All data now collected directly or indirectly that can identify an individual or is linked to an identified individual now needs careful consideration - do you have explicit consent to collect and use that data for that specific purpose? How is that data stored? Who has access to that data? Can the individual view it, correct it, delete it?

For example your data scientist can't now look at the raw data and decide to feed it into some new machine learning process to identify fraudulent transactions if when the data was collected explicit consent wasn't obtained to do that.

Technical people now need to understand what data is 'protected' by GDPR and what consents have been given for the processing of that data. And that for example linking an IP address to a piece of data can suddenly transform it into personal data now protected by GDPR.

Sounds like with your two skillsets, compliance and/or internal audit would be a good job for you. These jobs often rely on reading legal-ish documents such as HIPAA, PCI, and GDPR and interpreting them for your company's unique situation, then either overseeing the implementation of IT policies or actually implementing the IT policies yourself to control the IT systems appropriately.

With internal audit you're generally overseeing the compliance folks (from a distance), as a compliance person you're more often implementing the technology yourself. Another role to look into is risk management. All of them are a small step back from "hard" IT like sysadmin or programming and getting more into the people and process side of the IT house.

Spot on! I moved from infrastructure engineer to risk management (governance, risk, compliance). You need the technical experience to translate compliance and governance requirements into technical requirements.

Highly recommend the move for anyone who doesn’t want to be on call or carry a pager anymore.

In the UK a consultant with a moderate amount of experience and a GDPR Practitioner qualification can make between £500 and £800 a day in the City. That kind of work is largely going to be working as part of a team to survey the policy and process landscape of the organisation and suggest/make changes in accordance with the changes in the law.

But with regards to your point about having a law degree - I'm not sure where you're based but a qualified solicitor with a specialism in cyber law and data protection here in the UK will be set for a while. The GDPR enforcement date is a cash cow for consultants, but for lawyers this is just the beginning.

Edit: After seeing what freehunter posted at the same time as me - If you don't want to go through the hassle of becoming a qualified solicitor, then compliance is definitely a way to go. GDPR sets out a requirement for organisations to employ 'Data Protection Officers' so if compliance/risk management is of interest to you then the compliance ladder is pretty solid.

Reviewing systems and business processes to ensure compliance, specifying internal workflows to meet requirements, and all sorts!

It's not just GDPR, but lots of other EU regulations this year that are having large impacts on tech systems (e.g. in the financial world), and being across those is valuable.

Perhaps you won't get your hands dirty on actual code, but technical implementation of regulation is a lucrative field (or, at least, this phase of "oh shit we need to do something" is).

Have you tried the financial sector?

Banks, especially, are inundated with regulations (high-level, abstract) that necessitate technical (low-level, concrete) implementations or adaptations. Often, there are great legal minds at work on the one side, and great technical minds on the other side, with a large gap and significant barriers communication in between.

Being proficient in both of these matters can enable one to bridge that gap.

YUGE impact in the financial sector.

Please don't post unsubstantive comments here.

Why the down votes? It does have huge impact on the financial sector.

European banks are scrambling to patch software to purge older records. Backup strategies have to be changed to accommodate this as well.

Why is trampypizza's answer to this marked as [dead]? It looks like a perfectly reasonable response, no?

Maybe a false-positive of the spam detector. If you go to the comment's own page ( https://news.ycombinator.com/item?id=16257086 ) you can vouch for it. (There might be a karma threshold for that, I'm not sure.)

Cheers.