CISO and DPO: roles, differences and how they work together

One protects the information system, the other the people whose data is processed: how the CISO and the DPO split their roles, where they overlap and how to work together.

14 October 2026 · 11 min read

Illustration: a glass shield with an orange core

The CISO and the DPO work on the same data, but not for the same reason: the former protects the information system against threats, the latter makes sure the organisation complies with the GDPR and respects people's rights. Their work overlaps constantly (security of processing, data breaches, impact assessments, processors), which raises two questions: how to split the work, and can one person hold both roles?

CISO and DPO: two roles, two logics

The CISO (in French, RSSI) sets and enforces security policy, runs risk analysis, incident response and continuity. Their scope is the whole information system: personal data, but also trade secrets, financial data and service availability. No general law mandates the role, although NIS 2 and the public sector assume such a function.

The DPO, data protection officer, is a role created by the GDPR (Articles 37 to 39). They inform and advise the organisation, monitor compliance, give opinions on impact assessments and act as contact point for the supervisory authority. Their scope is personal data and people's rights. They must be independent, receive no instructions on their tasks and report to the highest level of management.

CISO vs DPO: the differences at a glance

Criterion	CISO	DPO
What they protect	The information system and all its data (availability, integrity, confidentiality, traceability)	Personal data and data subjects' rights
Legal basis	No general law; indirect requirements from NIS 2, DORA, the public sector and healthcare	GDPR, Articles 37 to 39
Mandatory?	Rarely required by name	Yes for the public sector and some large-scale activities (Article 37)
Stance	Decides or proposes measures, runs projects	Advises and monitors, without deciding the purposes or means of processing
Independence	Depends on the organisation and reporting line	Guaranteed by law: no instructions, no penalty for performing their tasks
External contacts	National cybersecurity agency, CSIRTs, NIS 2 and DORA authorities	Data protection authority and data subjects
Key documents	Security policy, risk analysis, security plan, incident file	Record of processing, opinions on DPIAs, breach register
Background	Mostly technical and risk management	Mostly legal and compliance, with a technical culture

Where CISO and DPO work overlaps

Security of processing (Article 32). The GDPR requires technical and organisational measures appropriate to the risk. The CISO designs and implements them; the DPO checks they are proportionate for personal data.
Data protection by design (Article 25). Every new project goes past both: the CISO for security, the DPO for minimisation, retention periods and transparency.
Impact assessments. The DPIA is carried out by the controller, with the DPO's advice; its “risks to individuals” section often builds on the CISO's risk analysis.
Processors (Article 28). The DPO checks the contract clauses; the CISO assesses the provider's actual security, for instance with a security questionnaire.
Logging and employee monitoring. Logs serve security but are personal data: retention and access are decided together.
Awareness. Article 39 tasks the DPO with training staff on GDPR rules; the CISO's security awareness programme benefits from including this.

One incident, two assessments, two notifications

A data breach is when the partnership shows. The French regulator CNIL received 6,167 breach notifications in 2025, a record and up 9.5% year on year, half of them linked to hacking. For an entity covered by NIS 2, two regimes run at the same time:

Regime	Trigger	Deadlines	Recipient	Usual lead
NIS 2, Article 23	Significant incident with a substantial impact on services	Early warning within 24 h, notification within 72 h, final report within one month	CSIRT or competent authority	CISO
GDPR, Article 33	Personal data breach posing a risk to individuals	Notification within 72 h of awareness, can be completed later	Supervisory authority	DPO, for the controller
GDPR, Article 34	High risk to rights and freedoms	Without undue delay	Data subjects	DPO and communications

Animated diagram with two lanes, CISO and DPO. Hour 0: the CISO detects and contains the incident, qualifies it and preserves evidence; an arrow hands over to the DPO who, within hours, checks whether personal data is affected and assesses the risk to individuals. Within 24 hours, the CISO sends the early warning to the CSIRT or authority under NIS 2; within 72 hours, the NIS 2 incident notification (severity, impact, indicators). In parallel, within 72 hours, the DPO prepares the notification to the data protection authority on behalf of the controller. Message: the CISO measures the impact on the system, the DPO the risk to people. — Faced with the same data breach, the CISO and the DPO run two assessments in parallel and two notifications, with different deadlines under NIS 2 and the GDPR. Video labels in French (RSSI is the French acronym for CISO).

The CNIL's case study on a cyberattack at a processor shows this split: the CISO confirms the leak and triggers the alert procedure, the DPO assesses the data affected and the level of risk to individuals before notification. The CISO brings the technical facts (scope, duration, data exfiltrated); the DPO turns them into risk to people and legal duties. Each keeps a record: the incident file on one side (see ISO 27035), the breach register required by Article 33(5) on the other.

Can one person be both CISO and DPO?

GDPR Article 38(6) allows a DPO to take on other tasks provided they do not create a conflict of interest. In the X-FAB judgment of 9 February 2023, the EU Court of Justice clarified the test: the DPO cannot hold a role that leads them to determine the purposes and means of processing. The CNIL's guidance on conflicts of interest uses the CISO as an example: if they set log retention or propose security measures, as DPO they would be checking their own decisions. It is assessed case by case, and the organisation must end any conflict.

This is not theoretical: the European Data Protection Board's coordinated enforcement action on DPOs, run in 2023 by 25 authorities and based on more than 17,000 replies, calls for stronger independence and resources. Common solutions when headcount is tight:

an external or shared DPO (group, federation, service provider), with the CISO staying in-house;
a fractional CISO, with the DPO coming from legal or compliance;
if both roles remain combined, a documented recusal: where the CISO decides, the DPO opinion is given by someone else.

Organising the CISO–DPO partnership

Rather than combining the roles, most organisations formalise a partnership. A responsibility matrix avoids blind spots (R: responsible, A: accountable, C: consulted, I: informed):

Activity	CISO	DPO	Management
Security policy	R	C	A
Record of processing	C	R	A
DPIA	R (security part)	C (mandatory opinion)	A
Incident qualification	R	I then C	I
NIS 2 notification	R	I	A
Authority notification and informing individuals	C	R	A
Processor assessment	R (security)	R (contract, Article 28)	A
Staff awareness	R	R (GDPR part)	A

Three routines are often enough: a monthly meeting on new projects, incidents and incoming providers; a shared breach procedure, tested in an exercise; a joint yearly review presented to management. ISO 27701 provides a common framework for both roles, and the risk manager can bring them together around the risk map.

To keep the record of processing and run impact assessments in the same place as security assessments, Phinasoft's GDPR module connects the two.

Summary

Two different objects

The CISO protects the information system and all its data; the DPO ensures compliance with the GDPR and people's rights. The law requires a DPO in some cases, a CISO rarely.

A risky combination

A CISO who decides on security measures would, as DPO, be checking their own choices: the French regulator CNIL cites this very example of conflict of interest. It is assessed case by case.

An organised partnership

A shared breach procedure, joint review of projects and processors, two-voice impact assessments: collaboration works best when it is formalised.

Frequently asked questions

What is the difference between a CISO and a DPO?

The CISO (chief information security officer) protects the information system against threats: they set security policy and manage risks and incidents. The DPO (data protection officer) makes sure the organisation complies with the GDPR: they inform, advise, monitor and act as contact point for the supervisory authority. The former protects systems and all data, the latter people's rights.

Can the CISO also be the DPO?

Rarely a good idea. The GDPR lets a DPO take on other tasks provided they do not create a conflict of interest (Article 38(6)). The French regulator CNIL cites the CISO as an example: if they set log retention periods or propose security measures, as DPO they would be checking their own decisions. The organisation must assess the situation case by case and end any conflict.

Is a DPO mandatory?

Yes for public authorities and bodies, and for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special categories of data or criminal conviction data (GDPR Article 37). Otherwise it is optional but recommended.

Is a CISO mandatory?

No law requires every company to have a CISO. Some frameworks require or assume one: the public sector, some healthcare programmes, and NIS 2, which requires governance and accountable security managers without naming the role. Our CISO article covers these cases.

Who notifies a personal data breach to the authority?

The controller, meaning the organisation, must notify the supervisory authority within 72 hours of becoming aware of a breach that poses a risk to individuals (Article 33). In practice, the DPO often prepares the notification and the CISO provides the technical details. If the organisation is also covered by NIS 2, an early warning within 24 hours and a notification within 72 hours go in parallel to the CSIRT or competent authority.

Who do the CISO and DPO report to?

The DPO reports to the highest management level and receives no instructions on how to carry out their tasks (Article 38). The CISO reports, depending on the organisation, to the CEO, the CIO or the risk function; a direct line to executive management is increasingly recommended.

Sources (9)

A platform and service that adapt to you

Our platform is designed for fine-tuned configuration and broad adaptability to your needs.

Request a demo