, action
Approval: Separate
Proves: Nothing alone

Approval of one record does not approve the others. A valid collection route does not prove the calculation. A correct calculation does not show causation. A readable report does not make the proposed decision sensible.

Make the metric contract complete

Every measure needs the same core fields: event or measure, numerator, denominator, population, unit, period, time zone, inclusions, exclusions, data owner and known caveat. Add source-system versions, transformation owner, quality status and permitted use.

Metric contract core fields

Event or measure
Numerator
Denominator
Population
Unit
Period and time zone
Inclusions and exclusions
Data owner and caveat

The Government Service Manual's performance-data introduction distinguishes measurements such as attempts and completions from a metric made by combining them. The page governs central government services. Its distinction is useful elsewhere because it exposes what sits above and below the line in a rate.

Metric card: eligible journey completion rate

Eligible journey completion rate

Event or measure:: a defined start followed by an approved completion event.
Numerator:: eligible journeys with one valid completion in the period.
Denominator:: eligible journeys with one valid start in the same period.
Population:: production journeys begun for the named England service, not a count of distinct people.
Unit:: percentage.
Period:: one calendar week, reported by start date.
Time zone:: Europe/London, including daylight-saving changes.
Inclusions:: authorised production starts that meet the written eligibility rule.
Exclusions:: robots, staff tests, synthetic monitoring, duplicate retries and journeys outside the scope.
Data owner:: named service performance analyst.
Known caveat:: cross-device or delayed completion may not join to its start; collection permissions can create further undercoverage.

Formula: eligible journey completion rate (%) = eligible completed journeys / eligible started journeys x 100.

The zero-denominator result is "not calculable", never zero per cent. The contract must also specify how save-and-return journeys, rejected applications and late arrivals are handled.

Metric card: reconciliation coverage

Reconciliation coverage

Event or measure:: eligible operational outcomes successfully matched to a measurement record.
Numerator:: eligible outcomes with an accepted match under the versioned join rule.
Denominator:: all eligible outcomes in the independent operational source.
Population:: outcomes recorded for the specified England operation, not customers or households.
Unit:: percentage.
Period:: the same calendar week as the completion card, after the declared maturation delay.
Time zone:: Europe/London in both systems.
Inclusions:: outcomes within the approved service, status and geography.
Exclusions:: reversals, test records and outcomes whose treatment is separately documented.
Data owner:: named reconciliation analyst; the operational owner supplies the denominator.
Known caveat:: a match can be technically correct while the original event definition is wrong; ambiguous joins can overstate coverage.

Formula: [reconciliation coverage](/privacy-first-measurement-key-metrics-in-england) (%) = accepted matched outcomes / eligible operational outcomes x 100.

Coverage is a diagnostic about the reporting pipeline. It is not an accuracy score for personal information and not evidence of marketing impact.

Metric card: controlled incremental outcome rate

Controlled incremental outcome rate

Event or measure:: the pre-specified eligible outcome observed during a controlled evaluation.
Numerator:: eligible outcomes in each assigned group.
Denominator:: eligible units assigned to that group and retained under the analysis plan.
Population:: the pre-registered England evaluation population, with its unit of assignment stated.
Unit:: outcomes per assigned unit, reported as a percentage when the outcome is binary.
Period:: the fixed intervention and follow-up window in the analysis plan.
Time zone:: Europe/London for event boundaries.
Inclusions:: units and outcomes meeting the plan written before results were examined.
Exclusions:: only pre-specified exclusions, reported by group.
Data owner:: named evaluation lead independent of campaign optimisation.
Known caveat:: interference, non-compliance, attrition or low power may limit the causal estimate.

The incremental comparison is the difference between group rates, with an uncertainty interval and exact design beside it. Do not calculate this card from channel credits.

The government's 2026 quality guidance for impact evaluation explains that outcome monitoring does not show whether an intervention caused the change. Causal confidence depends on a credible counterfactual. It was written for policy evaluation, so a commercial team must adapt the design with a qualified statistician.

Keep permission logic outside arithmetic

Map what each tag, script, pixel, SDK or comparable technology stores on or accesses from a device. Record behaviour after acceptance, refusal and withdrawal. The ICO's final April 2026 storage and access technologies guidance is UK-wide and covers more than conventional cookies.

Worked register entry: paid-social landing-page conversion

Use this as a single entry in the register; fill in the campaign period and named owner before use. The collection, calculation, reporting and decision records remain separately reviewable.

Register field	Example entry
Campaign and channel	Paid-social campaign directing visitors to a product landing page.
Decision	Use the rate to monitor campaign performance; do not treat it as incremental impact without a controlled evaluation.
Event or measure	Eligible campaign landing-page sessions followed by a valid signup completion.
Numerator	Eligible landing-page sessions with one valid signup completion in the period.
Denominator	Eligible campaign landing-page sessions in the period.
Formula	`landing-page signup rate (%) = eligible sessions with a valid signup / eligible campaign landing-page sessions x 100`
Population	Sessions assigned to the defined campaign under the documented campaign and session rule, not distinct people.
Unit	Percentage.
Period and time zone	Campaign reporting period, assigned by landing-page visit date; Europe/London, including daylight-saving changes.
Inclusions and exclusions	Include sessions meeting the campaign, measurement and collection eligibility rules. Exclude bots, staff tests, duplicate retries and sessions outside the campaign scope.
Data owner	Named campaign measurement analyst.
Collection and permission fields	In the collection record, store the permission state (acceptance, refusal or withdrawal), its effective time, the notice or interface version, the technology and purpose, and the event-eligibility rule.
Collection rule	Document what each technology may collect in each state under the applicable requirements. Keep this permission logic in the collection record, separate from the metric arithmetic.
Calculation record	Calculate from recorded events eligible under the documented collection rule. The permission-state value is not a numerator, denominator, multiplier or basis for imputing unobserved sessions.
Reporting record	Show the numerator and denominator, the observed scope and relevant coverage limitations. Label any modelled values separately from observed values.
Decision record	Name the decision owner and the action the rate may inform. A rate alone does not show that the campaign caused a change.
Known caveat	Delayed or cross-device signups may not join to a landing-page session; attribution does not establish incremental impact.

Permission state behaviour

Acceptance: record permitted behaviour
Refusal: record refused behaviour
Withdrawal: record withdrawn behaviour
Do not assume missing behaved like recorded

Do not "correct" missing observations by assuming that people who were not recorded behaved like those who were. Permission choices can be associated with device, journey and audience characteristics. Any adjustment is a model, with assumptions and uncertainty, not recovered observation.

UK GDPR processing needs its own record for purpose, lawful basis, roles, transparency, minimisation, retention, security and rights. When personal information or inferences are reported, the ICO's accuracy principle guidance requires reasonable steps against incorrect or misleading factual records and a process for challenges. Data-protection accuracy is not the same question as statistical error in an aggregate estimate.

Validate calculation before interpretation

Verification asks whether the implemented calculation matches its specification. Validation asks whether the analysis is fit for the intended use. The 2025 AQuA Book makes that distinction for government analysis and recommends assurance throughout the analytical lifecycle.

Verification versus validation

Verification

Question: Matches specification?
Method: Synthetic inputs, reproduce sample
Output: Test result with code version

Validation

Question: Fit for intended use?
Method: Challenge population, compare sources
Output: Defensible proxy and differences

For verification, run known synthetic inputs through each transformation. Check boundary dates, nulls, duplicate events, join multiplicity, currency, units, filter order and rounding. Independently reproduce a sample. Store the code or query version with its test result.

For validation, challenge the population, denominator and proxy, then compare aggregates with an independently produced source and investigate differences rather than forcing agreement.

A proxy is useful only if its relationship to the intended measure is defensible. The AQuA Book says surrogate data adds uncertainty, so record the choice and revisit it when it materially affects the analysis.

Set a stop condition before seeing results. Examples include a missing denominator, an unapproved field, a broken permission-state test, an unexplained join expansion, an inaccessible critical report or a revision that reverses the decision. The result then remains withheld, provisional or restricted until review.

Label observation, modelling and attribution

An observed value comes from recorded events under the declared collection boundary. A modelled value estimates unobserved or future quantities from assumptions and inputs. Show the two separately. Name the model, training or estimation period, population, variables, validation method, version and uncertainty. If a model fills a gap, retain the observed subtotal so readers can see what was measured.

Observation, modelling, attribution

Observed

Source: Recorded events
Shows: What was measured
Label: Observed

Modelled

Source: Assumptions and inputs
Shows: Estimated unobserved
Label: Modelled

Attributed

Source: Rule or algorithm
Shows: Credit allocation
Label: Credited

Attribution assigns credit under a rule or algorithm. It answers how the reporting system allocates an observed or modelled outcome among eligible touchpoints. It does not, by itself, estimate what would have happened without an exposure. Use "credited" in chart labels, not "caused" or "generated".

For causal incrementality, use a suitable experimental or quasi-experimental design and publish the target population, intervention, comparison, outcome, period, assignment mechanism, exclusions and uncertainty. Qualified review must consider interference, selection, missingness and power. A platform label such as data driven does not remove those duties.

Build a decision page, not a wall of charts

Put the decision, reporting status and newest material caveat first. Each displayed value should open its metric card and lineage. Show the numerator and denominator beside a rate, not only the percentage. Give the data period and last refresh separately. Mark observed, adjusted, modelled, attributed, provisional and revised values in text rather than colour alone.

Decision page essentials

Decision, status, newest caveat first
Numerator and denominator beside rate
Data period and last refresh separate
Observed, adjusted, modelled, attributed in text
Accessible data table or download
Manual keyboard and focus checks

The Government Analysis Function's 2026 dashboard testing guidance recommends visible metadata, source links, update dates, definitions, methods and quality information. It was designed for government analysts. Private dashboards still need user research, privacy checks and qualified accessibility testing for their audience.

Provide a data table or accessible download where disclosure controls permit it. Keyboard operation, focus order, headings, filter states, chart alternatives and error messages need manual checks. An attractive screenshot is not accessibility evidence.

Report uncertainty where it can change use

List sampling uncertainty, coverage error, measurement error, linkage error, model uncertainty and revision risk where they apply. Quantify an interval or sensitivity range when the method supports it. Otherwise state the likely direction and decision consequence without inventing precision.

Uncertainty to report

Sampling uncertainty
Coverage error
Measurement error
Linkage error
Model uncertainty
Revision risk

The Government Analysis Function's guidance on quality, uncertainty and change says critical limitations should be prominent rather than hidden in appendices. The page is under review and notes an accessibility gap, so use its statistical communication principles alongside current accessibility guidance.

A chart can show a change that is real in the data but immaterial to the decision. Define the smallest decision-relevant difference before reviewing the series. Do not call normal volatility a trend after two points.

Control revisions

Publish a release status: preliminary, provisional, final or corrected, with definitions agreed in advance. Keep the original value, revised value, absolute difference, relative difference where meaningful, cause, affected period, decision impact, approver and timestamp. Re-run dependent reports when a shared source changes.

Revision record fields

Release statuspreliminary, provisional, final, corrected
Original value and revised value
Absolute and relative difference
Cause and affected period
Decision impact and approver
Timestamp

Scheduled revisions incorporate later information under a known timetable. Unscheduled corrections follow an error. The uncertainty guidance distinguishes those cases. Neither should quietly replace a value in a screenshot or exported deck.

If a revision changes the action, reopen the decision record. If it reveals a systematic fault, stop related reporting and inspect earlier periods. A small numerical change can still matter where it crosses a threshold.

Treat benchmarks as research, not decoration

Before importing a comparison, match the event, numerator, denominator, population, unit, period, time zone, inclusions, exclusions, geography, owner and caveat. Also record publication date, access date, method and revision policy. A UK adult media-use estimate is not an England conversion benchmark. A count of VAT or PAYE enterprises is not an addressable market total.

Prefer a controlled internal baseline measured with the current definition. External evidence can supply context when the source population and method are clear, but it should not set a target merely because it is available. If no comparator survives the match, say so.

Connect reporting to a bounded action

Every report ends with one of four statuses: usable for the named decision, usable with a stated restriction, provisional pending a scheduled input, or withheld. Name the owner who applies the status and the evidence that would change it.

Recheck after a definition, collection route, permission interface, model, source system, attribution rule, geography or decision changes. Stop when a denominator disappears, personal information is misleading, a permission route fails, reconciliation is outside tolerance, uncertainty swallows the decision threshold, or the report becomes inaccessible to an intended user.

The purpose of the reporting process is modest but important: let the reader distinguish what was recorded, what was calculated, what was inferred and what action the evidence can support. Anything stronger needs stronger evidence.

Before you act

Write the proposed decision in one sentence.
Name the decision owner and the evidence deadline.
Complete all core metric contract fields.
Map what each tag or script stores.
Run known synthetic inputs through each transformation.
Set a stop condition before reporting.

Common questions

What four records must be separated?

The article lists a collection record, a calculation record, a reporting record and a decision record. Approval of one record does not approve the others. A valid collection route does not prove the calculation, a correct calculation does not show causation, and a readable report does not make the decision sensible.

Why should permission logic stay outside the arithmetic?

Permission choices can be associated with device, journey and audience characteristics, so people who were not recorded may differ from those who were. Assuming they behaved alike treats a model as recovered observation. Any adjustment is a model with assumptions and uncertainty, not recovered observation.

What is the difference between verification and validation?