We're a small company but we do have a designated CDO. My boss' title is Director of Data Services. He's the chief DBA etc but as a PCI compliant company he's also the person responsible for the security of our data, and makes all the decisions on all things related to it. PCI compliancy is a very big deal at our small company so its a very important role. 

(PCI = payment/credit card industry compliant)