Strategy
Part of A privacy first measurement strategy that starts with the decision, then the metric
A privacy measurement planning template, from decision record to release log
Complete a privacy measurement planning template covering decisions, data fields, consent states, quality tests, supplier checks and release authority.
Copy this privacy first measurement planning template into the project record and leave unknowns blank. An empty field is a research task. A guessed value can become a false approval.
The template uses UK guidance and suits an England-based operation, but it is not legal advice or a compliance certificate. No budget, volume, consent rate or performance result has been invented. Keep the completed template in the project's version-controlled record so every change has a visible revision.
What to take away
- The template is not legal advice or a compliance certificate, despite using UK guidance.
- Record why each data item is necessary, and remove it from scope if it has no effect on the decision.
- If a team cannot reproduce a number from the specification, mark the measure unavailable rather than accepting a dashboard total.
- Approval applies only to the recorded version, purpose and period, so a change sends the section back for review.
Decision record
Field / Entry
- Decision to be made
[blank]- Accountable decision-maker
[name and role]- Latest useful decision date
[date]- Population and England scope
[definition]- Current alternative
[retain, stop or other option]- Evidence that would change the choice
[criteria]
Avoid "increase engagement" as an objective. Describe the behaviour or service outcome and the baseline. Government Digital Service guidance on measuring service success recommends choosing methods according to the question and using more than digital analytics alone. It concerns public services, so its examples are prompts rather than mandatory commercial measures.
Data and permission register
Create one row per event, field or join.
Data and permission register
- Purpose
- Data item
- Collection point
- Permission or exception under review
- Retention
- Access
- Deletion test
| Purpose | Data item | Collection point | Permission or exception under review | Retention | Access | Deletion test |
|---|---|---|---|---|---|---|
[blank] | [blank] | [blank] | [qualified review] | [period] | [roles] | [date and result] |
| Checkout completion | Order confirmed event | Order confirmation page | Consent record for analytics | 90 days | Analytics and finance roles | 2027-01-15, deletion test passed |
This row is an illustrative example, not a default retention period.
The Information Commissioner's Office (ICO) design and default guidance says privacy measures belong at design stage and throughout the lifecycle. Record why each item is necessary. If it has no effect on the decision, remove it from scope.
Measurement specification
For each metric, fill in the event definition, denominator, source system, time zone, attribution window, deduplication rule, late-data treatment and owner. Add separate fields for observed, modelled and imported components. Include a test case with synthetic data and the expected result.
Worked metric example: checkout completion rate. Numerator: order_confirmed events with analytics consent. Denominator: checkout_started events from the same logged-in user. Source system: first-party analytics. Time zone: Europe/London. Attribution window: 7 days. Deduplication: by order_id. Late data: accepted for 72 hours. Owner: analytics lead.
Record the baseline period and confounders. If a team cannot reproduce the number from the specification, mark the measure unavailable rather than accepting a dashboard total.
Quality and failure worksheet
Write at least one pass case and one failure case for each source. Use synthetic records during development. The worksheet should state the expected count, actual count, tolerated difference and investigator. Include duplicate events, missing permission, late imports, changed time zones and an identifier that cannot be joined.
Add a reconciliation row for every report used by a decision-maker:
| Report | Comparison record | Difference | Explanation evidenced? | Action owner |
|---|---|---|---|---|
[name] | [system and period] | [blank] | [yes, no or unknown] | [role] |
Set a stop rule. For example, withhold a channel comparison when the denominator is missing or a refusal-state test fails. The project must define its own threshold; this template supplies no universal tolerance.
For a worked tolerance, if the reconciliation expects 5,000 events and finds 4,850, the difference is 150 events, or 3%. A stop rule could pause publication above 2% until the owner records a reason.
Supplier and security check
List the contracting entity, processor role under review, sub-processors, hosting claim, transfer mechanism, access control, audit-log evidence, incident route, export and deletion. The ICO's controller and processor contract guidance explains required contract topics and advises professional input for contract updates.
The National Cyber Security Centre SaaS security guide is aimed at risk owners and deployment teams. It warns that services change quickly and that published guidance does not guarantee security. Attach current evidence, not an undated tick.
Release and review log
| Gate | Owner | Evidence link | Decision | Review trigger |
|---|---|---|---|---|
| Technical quality | [blank] | [record ID] | [blank] | [failure condition] |
| Privacy and legal | [blank] | [record ID] | [blank] | [rule or purpose change] |
| Commercial use | [blank] | [record ID] | [blank] | [decision date] |
Finish with unresolved questions and a stop condition. Approval applies only to the recorded version, purpose and period. A change in channel, vendor, field or audience sends the relevant section back for review.
Store the completed document beside test evidence and decision minutes, not in a presentation that loses revision history. At the next review, close obsolete questions, retain the reason for past choices and assign dates to every new gap. This gives a replacement analyst enough context to challenge the plan instead of inheriting unexplained numbers.
Before you act
- Open the decision record and name the accountable owner.
- Define the England population and the current alternative.
- Attach the permission review to each register row.
- Run the synthetic test and compare expected with actual counts.
- Record the stop rule and the percentage difference that triggers a pause.
- Commit the completed document to version control.
Common questions
What should I do with fields I cannot fill in yet?
Leave them blank. The article says an empty field is a research task, while a guessed value can become a false approval. At the next review, close obsolete questions, retain the reason for past choices and assign dates to every new gap.
How should I handle a metric my team cannot reproduce?
Mark the measure unavailable rather than accepting a dashboard total. The measurement specification requires the event definition, denominator, source system, time zone, attribution window, deduplication rule, late-data treatment and owner, plus a test case with synthetic data and the expected result.
What does the template say about supplier security evidence?
Attach current evidence, not an undated tick. The National Cyber Security Centre SaaS security guide warns that services change quickly and that published guidance does not guarantee security. List the contracting entity, processor role under review, sub-processors, hosting claim, transfer mechanism, access control, audit-log evidence, incident route, export and deletion.
