Cybersecurity Policy Report, French Agency Explores Conflict of Interest Concerns for Data Protection Officers, (Aug 10, 2026)
By Tony Foley
Organizations that appoint data protection officers (DPOs) to perform the tasks outlined in article 39 of the European Union’s General Data Protection Regulation (GDPR) may entrust other tasks to the DPO but those tasks must not interfere with the DPO’s primary responsibilities or place the DPO in a conflict of interest, according to guidance issued today by the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL).
According to the guidance, DPOs will be in a conflict of interest situation if they are entrusted with the tasks specified in the GDPR and other tasks that may interfere with those responsibilities. The existence of a conflict is assessed case-by-case, and CNIL said organizations should conduct an analysis of potential conflicts before appointing a DPO or assigning additional function or missions to the DPO. Among the questions organizations should ask in identifying a conflict of interest are the following:
With respect to a DPO appointed internally, the functions and missions for which they are responsible, whether the DPO performs supervisory functions, whether the DPO has decision-making power in determining the purpose or means of data processing implemented by their organization, whether the DPO is required to take a position on subjects or projects related to personal data processing, and whether a DPO performs the functions of a staff representative or holds a trade union mandate with the organization;
With respect to externally appointed DPOs, whether a lawyer or law firm appointed as a DPO has participated in representing the organization in a data protection dispute and whether the DPO is a member of staff or management of an organization that may have interests contrary to those of the appointing organization; and
For a DPO shared between several organizations, whether the DPO was appointed by an organization that may have interests contrary to those of the appointing organization.
If a conflict of interest is identified, the appointing body has the obligation to end it by replacing the DPO, withdrawing the third-party missions giving rise to the conflict, or implementing other remediation measures.
The guidance outlines the steps to take in appointing a deputy DPO in the event that an internally appointed DPO is in a conflict situation, noting that the deputy must have real decision-making power with regard to the conflict situation.
Finally, the guidance provides that when the same external entity DPO is appointed by a data controller and its subcontractor, the entity should entrust the effective exercise of DPO functions to separate employees within the entity, with each bound by an obligation of confidentiality and professional secrecy.
News: InternationalLegislation DataPrivacy DataSecurity GDPR