data protection metrics