Why a CISO should not be a DPO?

A Discussion on why the CISO should not be a DPO

Transcript

SPEAKER_01 0:00

I was uh I was trying to delete an old social media account the other day. You know, one of those platforms you sign up for, use for maybe a month, and then completely forget about we all have a dozen of those floating around. Right. And I thought it would be like a simple click of a button. But instead, I found myself trapped in this endless labyrinth of confirmation emails, confusing privacy toggles, and uh those annoying are you sure pop-ups.

SPEAKER_00 0:26

They really don't want you to leave.

SPEAKER_01 0:27

They really don't. It felt less like I was managing my own information and more like I was trying to negotiate the release of a hostage or something. And it really makes you wonder what is actually happening to our information behind the scenes when we hit submit.

SPEAKER_00 0:40

Well, that frustration is completely universal. And honestly, it highlights a massive blind spot that most of us have. I mean, we tend to visualize corporate data protection as this giant, impenetrable fortress.

SPEAKER_01 0:54

Yeah, like a big vault.

SPEAKER_00 0:56

Exactly. We just assume the company's only priority is building thicker walls to keep the hackers out. But the reality is, well, it's far more complex. The friction you experience trying to delete an account isn't usually just a technical glitch. It's not. No, it's actually the visible symptom of a structural conflict happening inside the company's own organizational chart.

SPEAKER_01 1:17

Okay, let's unpack this. Because that internal corporate conflict is exactly our mission for today's deep dive. We are exploring a really fascinating piece of source material titled The Independent Governance of Data Protection and Audit Scope.

SPEAKER_00 1:31

Which came out of some high-level industry discussions held on June 6th, right?

SPEAKER_01 1:34

Yeah, exactly. And this text forces us to look closely at India's Digital Personal Data Protection Act, the DPDPA of 2023. And what those June 6th discussions make totally clear is that keeping data safe from outside threats, which is information security, is no longer the exact same thing as protecting your rights as a user.

SPEAKER_00 1:54

Yeah, and to really understand that distinction, um, we need to define the two central characters created by laws like the DPDPA 2023.

SPEAKER_01 2:01

That's a new terminology.

SPEAKER_00 2:02

Right. So first you have the data fiduciary. That is the organization, the platform, the company holding the data and deciding how it gets processed.

SPEAKER_01 2:10

Like the social media company I was trying to escape from.

SPEAKER_00 2:12

Exactly. And second, you have the data principal. That is you, the user. You know, the individual to whom the personal data actually belongs.

SPEAKER_01 2:21

Aaron Powell Okay, fiduciary and principal. Got it.

SPEAKER_00 2:23

Trevor Burrus, and historically, companies operated primarily to protect their own interests, the fiduciary's interests. But this new legal framework forces them to actively protect the principal's interests.

SPEAKER_01 2:34

Aaron Powell So if we look at who is actually doing the protecting inside these companies, we start to see where that friction comes from. Because the June 6th discussions, uh, they focus heavily on an emerging identity crisis within corporate leadership. Trevor Burrus, Jr.

SPEAKER_00 2:48

A massive identity crisis, yeah.

SPEAKER_01 2:49

Trevor Burrus, Jr.: Specifically, the text questions the role of the data protection officer, the DPO. And whether the person whose primary job is information security, like a chief information security officer, a CISO can effectively wear both hats.

SPEAKER_00 3:03

Right.

SPEAKER_01 3:04

I mean, can the CISO also be the DPO?

SPEAKER_00 3:06

What's fascinating here is that the text explicitly argues against combining these roles. It points out that their core objectives, well, they fundamentally diverge. How so? Well, the CISO is the architect of that digital fortress you mentioned earlier. Their entire mandate revolves around what we call the CIA triad confidentiality, integrity, and availability.

SPEAKER_01 3:28

Okay.

SPEAKER_00 3:29

The CISO's absolute worst nightmare is a system going offline or a database leaking to the dark web. Their instinct is uh absolute preservation and control of the company's digital assets.

SPEAKER_01 3:41

Aaron Powell They want to lock everything down. So let's um let's step away from the traditional technologies for a second. It sounds to me like a CISO is essentially a museum curator.

SPEAKER_00 3:50

Aaron Powell Oh, that's an interesting way to put it.

SPEAKER_01 3:52

Aaron Powell Right. Because the curator's job is to acquire artifacts, preserve them at all costs, put them behind bulletproof glass, and ensure nobody tampers with them. They want the collection to just grow and remain pristine forever.

SPEAKER_00 4:03

Aaron Powell That is actually a highly accurate way to look at it. The curator values the artifact itself. Now contrast that with the data protection officer under the DPDPA. The DPO is not there to preserve the company's data hoard. The DPO is there to ensure the company complies with the law, which means their primary focus is upholding the rights of the data principal, you know, the user. Trevor Burrus, Jr.

SPEAKER_01 4:26

So sticking with the museum idea, the DPO is more like a legal executor who suddenly walks in with court orders. Exactly. They're looking at the curator's prized collection and saying, actually, we don't have the legal provenance to hold these specific artifacts anymore. We need to return them to their rightful owners, or you know, the descendants have asked us to destroy these records. Aaron Powell Right.

SPEAKER_00 4:46

And you can instantly see the clash there. Right. Let's put this into a concrete technical scenario that companies face every single day. Sure. Imagine a CISO is building a defense strategy against ransomware. A standard, highly effective tactic is to create immutable backups. Data storage that is write once, read many. Trevor Burrus, Jr.

SPEAKER_01 5:05

Meaning you can't edit it.

SPEAKER_00 5:06

Exactly. Once the data goes into that backup server, it cannot be altered or deleted by anyone, not even the system administrator. That way, if a hacker gets in, they can't encrypt or destroy the backup. The CISO has successfully protected the asset.

SPEAKER_01 5:20

Aaron Powell That makes total sense from a security standpoint, but then uh a user submits a right-to-be forgotten request, like me with my account. They want their account and all associated data permanently deleted.

SPEAKER_00 5:32

Aaron Powell Right. So the DPO receives that legal request and has a strict statutory deadline to execute it. But they can't.

SPEAKER_01 5:40

Because of the immutable backup?

SPEAKER_00 5:41

Yes. The CSO's backup system physically prevents the deletion. So the very mechanism designed to ensure perfect security actively violates the user's right to privacy.

SPEAKER_01 5:51

Aaron Powell Oh, wow. Okay. I see the mechanical conflict there. But let me push back a bit just to play devil's advocate. Sure. Because I mean plenty of executives hold dual roles, right? A CEO is often the president. A CFO might also head up HR in a smaller company. So why can't a highly competent executive just look at that immutable backup problem and balance the two needs?

SPEAKER_00 6:09

Aaron Powell You mean just figure it out on a case-by-case basis?

SPEAKER_01 6:11

Yeah. They acknowledge the deletion request, maybe they carve out a technical exception and they move on. Why does this legally necessitate two separate people?

SPEAKER_00 6:20

Aaron Powell Well, because it's not just a technical puzzle, it is a matter of inherent legal conflict of interest.

SPEAKER_01 6:25

Aaron Powell Right.

SPEAKER_00 6:27

When you ask one person to balance those needs, human nature and corporate incentive structures basically dictate that they will default to protecting the fiduciary over the principal.

SPEAKER_01 6:37

Aaron Powell Because the fiduciary pays their salary.

SPEAKER_00 6:40

Exactly. If the CISO is also the DPO and a massive data minimization project threatens to break a really profitable internal analytics model, the security and operational desires of the company will almost always swallow up the user's rights.

SPEAKER_01 6:54

Yeah, that makes sense.

SPEAKER_00 6:55

The DPO role requires the autonomy to tell the CEO, no, we cannot do this, even if it's profitable, because it violates the principal's rights. A CISO, whose budget and bonuses are tied to corporate asset protection, is rarely positioned to make that purely legal, user-centric call.

SPEAKER_01 7:12

Wow. That makes the stakes incredibly clear. If the person in charge of privacy is subordinate to the person in charge of security, or worse, if they're the exact same person, then the user's rights are basically compromised from the start.

SPEAKER_00 7:25

Exactly.

SPEAKER_01 7:25

Which leads us to a really fascinating secondary problem from the text. If this internal team is structurally deadlocked, or you know, if the DPO is just constantly being overruled by the CISO, what happens when an outside auditor shows up to grade their homework?

SPEAKER_00 7:42

Uh, yes. The audit dilemma.

SPEAKER_01 7:44

Right. This is the second major issue tackled in the June 6th discussions, the independence of the DPDPA audit process itself.

SPEAKER_00 7:52

And the text frames this around a very specific question regarding the audit scope.

SPEAKER_01 7:56

The boundaries of the audit.

SPEAKER_00 7:58

Right. When a compliance audit is meant to protect the interests of the individuals, should the boundaries of that audit be determined solely by the company's management? Or does the auditor need independent validation of where they are actually allowed to look?

SPEAKER_01 8:09

I have to admit, my initial instinct here favors management.

SPEAKER_00 8:12

Really? How so?

SPEAKER_01 8:14

Well, let's say I'm running the company. I have millions of lines of code, thousands of servers spread across multiple cloud environments, and I am paying an external auditing firm a massive fee to review my compliance.

SPEAKER_00 8:24

A very massive fee, usually.

SPEAKER_01 8:26

Right. And I know my architecture better than any third party ever could. So shouldn't I have the unrestricted authority to draw the map for the auditor? I mean, I can point them to the active databases holding user data so we don't just waste time and money scanning totally irrelevant legacy systems.

SPEAKER_00 8:42

On paper, that kind of efficiency makes total sense. Yeah. But an audit scope is basically a binding contract.

SPEAKER_01 8:48

Okay.

SPEAKER_00 8:48

It legally dictates exactly what systems, departments, and vendor connections the auditor is permitted to examine. If the contract explicitly says do not scan the US East legacy servers, the auditor legally cannot look there.

SPEAKER_01 9:03

But wait, isn't an auditor fundamentally obligated to find the holes? Like if an auditing firm comes in and just blindly follows a map drawn by management and that map conveniently excludes all the messy databases, isn't that a failure of the auditing firm?

SPEAKER_00 9:16

You would think so. But this raises an important question about what a compliance audit actually is versus what we imagine it to be.

SPEAKER_01 9:23

Okay, what's the difference?

SPEAKER_00 9:24

Well, a compliant audit is not a penetration test. The auditor isn't a hacker hired to break into the network by any means necessary. They are hired to assess a specific perimeter against a specific set of rules.

SPEAKER_01 9:39

Ah, a specific perimeter.

SPEAKER_00 9:42

Exactly. If management has unrestricted authority to define that perimeter, self-preservation guarantees, they will draw the map around the systems they know are pristine.

SPEAKER_01 9:51

Oh, of course.

SPEAKER_00 9:52

They will point the auditor toward the shiny new cloud infrastructure that has perfect access controls.

SPEAKER_01 9:58

And they will actively carve out all the shadowy problematic areas like um the marketing database that was hastily merged during an acquisition three years ago. Exactly. Or some third-party API that constantly pulls user location data without proper logging.

SPEAKER_00 10:12

Yes, or the shadow IT systems that the engineering team just spun up over the weekend to test something. The source material argues that a DPDPA audit simply cannot be treated like a traditional management-controlled assurance exercise. Historically, financial or security audits were designed to assure the board of directors that the company's risks were managed.

SPEAKER_01 10:32

Right, the company protecting itself.

SPEAKER_00 10:34

Yeah, the fiduciary was auditing itself for its own benefit. But a DPDPA audit is completely different. It is meant to ensure that the data principal's rights are protected.

SPEAKER_01 10:43

So if management solely defines the scope, they are optimizing for the fiduciary. They might unintentionally or you know very intentionally scope the user's risks right out of existence.

SPEAKER_00 10:55

Which is exactly why the auditor needs this structural independence to challenge those scoping assumptions.

SPEAKER_01 11:01

They need to push back.

SPEAKER_00 11:02

Exactly. The auditor needs to be able to sit down with management, look at the proposed map, and say, look, I see you've excluded the legacy marketing systems. But based on my independent risk assessment, those systems frequently house the exact type of granular personal data that the DPDPA protects.

SPEAKER_01 11:17

So I need to look in there.

SPEAKER_00 11:18

Right. I cannot sign off on this audit unless those systems are included in the scope. Without that independent validation, the entire audit is just a rubber stamp validating management's own bias.

SPEAKER_01 11:30

Here's where it gets really interesting. Because we started by looking at internal HR reporting lines. You know, can the CISO be the DPO? Yep. And then we move to external vendor contracts. Who gets to draw the map for the auditor? And on the surface, these sound like completely separate operational headaches. One is internal staffing, the other is external procurement.

SPEAKER_00 11:52

These seem unrelated.

SPEAKER_01 11:53

Right. But the June 6th discussions explicitly link them.

SPEAKER_00 11:56

Aaron Powell Because they are two symptoms of the exact same underlying condition.

SPEAKER_01 12:00

Yes. The profound shift in power dynamics between the data fiduciary and the data principal. I mean, for decades, corporate governance was essentially a closed loop. The company protected its data to protect its shareholders.

SPEAKER_00 12:12

Right, using firewalls, encryption, and internal policies.

SPEAKER_01 12:15

All optimized for corporate survival.

SPEAKER_00 12:17

If we connect this to the bigger picture, the DPDPA 2023 disrupts that closed loop entirely. The law recognizes that personal data is not just a traditional corporate asset. It's not like a desk or a patent or, you know, a fleet of delivery trucks. Exactly. Personal data is a proxy for a human being. And because it represents a human being, constitutional and statutory rights remain attached to that data even long after it enters the company's servers.

SPEAKER_01 12:45

It's a total paradigm shift. And the June 6th text isn't just about tweaking job descriptions or updating audit contracts. It's arguing that the fundamental architecture of corporate governance has to change. Organizations are basically being forced to give you, the data principal, a permanent ghost seat at the boardroom table.

SPEAKER_00 13:02

A ghost seat. I love that. And that seat demands actual representation. That is why the roles of COOs and DPO must be separated.

SPEAKER_01 13:09

Right.

SPEAKER_00 13:10

The CSO represents the fiduciary's legitimate interest in security. But the DPO represents the principal's statutory interest in privacy and control. They act as a necessary system of checks and balances within the organization.

SPEAKER_01 13:22

And it perfectly explains the audit dilemma, too. Management represents the fiduciary. If they control the audit scope, that system of checks and balances just fails.

SPEAKER_00 13:32

Completely fails.

SPEAKER_01 13:33

The independent auditor serves as the external counterbalance, ensuring the principal's ghost seat isn't just ignored when the compliance reports are being drafted.

SPEAKER_00 13:41

And, you know, the source material positions these insights as exploratory. They are intended to spark serious debate among privacy professionals, CSOs, and policymakers.

SPEAKER_01 13:52

Because the industry is trying to figure this out in real time.

SPEAKER_00 13:55

Exactly. They are currently trying to rewire themselves. They're realizing that you can't just slap a new privacy label on a traditional information security framework and legally call it compliant under the DPDPA.

SPEAKER_01 14:07

So what does this all mean for you, the listener? I mean, we hear companies tout their commitment to privacy all the time, right? We see the polished marketing campaigns, we look for the little reassuring lock icons on our screen.

SPEAKER_00 14:18

It's a lock, yeah.

SPEAKER_01 14:19

Yeah. But the real battle for your digital autonomy isn't happening on the surface. It's hidden deep within the bureaucratic machinery of the organizations holding your data.

SPEAKER_00 14:29

That's entirely true. The strength of your privacy isn't just determined by the complexity of a company's encryption algorithms anymore.

SPEAKER_01 14:37

No.

SPEAKER_00 14:37

It's determined by their reporting lines. Like, do they empower a dedicated data protection officer to actually stand up to the security and operational teams when a conflict arises? Right. And do they subject themselves to genuinely independent audits, or do they just legally manipulate the scope to ensure they never fail?

SPEAKER_01 14:56

It fundamentally changes how we should evaluate trust in the digital age. We aren't just relying on companies to build an impenetrable vault anymore. We are demanding that they build an entire governance structure that respects our right to, you know, walk into that vault, see exactly what they're holding, and tell them to shred it if we want to.

SPEAKER_00 15:13

Exactly.

SPEAKER_01 15:14

The internal corporate tug of war is the only thing guaranteeing those rights.

SPEAKER_00 15:19

And this transition from check the box compliance to structural architectural privacy, it is going to be incredibly difficult for many organizations.

SPEAKER_01 15:28

Oh, absolutely.

SPEAKER_00 15:29

Because the inertia of prioritizing the fiduciary is just so deeply embedded in corporate culture.

SPEAKER_01 15:35

It is going to require a massive unlearning of old habits. And the June 6th discussions are clearly trying to accelerate that unlearning process before these structural flaws lead to massive regulatory failures under the new law.

SPEAKER_00 15:49

Which is inevitable if they don't adapt. So as we watch this new legal framework actually take effect, let's leave you, the listener, with something to consider.

SPEAKER_01 15:58

Yeah.

SPEAKER_00 15:59

We've talked extensively today about the hidden mechanisms companies use to manage their compliance and the danger of management drawing the map for their own audits. As laws like the DPDPA push for true independent oversight, how will you, the data principal, eventually be able to distinguish between the companies that have genuinely rebuilt their governance to embrace rigorous independent scrutiny?

SPEAKER_01 16:20

Wait, wait, and the companies that haven't?

SPEAKER_00 16:22

Yeah, exactly. And the companies that have simply found clever legal ways to keep grading their own homework.