Eight years after the GDPR became applicable, the DPO function has changed considerably. Initially focused on keeping the record of processing activities, it has become a strategic cog in the organisation. But this change comes with growing complexity: in 2026, the GDPR interacts with around ten other regulations (DORA, NIS2, AI Act) that create a dense regulatory mesh.
This reality is pushing DPOs towards a more collaborative approach. Gone are the days when they could manage their scope alone from an Excel file. Today, they orchestrate an ecosystem of internal and external actors, each with their own technical and budgetary constraints. Privacy by Design is no longer an option: it is an operational necessity that requires suitable tools.
The evolution of the DPO function: from documentation to strategic orchestration
The interconnection between the GDPR, NIS2 and DORA in 2026
The regulatory landscape of 2026 calls for an integrated view of data governance. NIS2, applicable to essential and important entities, requires cybersecurity measures that directly overlap with GDPR obligations. DORA, specific to the financial sector, imposes an operational resilience that affects the management of customers’ personal data.
For DPOs in the sectors concerned, this means that every data protection impact assessment (DPIA) must now include business continuity and crisis management considerations. The siloed approach is no longer viable. A security incident can simultaneously trigger an obligation to notify the CNIL (72 hours maximum), ANSSI and the ACPR, depending on the case.
This interconnection justifies adopting GDPR compliance software capable of handling several frameworks. Rather than maintaining three separate processes, organisations can centralise their obligations on a single platform that automates the cross-checks and avoids duplication.
The DPO as the pivot between technical, legal and business teams
The modern DPO must translate the CISO’s technical requirements into legal obligations that business teams can understand. This translation role is crucial during budget trade-offs. When Marketing asks for a new CRM to be integrated, the DPO must quickly assess the impact in terms of legal basis, international transfers and retention periods.
This versatility requires tools that make collaboration easier. Modern compliance software allows the DPO to create approval workflows involving the CISO for technical aspects and business managers for functional validation. Each stakeholder accesses the relevant information without being swamped by considerations that do not concern them.
Privacy by Design: identifying and removing the structural obstacles
The persistent lack of operational awareness
Despite years of training, many operational teams do not grasp the concrete implications of the GDPR. They apply procedures out of habit without understanding the underlying risks. This lack of knowledge generates dangerous “shortcuts”: excessive data collection, extended retention without justification, or no prior analysis for new processing activities.
The challenge for the DPO is to make compliance tangible. Instead of annual theoretical training, risks need to be put into context with examples drawn from the business sector. A bank does not raise its teams’ awareness in the same way as an online retailer: the data, the risks and the sanctions are different.
Saturation in the face of multiplying data flows
The explosion of SaaS tools and the adoption of generative artificial intelligence are multiplying data processing activities. A DPO can now handle 200 to 300 projects a year in a medium-sized organisation. This workload makes an in-depth individual analysis of each project impossible.
The risk is twofold: either the DPO becomes a bottleneck that slows down innovation, or they apply a superficial approach that lets major non-compliance slip through. The solution lies in intelligent automation that makes it possible to process low-risk projects automatically while reserving human expertise for complex cases.
The financial impact and the trade-off on design costs
Building data protection in from the design stage has a cost. Encryption, anonymisation, consent management infrastructure: these measures represent 5 to 15% of an IT project’s budget depending on its complexity. This reality creates budget tensions, particularly in SMEs where every euro counts.
The financial argument for Privacy by Design rests on the return on investment calculation. A data breach costs an average of 4.88 million dollars according to the IBM 2024 report. A CNIL sanction can reach 4% of worldwide turnover. Compared with these amounts, the initial investment in compliance becomes negligible.
Cultural transformation and the indispensable support of senior management
Privacy by Design transforms the way products and services are designed. This cultural shift requires strong backing at executive management level. Without this support, the DPO continues to be seen as an obstacle to innovation rather than as an enabler of sustainable growth.
The transformation involves setting up performance indicators that include compliance. Instead of measuring only development velocity, teams must also be assessed on their ability to deliver “secure by design” features. This change in the criteria for success gradually embeds data culture in the organisation’s DNA.
A methodology for bringing stakeholders on board from the outset
Early engagement: a necessity for project viability
Involving the DPO at the end of the development cycle multiplies compliance costs by 10 to 30. At that stage, correcting a non-compliant architecture often means rebuilding entire parts of the application. Early engagement makes it possible to integrate data protection constraints as normal functional specifications.
This approach requires changes to project management processes. The kick-off of a new project must systematically include the DPO and the CISO for a preliminary assessment. This 30-minute meeting makes it possible to identify the points of attention and to plan the in-depth analyses required.
The business case for Privacy by Design
GDPR compliance has become a selection criterion in B2B tenders. Procurement departments now require evidence of compliance (certifications, audits, up-to-date records) before selecting a supplier. This reality turns the regulatory constraint into a competitive advantage for well-structured organisations.
Beyond the commercial aspect, Privacy by Design improves data quality. Minimisation forces teams to think about the real usefulness of each piece of data collected. This approach often results in cleaner databases, more relevant analyses and better-targeted marketing campaigns.
Structuring an internal network of “Privacy Champions”
“Privacy Champions” are trained employees who pass on good practices within their team. These ambassadors have a dual skill set: they master the business issues of their department and have solid training in data protection. They can resolve 70% of compliance questions without escalating to the DPO.
This organisation offers two major advantages: it multiplies the DPO’s capacity to act and it embeds data culture as close as possible to operations. An HR Privacy Champion intuitively understands the issues involved in managing job applications. A Marketing Privacy Champion knows which data is really needed for an effective campaign.
The operational framework of Privacy by Design in 2026
The key stages in the life cycle of a compliant project
The Privacy by Design approach follows a process structured in 5 phases:
- Initial qualification: determine whether the project falls within the scope of the GDPR and assess its level of risk.
- Impact assessment: carry out a DPIA if necessary, identify the technical and organisational measures.
- Validation of choices: have the architecture and the security measures approved by the DPO and the CISO.
- Controlled implementation: check that the developments comply with the security specifications.
- Go-live and monitoring: monitor the compliance indicators and adjust if necessary.
Each phase generates documentation that feeds accountability. This traceability is crucial during CNIL audits: it proves that the organisation has carried out a structured and proportionate assessment.
Automating the impact assessment (DPIA) through collaborative workflows
The classic DPIA is a Word document of 20 to 50 pages that takes several weeks to write. This approach no longer works given the volume of projects to be handled. Modern compliance software turns the DPIA into a dynamic questionnaire that adapts to the project manager’s answers.
This automation cuts the time needed to complete a standard DPIA by a factor of 5 while improving its quality. The system guides the user, suggests mitigation measures suited to their context and automatically generates the final report. The DPO concentrates on analysing high risks rather than on formatting.
Integrating compliance into development pipelines
DevOps teams are gradually integrating compliance checks into their deployment chains. Tools such as Terraform or Ansible can automatically check that cloud resources comply with the encryption and geographical location standards defined by the DPO.
This technical integration brings compliance closer to developers’ day-to-day work. Instead of a time-consuming external process, GDPR checks become unit tests like any others. A deployment fails if personal data is not encrypted, in the same way as it fails if the performance tests do not pass.
Good practices for agile and collaborative governance
Critical alignment between Procurement, IT and Security
Selecting a new supplier involves three complementary assessments: financial (Procurement), technical (IT) and regulatory (DPO/CISO). These assessments must be carried out in parallel to avoid discovering non-compliance after the contract has been signed.
Using compliance software makes it possible to standardise supplier assessment. Each provider fills in the same questionnaire, which makes comparison easier and speeds up decision-making. The answers automatically feed the register of processors and generate the appropriate contractual clauses.
Going beyond an accounting view of the record of processing activities
Many organisations still regard the record as a static inventory to be maintained for the CNIL. This approach misses its strategic value: the record must become a steering tool that helps make better business decisions.
A well-used record reveals redundancies between departments, identifies under-used data and highlights concentration risks. These analyses make it possible to optimise storage costs, improve data quality and reduce the attack surface in the event of an incident.
The role of centralised steering in managing third parties and suppliers
The management of processors often represents 40 to 60% of the DPO’s workload. Between the initial assessments, the follow-up audits and the management of incidents, manual tracking becomes unmanageable beyond 50 suppliers.
Compliance software automates this management: the sending of periodic questionnaires, automatic reminders, the consolidation of answers and the generation of alerts when a non-compliance is detected. This automation frees up time in order to concentrate on the analysis of the most critical risks.
Why collaborative compliance software has become indispensable
Leaving spreadsheets behind for dynamic dashboards
Excel remains the tool most used by DPOs, but it reaches its limits in the face of current requirements. It cannot manage approval workflows, offers no reliable traceability of changes, carries a risk of formula errors, and makes consolidation across several files difficult. These limitations create major operational risks.
A dynamic dashboard offers real-time visibility into the state of compliance: number of DPIAs pending, suppliers to be audited, incidents being handled. This overall view allows the DPO to prioritise their actions and to report factually to senior management on how risks are evolving.
Ensuring sovereignty and traceability of actions
Traceability is at the heart of GDPR accountability. Every action taken by the DPO must be able to be reconstructed in the event of an audit or incident. This requirement makes it necessary to have a complete and unalterable history of all the decisions taken.
French cloud solutions such as Make IT Safe guarantee that compliance data remains under European jurisdiction. This sovereignty avoids the complications linked to international transfers and ensures better control in the event of a judicial requisition.
Make IT Safe: centralising cybersecurity and GDPR compliance
Make IT Safe was designed by practitioners to meet the concrete challenges faced by DPOs and CISOs. The platform natively integrates the main frameworks (GDPR, ISO 27001, NIS2) and allows unified management of cyber and regulatory risks.
The tool stands out for its collaborative approach: each actor has an interface suited to their role, approval workflows are configurable and report generation is automated. This approach turns compliance from an imposed constraint into a controlled process that secures the business.
Key points to remember
- The DPO function has evolved towards strategic orchestration: gone are the days when compliance was managed in a silo; it is now part of a complex regulatory ecosystem.
- Early engagement cuts costs by a factor of 10: involving the DPO from the design stage avoids costly rebuilds at the end of the project.
- Privacy Champions multiply effectiveness: training internal relays makes it possible to handle 70% of questions without escalating to the DPO.
- Automating DPIAs changes the game: a dynamic questionnaire is a better replacement for a 50-page Word document.
- Excel creates more risks than it solves: the lack of traceability and collaboration in spreadsheets exposes the organisation during audits.
- The sovereignty of compliance data matters: hosting your records with a French provider avoids legal complications.
Frequently asked questions
What sanctions do you face if Privacy by Design is deficient?
Failing to take data protection into account from the design stage can lead to fines of up to 20 million euros or 4% of worldwide turnover. Beyond the financial aspect, the CNIL can impose compliance orders with daily penalty payments, or even temporarily prohibit the processing in question.
Does compliance software make CNIL inspections easier?
Yes, considerably. The tool instantly provides all the elements required: an up-to-date record, the history of DPIAs, evidence of team awareness training, and the monitoring of processors. This responsiveness reduces the length of inspections and demonstrates the organisation’s good faith.
Does Privacy by Design apply to existing projects?
Legally, it applies to new processing activities or to substantial modifications. In practice, a compliance review of existing critical processing activities is recommended in order to identify vulnerabilities and correct them before they cause an incident.
How should roles be divided between the DPO and the CISO?
The DPO concentrates on the legal aspects (legal basis, data subjects’ rights, retention periods). The CISO brings technical expertise (encryption, access controls, incident detection). Collaborative software makes it possible to work on the same risk analysis without duplication.
Does an SME need compliance software?
As soon as the organisation uses more than 10 different SaaS tools or processes more than 1,000 customer files a year, manual management becomes hazardous. Suitable software structures the approach without tying up disproportionate resources, making it possible to stay focused on the core business.
Where to start
The next step is to audit your current compliance management tools. If you use more than three Excel files to manage records, incidents and suppliers, you are at risk. Losing information or using an outdated version can compromise your defence in the event of an audit.
Start by automating one critical process, such as the assessment of new suppliers. Within a few weeks, you will measure the time saved and the better traceability that a dedicated platform brings. This gradual approach makes it possible to validate the value of automation before extending it to all processes.
Finally, anticipate regulatory change by choosing a solution capable of handling several frameworks simultaneously. The European AI Act applies in stages until 2 August 2028, its final deadline (high-risk AI systems embedded in regulated products), and creates new obligations for organisations using AI systems. To see how the record of processing activities, DPIAs and project monitoring are managed in a single tool, request a demonstration.
