CNIL published guidance today on DPO conflicts of interest. The line is blunt: if a job decides why and how personal data gets processed, it shouldn't sit with the DPO. CEO, head of HR, the person who owns the fraud system. The test is whether the DPO ends up judging their own work.

In small teams the DPO hat lands on whoever already runs IT or legal. That's the person the DPO is meant to challenge. You can see it on the org chart before you read a single policy.

cnil.fr/fr/dpo-identifi…