Not sure exactly what it means in practice but I’m happy to keep building automated compliance systems for new European regulations as long as I’m paid to do it.
Compliance is making sure they signed the right documents (W-8EBN for remote workers) and that they provided their real address. (It differs a lot depending on the state/country).
These guys are often hired to implement regulation or certification requirements and the organization, if its goal is to comply, has to change its behavior and processes.
Not saying your point is not true, I met guys who did it just because too. But it's not always malice or incompetence on their part.
It really should be defined by company size or revenue. If I my site goes viral and a small web app suddenly has 2M lines of logs, but my revenue is small/non-existent, then there's no reason to comply. If that pushes my revenue over 1M euros a year, you now get pushed into a zone where you should be compliant, and you have enough revenue to afford it as well.
> mandatory compliance trainings that come up quarterly and take hours
Compliance has a bad name because it's bureaucratic. But in software, compliance can cover important things like privacy, security, internationalization, and accessibility. Getting these things right is a moral imperative in many cases. For this reason, the rise of move-fast-and-break-things startups, with their developers unfettered by bureaucracy, worries me.
reply