We often picture the DPO as insurance you trigger when something goes wrong. It's the opposite. Their value is decided before the incident, when a decision can still be changed. Consulted after the fact, all they can do is note the damage.
Lessons from a real case
In 2025, a major retailer installed hidden cameras in its stockrooms. The DPO was only informed once the system was in place, and had already been taken down. Among several failings, the CNIL (the French data protection authority) held that the DPO had not been involved in good time, and imposed an overall fine of 100,000 euros.
The message is clear: consulting the DPO once the project has launched is not enough. If they can no longer influence the decision, the obligation is not met. Operational urgency excuses nothing. On the contrary, it means you must plan for a deputy and a prior consultation.
An opinion delivered too late is not an opinion. It's an incident report.
The milestone that changes everything
In practice, a useful DPO is involved when a project is being scoped, not when it's delivered: before buying software, before designing an algorithm, before choosing a legal basis, before installing any monitoring. Some topics trigger this milestone automatically: sensitive data, minors, biometrics, scoring, AI, employee monitoring, transfers outside Europe, mass data collection.
Data breach: 72 hours, one shot
In the event of a personal data breach, the clock runs fast: where there is a risk, the CNIL must be notified without undue delay and, where feasible, within 72 hours. The DPO must be informed immediately and advise on the risk and the documentation, but the decision to notify stays with the data controller.
Without a procedure or a deputy, those 72 hours disappear into meetings. A dpo@ mailbox nobody checks during vacation, reliance on a single person, no emergency access: small details that, on that day, cost you a late notification.
What a DPO doesn't do, and why it matters
A DPO doesn't take on your liability. They advise, monitor and raise alerts independently; the responsibility for demonstrating compliance remains yours. If a provider promises you "zero penalties", that should raise a red flag: it's not what the law provides, and it's not what protects you.
What protects you is the paper trail: dated opinions, decisions you own when you depart from the advice, proof that the DPO was consulted in time. On inspection day, that file speaks for you.
Two things to do today
Add a "DPO opinion" box to your projects involving data, and write your breach procedure today: who raises the alert, who decides, who covers during absences. These two habits are worth more than any clause in a contract.
The best time to call your DPO is before. The worst is when the CNIL has already called.
