I've recently been asked if I'm part of CIISec in an interview and while I can understand the logic of joining such an organization I'm still unsure what one is supposed to get out of it in 2022.Are any of those communities relevant/valuable to you in cloud/cyber space ? or IT in general ? In what way ?
Very good at putting into words my introspection efforts and try to devise action plans for both personal and professional growth.
https://gdpr-info.eu/art-3-gdpr/
3-1: if you're EU citizen in the US using only a US service then GDPR does not apply it falls under US data protection however if that US service is using an EU subprocessor then GDPR does apply
3-2: if you're a US citizen in EU you're under GDPR regardless of the service you're using
Also https://gdpr-info.eu/recitals/no-23/ if you're a US company targeting EU residents you fall under GDPR
Customers don't have to be in EU for GDPR to apply, it applies everywhere as long as the data subject is an EU citizen. You're probably already not compliant unless you can 100% guarantee that none of your users in the US are EU citizens.
The goal of GDPR is not to enforce a technical choice of a provider/technology but to ensure the existence of processes and the validity of data collection and usage by companies on EU citizens. In essence, no it is not required to host your data in Europe but that is a possible interpretation.
First lawyer up, identify which data items are PII and what is not, make sure you have a process for article 17 (right to data erasure), appoint a DPO, make a real privacy policy stating the full extend and intent of data collection. Depending on the type of data you process different regulations will apply in addition to GDPR (PDSG, HDS for health data BaFin/AMF for finance in Germany/France) they vary based on industry and country, that will impact your overall technical design so this is prep work for everything else.
Technically I would definitely suggest having a separate database in EU and be prepared to potentially split your data among different countries as well. The processing of that data also might need to be split between US/EU and EU countries.
If you deal with data aggregation between EU/US you might not be allowed to run some analytics that contain personal data and will need to anonymize it and justify of that process to your DPO.
As hiring manager I do not disagree with basic tests for junior roles but for senior roles it definitely does not assess where the value is, coding is only part of the equation. I believe that a short call with a peer from the team to review a merge request/architecture decision is far more interesting.