DPO vs CISO: Who Does What?
The Data Protection Officer (DPO) helps manage privacy work. The Chief Information Security Officer (CISO) leads work to keep information secure.
What to review
For example, a customer reports that their account details were leaked. The security team checks what happened. The privacy and legal teams decide how to handle the customer’s request and any required reports.
Problems to look for
- 1.A customer request goes unanswered because nobody is assigned to it.
- 2.Security finds a possible leak but the privacy team hears about it late.
- 3.A supplier review checks security but misses how the supplier uses customer data.
The Immediate Fix
Bring the privacy, security and legal teams together. Agree who takes the lead in each situation below.
What to check
- Customer questions
- The privacy team coordinates answers and checks them with legal when needed.
- System security
- The CISO or security lead checks access, security settings and alerts.
- Possible data leak
- Security investigates. Privacy and legal review what must be reported. Name who sends each message.
- New supplier
- The buying, privacy and security teams check what data the supplier needs and how it will protect it.
- Updates to management
- Keep one list of fixes, people responsible and due dates.
Section 10 sets a DPO requirement for companies named as Significant Data Fiduciaries, a category decided by the government. Ask your legal team whether it applies. DPDP Act and its start dates.
Reviewed 5 September 2026.
Get DPDP Updates for DPO vs CISO: Who Does What?
We'll send you compliance alerts and deadline reminders specific to your area. No spam — unsubscribe anytime.
Need help checking your business?
- Start with the free self-check to find questions for your team.
- Our paid gap assessment takes four weeks. We check your apps, documents and records, then list what needs fixing.
- Fixing the agreed gaps takes two to three months. A final assessment checks the completed work.
Save your results and discuss the questions with your team.
Next step after the audit
The audit shows the gaps. Sanctum closes them. One programme covers legal position, data map, gap analysis, implementation, tooling, training, a written readiness opinion, and breach cover, under one accountable owner. See the all-in-one programme
What Should You Do Next?