◇ OpenCyber Academy
Bachelor's · Chapter 15 · English

Chapter 15 — Evidence and measurement

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Evidence and measurement

Lesson map

Lesson 15 published. Map, example, EX043.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Access requests from parents"]
  N2["15.2 Causes"]
  N3["15.3 Targets and process"]
  N4["15.4 Monitoring"]
  N5["Lab — Response times for parents' access requests"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX043"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Access requests from parents"]
  N2["15.2 Causes"]
  N3["15.3 Targets and process"]
  N4["15.4 Monitoring"]
  N5["Lab — Response times for parents' access requests"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX043"]

[Learning outcomes]
    |
    v
[15.1 Access requests from parents]
    |
    v
[15.2 Causes]
    |
    v
[15.3 Targets and process]
    |
    v
[15.4 Monitoring]
    |
    v
[Lab — Response times for parents' access requests]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX043]

Learning outcomes

You will (1) measure performance on rights requests; (2) identify causes of delay; (3) set targets and monitoring.

15.1 Access requests from parents

Parents can request access to their child's data, and children can make requests themselves when mature enough. Elena collects synthetic data on twenty requests from the past year. The median response time is 26 days and the mean 26.8. Six of the twenty, 30%, took longer than thirty days, the approximate one-month limit in GDPR Article 12(3). The longest took 61 days. The figures give the trust its first factual picture of how it handles requests. Several took over a month. Most were answered on time, but delays clustered around holidays.

15.2 Causes

Elena looks at the late requests. All four requests received just before school holidays were late, because staff were away. She also finds that requests went to individual schools rather than a central point, so handling varied. She explains that the GDPR deadline continues during holidays, although Article 12(3) allows extension by two months for complex or numerous requests if the requester is told within the first month. Holidays alone do not justify an extension. Most delays came from school holidays. Planning can fix this.

15.3 Targets and process

Elena proposes a central request inbox managed by the data protection lead, a holiday cover rota and a target of answering all requests within twenty-five days to leave a margin. She also proposes a template letter for extensions where genuinely needed. EDPB Guidelines 01/2022 on the right of access help her design the identity check and the content of responses. She presents the plan to the trust's leadership with the measured baseline. The plan sets a twenty-day internal target. Each request is logged centrally from day one.

15.4 Monitoring

Elena sets up a simple monthly report: requests received, open requests, median time and late requests. She explains that measuring regularly turns a one-off review into a feedback loop. Dr. Asante points out that small numbers make percentages jumpy, so she reports counts alongside percentages. Six months later, after the new process starts, no requests are late. She reports the improvement with the caution that the sample is small. With so few requests, one late case changes the percentage sharply. Counts are shown too.

Lab — Response times for parents' access requests

# Subject access requests from parents over one year: days to respond, one-month (30-day) target.
import statistics
days = [12, 25, 31, 8, 44, 19, 27, 30, 52, 15, 22, 35, 9, 28, 61, 17, 24, 29, 33, 14]
print(f"requests {len(days)}; median {statistics.median(days)} days; mean {statistics.mean(days):.1f}")
late = [d for d in days if d > 30]
print(f"late (>30 days): {len(late)} of {len(days)} ({len(late)/len(days):.0%}); longest {max(days)} days")
print("holiday-period requests late:", sum(1 for d in [44, 52, 61, 35] if d > 30), "of 4")

Run with python3 lab_sar.py. Verified output:

requests 20; median 26.0 days; mean 26.8
late (>30 days): 6 of 20 (30%); longest 61 days
holiday-period requests late: 4 of 4

Worked example

Elena measures a median of 26 days with 6 of 20 requests late (all four holiday-period requests), centralises handling with holiday cover and monitors monthly.

Synthetic case. Requests are synthetic; GDPR Article 12(3) and EDPB Guidelines 01/2022 are real.

Errors and limits

Twenty requests are few; one late case changes the percentage a lot.

Exercises

Synthesis

Chapter 15 measures rights handling. Chapter 16 studies security architecture.

Continue studying — chapter 15 of 40

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →