Ask anyone who has worked in privacy for a while, and they’ll recognise it. Legal and the DPO don’t always see eye to eye. Sometimes that is a healthy difference of opinion, settled over coffee. Sometimes it’s recurring friction that slows decisions down or quietly stops them from being made. In this blog, we look at where that friction comes from, why it’s rarely about personalities, and how organisations can turn it into something productive.
Signed, sealed, and never seen by the DPO.
Picture an ordinary scene. A Data Processing Agreement lands on someone’s desk, often tucked away as an annex to a larger contract. Legal reviews it, as legal should. Many DPOs are perfectly happy to leave DPAs to legal, which is a sensible division of labour.
The trouble starts when nobody has agreed in advance what “acceptable” means from a data protection point of view, and when there is no clear trigger for when legal should pull in the DPO’s specialist advice. Without those agreements, a DPA can be reviewed, signed and filed without the DPO ever seeing it. They find out afterwards, or by chance.
That is where the clash begins. The DPO spots a problem, perhaps personal data going to a country outside the EEA, or a list of sub-processors nobody checked. Legal points out that the contract is signed and the business is waiting. The DPO feels bypassed, legal feels second-guessed, and both have a point. Then the same discussion comes back with the next contract, and the one after that.
Two functions, two mandates.
It’s tempting to fall back on stereotypes and blame personalities: “the lawyer who is too commercial”, and “the DPO who is too rigid”. What we usually find is a gap in governance where nobody decided upfront who owns what or how disagreements get resolved.
To see where that gap comes from, it helps to look at what each function is here to do.
- Legal manages risk across the whole business, from contracts and liability to disputes and regulatory exposure.
- The DPO safeguards the rights of the people whose data the organisation processes. They do so by informing, advising and monitoring (Article 39 GDPR). The DPO has no veto, but their advice must be sought in time and taken seriously.
Both roles are important, and both are about compliance. But they are different jobs and treating them as one is where the friction often begins. That happens easily, because many DPOs have a legal background. Colleagues keep seeing them as “someone from Legal”, even though their role is deliberately independent.
Their instincts differ as well. Legal teams are trained to find solutions, negotiate and get the deal done while keeping exposure under control. The DPO starts from a different place. Under the GDPR, the DPO looks at each processing activity from the point of view of the individuals behind the data. That can lead to tension. What the business has in mind may not be lawful in its current form. When the DPO points that out, the role is working exactly as the regulation intends.
Without a clear line between the two roles, every contract review, new processing activity and vendor onboarding becomes a fresh negotiation over territory, instead of a process both teams already understand.
Three patterns we often see
In our experience, the same three patterns come up repeatedly, regardless of company size or sector.
- The DPO comes in too late. They are treated as a final checkbox, rather than involved from the start. By the time they see the file, the business has already made commitments, so any concern they raise feels like an obstacle. The GDPR asks for the opposite, a DPO who is involved “properly and in a timely manner” (Article 38(1)).
- The reporting lines are Legal and the DPO report into different parts of the organisation, sometimes with different risk appetites, and nobody above them brings the two views together. The GDPR expects the DPO to report directly to the highest management level (Article 38(3)). Legal usually also reports to senior management but without senior management being capable of weighing and reconciling the differing views, this rarely works.
- Disagreements stay unresolved. There is no shared, documented process for how privacy questions get raised, escalated and resolved. So, every disagreement is handled informally, case by case, and whoever pushes hardest that week usually wins.
Left unaddressed, these gaps get more expensive over time. Deals are delayed, decisions become inconsistent, and sooner or later there is a data protection incident that the right person could have caught earlier.
What can be done to improve teamwork between DPO and legal
Some friction between legal and the DPO is healthy. It shows that both functions are doing their jobs. The goal is to give that friction somewhere useful to go, and that comes down to three things.
- Bring in the DPO early: Involve the DPO from the start, as part of the design conversation, especially for new data flows, new vendors or new products. A DPO who only sees a file at the last minute will slow things down, and rightly so, because that is often the only moment left to raise a concern. A DPO who is involved from day one can help shape the deal instead of stopping it.
- Give the DPO a direct line to the top. Senior leadership should decide how disputes are escalated when legal and the DPO cannot agree, instead of leaving it to whoever is more persistent or more senior in the room. That path should respect both the DPO’s independence and the business’s need to make decisions. And when management decides not to follow the DPO’s advice, write down why. It protects both the organisation and the DPO, and it turns a disagreement into a clear, documented decision.
- Governance: agree on the rules in advance. Decide who reviews what, at which stage, and what happens when legal and the DPO disagree. For DPAs, that means agreeing what “acceptable” looks like from a data protection point of view and setting clear triggers for when legal brings in the DPO, for example transfers outside the EEA, sensitive data or new sub-processors. Nobody should need an email chain to find out whether the DPO can pause a contract. The answer should be clear long before the contract exists.
None of this is complicated in theory. In practice, it takes a slightly uncomfortable conversation about roles and responsibilities and having these clearly documented.
Time for peace talks.
At CRANIUM, we sit on both sides of the table. Because we understand both points of view, we can help you draw a clear line between the two.
Does this situation sound familiar? Get in touch and we will help you draw up the terms of peace. Coffee optional, but recommended.
Contact us
