Strategy
Part of A privacy first measurement strategy that starts with the decision, then the metric
A five-frame measurement plan built to survive a hostile review
Use a five-part privacy measurement framework to connect an England decision with outcomes, proportionate data, evidence quality and named owners.
A privacy first measurement strategy framework needs five connected records: the decision, the outcome, the minimum data, the evidence test and the owner. If any record is blank, pause the collection request rather than filling the gap with a fashionable metric.
This method is for teams operating in England. UK regulator guidance supplies the legal context, while the government evaluation source is a planning aid rather than a rule for private organisations. No fieldwork or implementation informed this article. Sources were checked on 5 September 2026.
What to take away
- A five-frame plan links decision, outcome, minimum data, evidence test and owner to prevent ad hoc measurement.
- The ICO requires data protection by design and purpose limitation throughout the processing lifecycle.
- A hostile review tests whether an outsider can trace a measure from outcome to raw input.
- Removing a data source reveals whether evidence is essential or merely convenient.
Frame 1: the decision
Write the choice, decision-maker and deadline in one line. "Improve attribution" is a topic. "Decide whether to retain paid social activity after a controlled six-week test" can drive a plan.
Frame 1: the decision
What decision must be made?
retain paid social after test
stop paid social activity
List the evidence that would support, weaken or leave the decision unresolved. This prevents the team changing success criteria once results appear. Add the alternative action, including doing nothing, so the analysis compares real options.
Frame 2: the outcome chain
Separate delivery from change. The Government Communication Service Evaluation Cycle distinguishes inputs, outputs, outtakes, outcomes and impact. It was designed for public communications, but the categories help any team avoid treating reach as behaviour or business impact.
Frame 2: outcome chain
- Inputs
- Outputs
- Outtakes
- Outcomes
- Impact
Map only the steps needed for the stated decision. Note assumptions between a message being delivered, a person responding and an organisational result. Give each assumption a test or mark it untested.
Frame 3: the minimum data boundary
For every proposed event or field, state its purpose, source, retention, access and deletion. Then ask what happens to the decision if it is removed. The Information Commissioner's Office (ICO) says data protection by design must run from design through the processing lifecycle.
The ICO's data protection principles also cover storage limitation. The regulator notes that the guide is under review following the Data (Use and Access) Act. A qualified reviewer should check the current position and the actual data flow.
Frame 4: the evidence test
Specify the unit, denominator, comparison, time window and missing-data rule. For the paid social decision, one metric is incremental sign-up rate: sign-ups in the test group divided by eligible sessions, over the six-week test window, compared with a holdout group. Label observed, modelled and imported values. Run a reproducibility check before using a metric in a decision meeting.
If storage or access technologies are involved, review the current ICO technology guidance. It covers cookies, pixels, fingerprinting and related techniques under PECR and, where relevant, UK GDPR. The label "first party" does not settle the rule or prove accuracy.
Frame 5: ownership and review
Name a decision owner, data owner, privacy reviewer and delivery owner. Record who can approve a change and who can stop processing when a test fails. Set review triggers for a platform update, supplier-contract change, new purpose, unexplained discrepancy or regulator update.
The completed framework should fit on one page with links to supporting records. It does not certify compliance or predict performance. Its job is narrower: make the decision, evidence boundary and accountability visible before more data is collected.
Worked example: one decision on one page
The table below carries the paid social decision through all five frames. It is a template, not a recommendation.
| Frame | Record for the paid social decision |
|---|---|
| 1. Decision | Decide whether to retain paid social after a controlled six-week test. Decision-maker: marketing director. Deadline: six weeks after test start. |
| 2. Outcome chain | Output: delivered impressions. Outtake: ad recall. Outcome: incremental trial sign-ups. Impact: retained customers. |
| 3. Minimum data | Field: conversion flag. Purpose: measure incremental sign-ups. Source: first-party event. Retention: 90 days in this example, set by the record schedule. Access: analytics team. Deletion: after retention. |
| 4. Evidence test | Metric: incremental sign-up rate. Unit: rate. Denominator: eligible sessions. Time window: six weeks. Comparison: holdout group. Missing-data rule: exclude incomplete sessions. |
| 5. Owner | Decision owner: marketing director. Data owner: analytics lead. Privacy reviewer: data protection lead. Delivery owner: paid social manager. Review triggers: platform update, contract change, new purpose, unexplained discrepancy, regulator update. |
Put the page through a hostile review
Ask someone outside delivery to follow one measure from the stated outcome to its raw input. They should be able to find the definition, permission state, quality test and person authorised to act. If they cannot, record the break rather than explain it verbally.
Then remove one data source from the scenario. Does the decision become impossible, less certain or unchanged? That answer helps distinguish essential evidence from convenient collection. Repeat the exercise for a supplier outage and a delayed privacy approval.
Finally, date the framework and archive superseded versions. A future reviewer needs to know which purpose, fields and assumptions were approved at the time. Change control matters because a familiar metric can acquire a new use without its name changing.
Before you act
- Write the decision, decision-maker and deadline in one line.
- Map only the outcome steps needed for the stated decision.
- State purpose, source, retention, access and deletion for each data field.
- Specify unit, denominator, comparison, time window and missing-data rule.
- Name decision, data, privacy and delivery owners.
- Date the framework and archive superseded versions.
Common questions
What should a team do if any of the five records is blank?
Name the missing record first. A blank owner is the most common gap: without a decision owner, no one can approve a field or stop a test that fails. The fix is to assign the record before the next collection request.
How does the ICO guidance shape the minimum data boundary?
The guidance pushes the boundary earlier than most teams expect: define the purpose and retention before a field is collected. The Data (Use and Access) Act means the guide is under review, so a reviewer should confirm the current text against the actual data flow.
What does a hostile review of the framework involve?
Give an outsider the one-page plan and a raw data extract. Ask them to trace the chosen measure back to its source without help. If they need a verbal explanation, the plan has a gap.
