CISO vs DPO vs RSSI: who does what, really.

Two accountabilities, one perimeter

The confusion between these roles is not about job titles. It is about which authority each person answers to. The CISO and the RSSI run a programme on behalf of the executive: they are judged on whether the organisation is secure enough to keep operating and whether the board understands the residual risk it is carrying. The DPO answers to a different master entirely. The role exists because GDPR put an independent compliance function inside the organisation, and that function reports to the highest level of management while staying out of the operational decisions it has to assess. One side optimises for the business. The other side has to be able to tell the business it is wrong.

In operational terms, the CISO and RSSI build and defend; the DPO reviews and challenges. When a marketing team wants to enrich a customer database with third-party data, the CISO asks whether it can be done securely and the DPO asks whether it should be done at all under the lawfulness, minimisation and purpose-limitation tests. Both questions are legitimate. They are not the same question, and the moment you collapse them into one person you lose the second one.

The comparison that actually matters

Most published comparisons stop at definitions. The distinction that decides org-chart fights is the reporting line and the source of the mandate, because that is what determines who can overrule whom and who carries the liability when something goes wrong.

The certification column is the practical signal a hiring manager reads. A security leader profile is built on CISM for the management-level credential, the PECB Certified CISO for the executive framing, and Lead Cybersecurity Manager for the programme build. A data-protection profile signals through the Certified Data Protection Officer credential and a privacy-engineering layer like CDPSE. The two stacks are not interchangeable, and a CV that mixes them without a clear primary role usually signals someone who has done neither at depth.

Where they genuinely overlap: Article 32 and incidents

The overlap is real, and pretending otherwise is how organisations end up with gaps. Article 32 of GDPR requires appropriate technical and organisational measures to secure personal data: encryption, resilience, the ability to restore availability, and regular testing of those measures. That is security work. The CISO owns the controls that deliver it. But the DPO has to be able to assess whether those measures are appropriate to the risk to data subjects, which is a different lens from appropriate to the business.

The clean way to run this: the CISO is accountable for implementing and operating the Article 32 measures, and the DPO is accountable for forming an independent opinion on their adequacy. The CISO builds the encryption-at-rest standard; the DPO records in the DPIA that it is sufficient for the processing in scope, or flags that it is not. Neither approves their own homework.

ISO 27701 sits exactly on this seam. It extends an ISO 27001 ISMS into a privacy information management system, which gives the CISO and DPO a shared control framework instead of two disconnected vocabularies. The ISO 27701 Lead Implementer course is the single most useful qualification for the person who has to make the security programme and the privacy programme speak to each other.

Incident response is the second overlap and the one that breaks under pressure. The CISO runs the technical response: contain, eradicate, recover. The DPO runs the regulatory clock: GDPR gives 72 hours to notify the supervisory authority of a personal-data breach, and that assessment (is it a breach, is it notifiable, are data subjects at risk) is the DPO call, not the CISO call. If these two people are not in the same room within the first hour of a serious incident, you will either over-notify and burn credibility with the regulator or under-notify and breach the deadline.

Why one person should not hold CISO and DPO

The reason is structural, not workload. GDPR requires the DPO to be free of any conflict of interest: the DPO cannot hold a position that involves determining the purposes and means of processing personal data. A CISO does exactly that. The CISO decides which logging is retained, how long backups live, what monitoring inspects employee traffic, which vendors process data. Those are processing decisions. A single person who both makes them and is supposed to independently audit them cannot do the second job, because the supervisory authority will not accept self-review as independent oversight.

This is not a Cyber Academy opinion. European supervisory authorities have already fined organisations for appointing a DPO who also held an operational role over the processing they were meant to supervise. In a small organisation you may genuinely have one capable person who could do both. The answer there is not to combine the roles; it is to make that person the CISO and appoint the DPO externally, or vice versa. An external DPO is a recognised and often cleaner solution precisely because independence is built in.

The audit-room reality

When an ISO 27001 auditor or a supervisory authority looks at this, they are testing for one thing: can you show that security decisions and privacy decisions were made by people with the right authority and the right independence. The evidence they want is mundane and specific.

1. A RACI or equivalent that names who is accountable for the risk register versus the records of processing, with no person holding both the operate and the oversee role for the same control.
2. Incident records showing the DPO was engaged on notifiability and the CISO on containment, with timestamps that fit inside the 72-hour window.
3. DPIAs that carry an independent DPO opinion on the security measures, not a security sign-off relabelled as a privacy review.

The audit and assurance skills that make this provable belong to a distinct profile again. CISA builds the audit and evidence discipline, and CRISC builds the risk-quantification language that lets the CISO present residual risk to the board in terms it can actually decide on. These are the credentials that turn a defensible structure into a demonstrable one.

Common mistakes to avoid

• Treating CISO and RSSI as two roles to be filled separately. They are the same role; the title follows the language and the regulatory context, not the scope.
• Letting the DPO report into the CISO or the IT function. That destroys the independence GDPR requires and is an easy finding for any regulator.
• Assuming the highest-ranking certification wins. A CISM holder is not therefore qualified as a DPO, and a strong DPO credential does not make someone a security leader. Match the credential to the mandate.
• Writing a board report that blends security risk and privacy risk into one number. The board needs to see both, because the consequences and the authorities involved are different.

The organisations that get this right do not have more headcount than the ones that get it wrong. They have a clear answer to a single question: for any decision about personal data, who builds it and who independently judges it. Keep those two answers in two different people, give each the credential that matches their mandate, and the org chart stops being a source of audit findings.