As privacy regulations tighten in Israel (especially with Amendment 13) and across the EU (GDPR) organizations face increasing pressure to establish and maintain clear responsibilities for data governance.
Two key roles have emerged at the forefront of this effort: the Data Protection Officer (DPO) and the Chief Information Security Officer (CISO) (or sometimes Chief Information and Cyber Officer, CICO).
While both deal with the same asset: information. they approach it from different angles, with different mandates, methods, and legal implications.
Two Functions, Two Perspectives
The DPO is responsible for ensuring that the organization processes personal data in accordance with applicable privacy laws. This includes GDPR, Israeli privacy law (as amended), biometric data regulations, and more. The DPO provides legal and regulatory guidance, oversees transparency measures, helps manage data subject requests, and conducts impact assessments (DPIAs).
The CISO, on the other hand, leads the organization’s technical and operational defense against data breaches, cyberattacks, and unauthorized access. This includes encryption strategies, system architecture, incident response, and internal security protocols.
The DPO ensures data is used lawfully. The CISO ensures data is protected in practice.
Both are essential. But they must remain separate.
Conflict of Interest: Why the Same Person Can’t Do Both
One of the most common questions we get from clients is:
“Can our CISO also serve as our DPO?”
Under both the GDPR and Israeli Amendment 13 — the answer is: Only if there’s no conflict of interest. In most cases, there will be.
Why? Because the DPO is supposed to monitor and advise on how data is processed — but the CISO is often the one making those decisions.
If the same person determines how data is handled and reviews the lawfulness of those decisions, their independence is compromised. It’s essentially self-monitoring — a violation of the principle of functional independence that is foundational to the DPO role.
The European Data Protection Board (EDPB), as well as EU courts, have reinforced this: an employee who defines data handling strategies (e.g., head of IT, security lead, CIO) cannot also serve as DPO — even if they're highly privacy-aware.
How to Structure It Right
Organizations that want to build a future-proof data governance framework should:
- Maintain a clear separation of responsibilitiesDefine the roles of DPO and CISO in a way that avoids overlap in decision-making authority.
- Ensure independent reporting for the DPOWhether internal or external, the DPO must have a direct line to senior management — not report to the CISO or IT teams.
- Document accountability frameworksInternal policies should clarify who does what, how decisions are made, and who signs off.
- Consider appointing an external DPOEspecially when roles are tightly integrated operationally, a neutral external DPO ensures compliance and independence.
Bottom Line
At a glance, the DPO and CISO may appear to handle similar things. But in reality, their focus, their training, and their duties are fundamentally different.
- The DPO asks: “Are we allowed to process this data?”
- The CISO asks: “How do we protect this data from threats?”
One handles legal risk. The other manages security risk.Mixing those up creates organizational risk.
In an era where enforcement actions are increasing — both in Europe and in Israel — it’s not just a best practice to separate these roles. It’s a legal necessi