Beltug’s guidelines for collaborative DPO and information security roles in organisations

In many organisations, DPOs and information security professionals share certain concerns, but from different perspectives: the DPO focuses on protecting individuals’ rights and freedoms, while those responsible for information security are charged with safeguarding the organisation’s data and systems. When these roles are not well coordinated, misunderstandings and inefficiencies can arise, especially when competing for company resources or under pressure to deliver quickly.

These guidelines, developed by members of Beltug’s Privacy Council, provide practical directions for fostering cooperation, clarifying responsibilities, and building mutual understanding. They help organisations:

• Define clear governance structures that respect both privacy and security mandates
• Encourage early and ongoing collaboration between DPO, information security, and business teams
• Avoid duplication of efforts and conflicting priorities
• Strengthen risk management and compliance through shared objectives

The guidelines cover:

• The role of the Data Protection Officer versus a privacy responsible
• The role of the Information Security Responsible
• Collaboration between the DPO and the Information Security Responsible
• Collaborative governance and processes when roles are separate
• Combining the role of the DPO and the Information Security Responsible
• A comparison of combined versus separate functions

Our thanks to our dedicated Beltug members of the Privacy Council,  with special thanks to Wim Barthier, Katia Bodard, Klaas Ghesquiere, Marja Lubbers, and Iwona Muchin. Their contributions ensure that this document reflects Beltug’s collective expertise and commitment to supporting organisations in the digital era.

The paper is available to Beltug members after login.