MTTL really applies more to a startup portfolio, has long does the average startup from an incubator operate before it receives it's first lawsuit.

For your situation, you really want to measure how many PII records you handle per lawsuit. That way you can accurately measure the lawsuit cost per record and compare it to revenue per record to see if you're profitable.