Privacy leaders spend a lot of time thinking about what their program covers. Executives spend a lot of time thinking about something different: what the program is doing for the business.
That gap between what privacy teams track and what leadership wants to understand is one of the most common friction points in mature privacy programs. And it is one that does not resolve itself. It requires privacy leaders to think carefully about how they communicate upward, not just how they operate internally.
In a previous Myna Partners webinar, Dave Cohen and Aaron Weller, who leads privacy innovation and assurance at HP, walked through what executive leadership is looking for and what kinds of reporting genuinely land versus what gets filed away and forgotten.
What Is Leadership Actually Looking for in Privacy Reporting?
When executives engage with privacy and compliance reporting, they are not looking for a summary of activities completed. They are looking for a small number of things: reduced risk, lower costs, predictability, and protection of the organization’s reputation.
For B2C organizations in particular, brand reputation is a live concern, not an abstract one. Losing customer trust through a data breach or a misuse of personal information is not something every organization recovers from. Leadership knows this. What they want to know is whether the privacy program is reducing that exposure and not just whether policies are in place.
Time to market is the other consistent theme. Privacy has long carried a reputation for slowing things down. The executives who are most invested in the compliance function are the ones who have seen it work as a business enabler, one that gets involved early enough to clear the path rather than becoming a blocker at the end. Leadership wants to see that the privacy team is embedded in the process, not bolted on at the end.
What Makes a Privacy Metric Useful?
The most common mistake in privacy reporting is reaching for the metrics that are easiest to pull rather than the ones that are most meaningful. A pie chart of assessments completed looks tidy. It does not tell leadership whether risk is going up or down.
“If it won’t change your behavior, it’s a bad metric.”
— Aaron Weller, Leader of Privacy Innovation and Assurance, HP
Aaron’s framing from the webinar is a useful test. For every metric on a compliance dashboard, the question is not whether it is measurable. It is whether a change in that metric would prompt a change in what the team does. If the answer is no, the metric is decorative.
The metrics that tend to have real impact are the ones tied to outcomes rather than activity. Time to complete privacy reviews matters less as a raw number and more as a trend, and only if the team has defined what a meaningful change looks like and what it would do about it. The percentage of findings remediated within agreed timelines is far more meaningful than the number of findings identified. It is the difference between reporting on work done and reporting on risk reduced.
Does Reporting Format Matter as Much as Reporting Content?
One of the more practical shifts discussed in the webinar was moving away from static PowerPoint reporting toward live dashboards that leadership can access directly. The insight behind this is not just about efficiency, though the time savings are real. It is about what the format signals.
“If you’re willing to be transparent with leadership, they’re probably going to see that as a signal that we have nothing to hide here. Here are the numbers in real time.”
— Dave Cohen, Director, Myna Partners
A privacy leader who can say to their CEO, “Here is a dashboard, here is the link, and you can look at this whenever you want,” is communicating something beyond the data itself. They are communicating confidence in what the program is producing. That signal matters.
The practical implication is worth taking seriously. If your current reporting process involves exporting numbers from one system, reformatting them, and building a slide deck that is outdated before it is presented, that is a process worth redesigning, not because the effort is wasted, but because there is a better way to give leadership what they want: current, clear, accessible information they can check on their own terms.
What Should You Ask Before Building the Next Privacy Report?
Before developing or redesigning KPIs and reporting structures, Aaron’s suggestion from the webinar is worth taking literally: ask leadership what they want to hear.
It sounds obvious. It happens far less often than it should. Privacy teams frequently build reporting structures based on what they think is important to communicate, without ever checking whether those are the questions leadership is asking. A short conversation at the outset (“What do you want to know from us, and how do you want to receive it?”) can reshape an entire reporting framework.
The goal is not to give leadership a compliance summary. It is to give them the information they need to make decisions and to see, clearly, that the privacy function is a working part of the business and not a separate compliance exercise running in parallel.
Frequently Asked Questions
What do executives want from privacy program reporting?
Executives are looking for a small number of things: evidence that risk is being reduced, lower costs, predictability, and protection of the organization’s reputation. They are not looking for a summary of activities completed. They want to see what the program is doing for the business.
What privacy metrics matter to leadership?
The metrics that land with leadership are tied to outcomes, not activity. The percentage of findings remediated within agreed timelines is far more meaningful than the number of findings identified. If a metric would not change what the team does, it is not a useful metric for reporting upward.
Should privacy leaders use dashboards instead of slide decks for reporting?
Live dashboards that leadership can access directly communicate something beyond the data: they signal confidence and transparency. A privacy leader who can give their CEO a real time link is saying there is nothing to hide. That signal matters as much as the numbers themselves.
How should privacy leaders find out what executives want to hear?
The most direct answer is to ask. Privacy teams frequently build reporting structures based on what they think is important without ever checking whether those are the questions leadership is asking. A short conversation at the outset (“What do you want to know, and how do you want to receive it?”) can reshape an entire reporting framework.
How can privacy teams position themselves as business enablers rather than blockers?
The executives most invested in the compliance function are the ones who have seen it work as an enabler, one that gets involved early enough to clear the path rather than becoming a blocker at the end. Reporting that shows time to market impact and early involvement in business decisions helps shift that perception over time.
>> Also in this series: What Good Execution Actually Looks Like
