4 ms·

Good time to be a contractor who knows about GDPR compliance

Keronk 9y ago
Woop yeah it is.
roel_v 9y ago
In what way? Genuinely curious - what sort of technical work needs to be done that requires actually knowing the regulation? I'm asking because I got my law degree with the idea that I would combine tech skills with knowledge of the law, but I never really found an angle to make that work.
- freehunter 9y ago
  Sounds like with your two skillsets, compliance and/or internal audit would be a good job for you. These jobs often rely on reading legal-ish documents such as HIPAA, PCI, and GDPR and interpreting them for your company's unique situation, then either overseeing the implementation of IT policies or actually implementing the IT policies yourself to control the IT systems appropriately. With internal audit you're generally overseeing the compliance folks (from a distance), as a compliance person you're more often implementing the technology yourself. Another role to look into is risk management. All of them are a small step back from "hard" IT like sysadmin or programming and getting more into the people and process side of the IT house.
  - toomuchtodo 9y ago
    Spot on! I moved from infrastructure engineer to risk management (governance, risk, compliance). You need the technical experience to translate compliance and governance requirements into technical requirements. Highly recommend the move for anyone who doesn’t want to be on call or carry a pager anymore.
- trampypizza 9y ago
  In the UK a consultant with a moderate amount of experience and a GDPR Practitioner qualification can make between £500 and £800 a day in the City. That kind of work is largely going to be working as part of a team to survey the policy and process landscape of the organisation and suggest/make changes in accordance with the changes in the law. But with regards to your point about having a law degree - I'm not sure where you're based but a qualified solicitor with a specialism in cyber law and data protection here in the UK will be set for a while. The GDPR enforcement date is a cash cow for consultants, but for lawyers this is just the beginning. Edit: After seeing what freehunter posted at the same time as me - If you don't want to go through the hassle of becoming a qualified solicitor, then compliance is definitely a way to go. GDPR sets out a requirement for organisations to employ 'Data Protection Officers' so if compliance/risk management is of interest to you then the compliance ladder is pretty solid.
- wastedhours 9y ago
  Reviewing systems and business processes to ensure compliance, specifying internal workflows to meet requirements, and all sorts! It's not just GDPR, but lots of other EU regulations this year that are having large impacts on tech systems (e.g. in the financial world), and being across those is valuable. Perhaps you won't get your hands dirty on actual code, but technical implementation of regulation is a lucrative field (or, at least, this phase of "oh shit we need to do something" is).
- Angostura 9y ago
  Why is trampypizza's answer to this marked as [dead]? It looks like a perfectly reasonable response, no?
  - yorwba 9y ago
    Maybe a false-positive of the spam detector. If you go to the comment's own page ( https://news.ycombinator.com/item?id=16257086 https://news.ycombinator.com/item?id=16257086 ) you can vouch for it. (There might be a karma threshold for that, I'm not sure.)
    - Angostura 9y ago
      Cheers.
- ckastner 9y ago
  Have you tried the financial sector? Banks, especially, are inundated with regulations (high-level, abstract) that necessitate technical (low-level, concrete) implementations or adaptations. Often, there are great legal minds at work on the one side, and great technical minds on the other side, with a large gap and significant barriers communication in between. Being proficient in both of these matters can enable one to bridge that gap.
  - boobsbr 9y ago
    YUGE impact in the financial sector.
    - dang 9y ago
      Please don't post unsubstantive comments here.
    - boobsbr 9y ago
      Why the down votes? It does have huge impact on the financial sector. European banks are scrambling to patch software to purge older records. Backup strategies have to be changed to accommodate this as well.
- snowwolf 9y ago
  All data now collected directly or indirectly that can identify an individual or is linked to an identified individual now needs careful consideration - do you have explicit consent to collect and use that data for that specific purpose? How is that data stored? Who has access to that data? Can the individual view it, correct it, delete it? For example your data scientist can't now look at the raw data and decide to feed it into some new machine learning process to identify fraudulent transactions if when the data was collected explicit consent wasn't obtained to do that. Technical people now need to understand what data is 'protected' by GDPR and what consents have been given for the processing of that data. And that for example linking an IP address to a piece of data can suddenly transform it into personal data now protected by GDPR.

Woop yeah it is.

In what way? Genuinely curious - what sort of technical work needs to be done that requires actually knowing the regulation? I'm asking because I got my law degree with the idea that I would combine tech skills with knowledge of the law, but I never really found an angle to make that work.

freehunter 9y ago
Sounds like with your two skillsets, compliance and/or internal audit would be a good job for you. These jobs often rely on reading legal-ish documents such as HIPAA, PCI, and GDPR and interpreting them for your company's unique situation, then either overseeing the implementation of IT policies or actually implementing the IT policies yourself to control the IT systems appropriately. With internal audit you're generally overseeing the compliance folks (from a distance), as a compliance person you're more often implementing the technology yourself. Another role to look into is risk management. All of them are a small step back from "hard" IT like sysadmin or programming and getting more into the people and process side of the IT house.
- toomuchtodo 9y ago
  Spot on! I moved from infrastructure engineer to risk management (governance, risk, compliance). You need the technical experience to translate compliance and governance requirements into technical requirements. Highly recommend the move for anyone who doesn’t want to be on call or carry a pager anymore.
trampypizza 9y ago
In the UK a consultant with a moderate amount of experience and a GDPR Practitioner qualification can make between £500 and £800 a day in the City. That kind of work is largely going to be working as part of a team to survey the policy and process landscape of the organisation and suggest/make changes in accordance with the changes in the law. But with regards to your point about having a law degree - I'm not sure where you're based but a qualified solicitor with a specialism in cyber law and data protection here in the UK will be set for a while. The GDPR enforcement date is a cash cow for consultants, but for lawyers this is just the beginning. Edit: After seeing what freehunter posted at the same time as me - If you don't want to go through the hassle of becoming a qualified solicitor, then compliance is definitely a way to go. GDPR sets out a requirement for organisations to employ 'Data Protection Officers' so if compliance/risk management is of interest to you then the compliance ladder is pretty solid.
wastedhours 9y ago
Reviewing systems and business processes to ensure compliance, specifying internal workflows to meet requirements, and all sorts! It's not just GDPR, but lots of other EU regulations this year that are having large impacts on tech systems (e.g. in the financial world), and being across those is valuable. Perhaps you won't get your hands dirty on actual code, but technical implementation of regulation is a lucrative field (or, at least, this phase of "oh shit we need to do something" is).
Angostura 9y ago
Why is trampypizza's answer to this marked as [dead]? It looks like a perfectly reasonable response, no?
- yorwba 9y ago
  Maybe a false-positive of the spam detector. If you go to the comment's own page ( https://news.ycombinator.com/item?id=16257086 https://news.ycombinator.com/item?id=16257086 ) you can vouch for it. (There might be a karma threshold for that, I'm not sure.)
  - Angostura 9y ago
    Cheers.
ckastner 9y ago
Have you tried the financial sector? Banks, especially, are inundated with regulations (high-level, abstract) that necessitate technical (low-level, concrete) implementations or adaptations. Often, there are great legal minds at work on the one side, and great technical minds on the other side, with a large gap and significant barriers communication in between. Being proficient in both of these matters can enable one to bridge that gap.
- boobsbr 9y ago
  YUGE impact in the financial sector.
  - dang 9y ago
    Please don't post unsubstantive comments here.
  - boobsbr 9y ago
    Why the down votes? It does have huge impact on the financial sector. European banks are scrambling to patch software to purge older records. Backup strategies have to be changed to accommodate this as well.
snowwolf 9y ago
All data now collected directly or indirectly that can identify an individual or is linked to an identified individual now needs careful consideration - do you have explicit consent to collect and use that data for that specific purpose? How is that data stored? Who has access to that data? Can the individual view it, correct it, delete it? For example your data scientist can't now look at the raw data and decide to feed it into some new machine learning process to identify fraudulent transactions if when the data was collected explicit consent wasn't obtained to do that. Technical people now need to understand what data is 'protected' by GDPR and what consents have been given for the processing of that data. And that for example linking an IP address to a piece of data can suddenly transform it into personal data now protected by GDPR.