Introduction

In an increasingly complex Italian and European regulatory environment — including GDPR, NIS2 and the AI Act — organizations must be explicit about who does what. This guide compares key roles (DPO, CISO, operational security lead, legal team, executive management, external vendors) and provides operational schemes, checklists and practical escalation flows.

Regulatory role snapshot

  • DPO (Data Protection Officer): required by the GDPR for public authorities and for organizations performing large-scale processing or systematic monitoring. Advises on compliance, monitors implementation and acts as contact point with supervisory authorities.
  • CISO (Chief Information Security Officer): strategic role for security governance, risk management and defining security policies.
  • Operational security lead (Head of Security / Security Manager): responsible for day-to-day technical and operational security measures and incident response.
  • Legal / compliance team: assesses legal impacts, contract obligations and supports notifications and high-risk decisions.
  • Management / Board: provides resources, approves strategy and holds final accountability for compliance.
  • External providers and consultants: may carry out delegated activities (e.g., SOC, testing, hosting) while contractual and regulatory responsibilities often remain with the commissioning organization.

Who does what: an operational map

  • Governance & strategy (Board, CISO): define security policy, risk appetite, budget and periodic reporting.
  • Compliance & legal interpretation (DPO, legal team, CISO): assess applicable obligations (GDPR, NIS2, AI Act, etc.), perform DPIAs and map processing activities.
  • Technical & operational controls (Operational security lead, SOC, vendors): implement controls, vulnerability management, patching, network and endpoint protections.
  • Data protection and rights management (DPO, operations): procedures for access, rectification, erasure, and responding to supervisory authority inquiries.
  • Incident management (Operational security lead, CISO, DPO, legal): define detection, containment, internal and external notification, and post-incident review.

Recommended escalation flow

  1. Detection: reported by operations or SOC to the operational security lead.
  2. Triage: operational security lead classifies incident (confidentiality/integrity/availability) and assesses impact on personal data and critical services.
  3. DPO involvement: when personal data are affected or as required by law, the DPO is informed early to support risk assessment and notification decisions.
  4. Legal and management involvement: for legal, contractual, or reputational impact, legal counsel and the CISO/Board are briefed and define external communications.
  5. Notification: the DPO coordinates notifications to supervisory authorities and data subjects where applicable, supported by legal and the CISO.
  6. Remediation & lessons learned: remediation actions by security operations; final report to the Board and policy updates.

Operational checklist for assigning responsibilities

  • Formally document responsibilities and delegations in governance artifacts.
  • Map critical processes and assign accountable owners.
  • Establish internal communication SLAs (e.g., maximum time for primary escalation).
  • Formalize DPO and legal involvement rules for event types.
  • Include notification and reporting obligations in supplier contracts.
  • Maintain incident response playbooks with up-to-date roles and contacts.

Managing suppliers and shared responsibility

  • Define clear contracts with SLAs and security and privacy obligations.
  • Request technical evidence and attestations where relevant (audit reports, pen tests, SOC/ISO reports if appropriate).
  • Set direct escalation channels to vendors for incidents involving outsourced services.
  • Preserve contractual rights to audit and verify compliance.

Short practical scenarios

  • Scenario 1: A customer data leak occurs in a cloud service managed by a vendor. Recommended flow: operational security lead contacts vendor -> assess data impact with DPO -> notify authority if required -> implement containment and communication plan.
  • Scenario 2: An AI application outputs results that may be discriminatory. Recommended flow: involve CISO, DPO and legal to assess risk and, if necessary, perform or update a DPIA for high-risk AI systems; update governance and mitigations.

Practical tips for implementing the model

  • Document roles and processes in a centralized governance framework.
  • Run regular incident response exercises involving all functions.
  • Integrate security reporting into Board meetings.
  • Provide targeted training for DPOs, CISOs and operational leads on regulatory obligations and communication best practices.

Conclusion

A resilient organization separates strategic roles (CISO, Board), advisory/control roles (DPO, legal) and operational roles (security lead, SOC). Formalizing escalation flows and supplier contracts is essential to translate regulatory obligations into demonstrable practices.