Data protection and IT security can no longer be handled in silos. In 2026, organisations that still keep the two apart expose themselves to major financial penalties and critical security flaws. The growing number of regulatory frameworks (GDPR, NIS 2, DORA, AI Act) calls for a structured, properly equipped DPO and CISO collaboration.
This convergence is not just an administrative constraint. It makes it possible to optimise budgets, avoid duplication and react more quickly to incidents. The DPO and the CISO share a fundamental objective: protecting the company’s information assets. Their approaches complement each other naturally.
Who does what: scope and responsibilities
The CISO (Chief Information Security Officer) steers the technical security of the entire information system. They assess threats, deploy protection measures and manage the response to incidents. Their approach covers the classic triad: Availability, Integrity, Confidentiality (the CIA triad).
In practice, the CISO:
- Defines the security architecture (firewalls, antivirus, encryption)
- Oversees the monitoring of systems (SOC, SIEM)
- Coordinates the response to security incidents
- Assesses the risks linked to IT suppliers
- Trains technical teams in best practices
The DPO (Data Protection Officer) concentrates on the regulatory compliance of personal data processing. They advise the organisation on applying the GDPR and make sure the rights of data subjects are respected.
The DPO works on:
- Keeping the record of processing activities
- Carrying out Data Protection Impact Assessments (DPIAs)
- Handling requests from data subjects exercising their rights
- Notifying breaches to the CNIL (the French data protection authority)
- Training business teams in data protection issues
These missions naturally overlap. A security incident can affect personal data. A DPIA requires a technical assessment of the protection measures. This is where collaboration becomes indispensable.
The impact of new regulations
NIS 2 sets out to considerably extend the range of entities subject to cybersecurity obligations. It imposes technical and organisational measures that largely overlap with the requirements of Article 32 of the GDPR.
This regulatory convergence creates an opportunity: the same control can serve to demonstrate compliance with several frameworks. For example, implementing robust encryption meets the NIS 2 requirements on protecting systems AND the GDPR obligations on the security of personal data.
DORA (Digital Operational Resilience Act) goes further by requiring financial players to manage IT and operational risks in an integrated way. The CISO can no longer steer technical resilience without coordinating with the DPO on the protection of customer data.
This proliferation of frameworks makes manual management impossible. Organisations that cling to Excel files to steer their compliance expose themselves to major errors and an unsustainable workload.
Lessons learned: when coordination makes the difference
The Cdiscount case (January 2021)
A manager at the company, the director of one of its warehouses, extracts the data of 33 million customers between October 2020 and January 2021 and tries to sell it. Cdiscount’s cybersecurity teams detect the extraction on 29 January and stop it the following day. The employee is placed under formal investigation for fraudulent extraction of data, breach of trust and fraud.
This case shows how important technical tooling is. Without the CISO’s logs, the DPO would not have been able to assess the exact extent of the breach or demonstrate the actions taken to limit the damage.
The Dedalus Biologie case (February 2021)
Nearly 500,000 patient records exposed on cybercriminal forums. In April 2022, the CNIL fines the software publisher, a processor for medical laboratories, 1.5 million euros. During a software migration it had extracted more data than requested, its security measures were inadequate, and its contracts contained none of the terms required by Article 28 of the GDPR.
This failure could have been avoided with an automated third-party audit process, steered jointly by the DPO (contractual aspects) and the CISO (technical aspects).
Discord Inc. (November 2022)
An 800,000-euro fine for inactive accounts that had not been deleted and for failures to inform users. At the time of the inspection, the company had no written retention policy, and 2,474,000 accounts of French users had not been used for more than three years. The lack of coordination therefore began before any deletion script: there was no retention period to apply.
Organising information sharing
Effective collaboration relies on rituals that are simple but regular. No marathon meetings, just weekly technical check-ins on the topics that are critical:
Weekly incident check-in
- Review of the week’s security alerts
- Assessment of the impact on personal data
- Follow-up of remediation actions
Monthly project review
- Approval of new applications (Privacy & Security by Design)
- Assessment of new suppliers
- Update of the record of processing activities and of the risk map
Consolidated quarterly reporting
- Security and compliance KPIs
- Summary of audits and corrective actions
- Presentation to executive management
Using a collaborative platform puts an end to email ping-pong. Every change to the record of processing activities is automatically notified to the CISO. Every newly identified vulnerability is assessed by the DPO for its impact on personal data.
Joint management of security incidents
A security incident involving personal data triggers strict legal obligations: notification to the CNIL within 72 hours, informing the data subjects if the risk is high, and full documentation of the event.
Handling it calls for precisely timed coordination:
H+0: Detection and containment
The CISO takes charge of the technical response: isolating the compromised systems, forensic analysis, eradicating the threat.
H+1: Assessing the impact on personal data
The DPO analyses the information gathered by the CISO to determine whether the incident constitutes a breach within the meaning of the GDPR. They assess the number of people concerned, the types of data affected and the risks to their rights and freedoms.
H+24: Preparing the notification
The DPO drafts the notification to the CNIL, drawing on the CISO’s technical analysis. It must describe precisely the security measures that failed, those that helped limit the impact, and the remediation actions implemented.
H+72: Official notification
The notification is sent to the CNIL. The technical file consolidated by the CISO and the DPO serves as the basis for any subsequent communication.
This coordination cannot be improvised. It requires documented procedures that are tested regularly.
Pooling supplier assessment
Third-party management is a major challenge for both functions. The GDPR requires processors to be assessed on their ability to protect personal data. NIS 2 requires critical suppliers to be assessed on their level of cybersecurity.
Rather than carrying out separate audits, the DPO and the CISO can pool their questionnaires:
Legal questionnaire (led by the DPO)
- Geographical location of processing
- Retention periods applied
- Procedures for exercising rights
- Contractual clauses on data protection
Technical questionnaire (led by the CISO)
- Security architecture (encryption, access, logs)
- Backup and business continuity policy
- Security patch management
- Certifications held (ISO 27001, SOC 2)
Automating this process with tools such as Make IT Safe makes it possible to centralise the answers and trigger periodic reassessments. No more manually chasing 50 suppliers every year.
The DPIA as a collaborative project
The Data Protection Impact Assessment (DPIA) is a perfect illustration of how the DPO and the CISO complement each other. The DPO identifies the need for a DPIA and defines the legal framework. The CISO brings technical expertise to assess the risks and propose protection measures.
Phase 1: Scoping (DPO)
- Identification of the personal data processed
- Purposes and legal basis of the processing
- Retention periods and planned transfers
Phase 2: Technical analysis (CISO)
- Mapping of data flows
- Identification of threats to the information system
- Assessment of how robust the security measures are
Phase 3: Collaborative synthesis
- Assessment of the residual risk
- Approval of the mitigation measures
- Final documentation and follow-up of actions
This approach ensures that the DPIA does not remain a theoretical exercise but rests on a rigorous technical analysis.
Moving beyond manual management
Excel files have reached their limits. They can neither cope with the growing complexity of regulatory obligations nor guarantee the consistency of the information shared between the DPO and the CISO.
Mature organisations are adopting GRC (Governance, Risk and Compliance) platforms that centralise:
- The GDPR record of processing activities
- The cyber risk map
- The follow-up of audits and action plans
- Evidence of compliance across multiple frameworks
Make IT Safe addresses this problem by offering a consolidated view of security and compliance issues. The DPO and the CISO work on the same database, with access rights suited to their respective responsibilities.
This centralisation makes it possible to automate a large share of the administrative tasks: generating regulatory reports, sending automatic reminders on action plans, raising alerts when indicators drift.
Building a responsible data culture
Raising employee awareness is a major concern for both functions. Rather than multiplying communications that sometimes contradict each other, the DPO and the CISO have everything to gain from delivering a single message.
Joint awareness campaigns
- Phishing and the protection of personal data
- Good password practices and confidentiality
- Secure handling of sensitive documents
Training for business teams
- Privacy & Security by Design in projects
- Risk assessment before any new processing
- Everyday security reflexes
This approach avoids employee fatigue with messages seen as repetitive, and increases the impact of awareness initiatives.
Removing organisational obstacles
DPO/CISO collaboration sometimes runs up against internal resistance. A few success factors help overcome it:
Support from executive management
Cybersecurity and data protection issues must be championed at executive committee level. Without executive sponsorship, initiatives remain fragile.
Clarifying responsibilities
A RACI matrix (Responsible, Accountable, Consulted, Informed) helps avoid grey areas and disputes over scope.
Shared tools
Using a common platform removes the friction caused by exchanging files and by conflicting versions.
Measuring performance
Shared KPIs (compliance rate, incident response time, coverage of supplier audits) give an objective measure of how the collaboration is progressing.
The future of data governance
Artificial intelligence is already transforming the management of cyber risk and compliance. Tools that automatically detect sensitive data make it possible to keep the record of processing activities up to date without large-scale manual work.
AI also makes it easier to analyse security logs to identify anomalies likely to affect personal data. This automation frees up time for high value-added tasks: advising business teams, negotiating with suppliers, and strategic thinking about data governance.
Digital sovereignty is becoming a major selection criterion. Entrusting the management of your vulnerabilities and your GDPR records to tools whose hosting you do not control raises obvious questions of consistency. French and European solutions are gaining in maturity and offer a credible alternative to American platforms.
Measuring the effects of collaboration
The effects of a structured DPO/CISO collaboration can be read in a few indicators tracked over time: the time between detecting an incident and qualifying it under the GDPR, the share of high-risk processing activities covered by an up-to-date DPIA, and the share of critical suppliers assessed during the year. Recording their starting level before reorganising the work lets you measure the progress made rather than assume it.
In Make IT Safe, the record of processing activities, the risk map and supplier assessment share the same database: the DPO and the CISO track these indicators from a single source. To see this shared way of working, request a demonstration.
