4

I'm starting in a new project as a solution architect and there are many laws regulating software for this particular field. These laws are related to security, privacy, scalability and more. So the question is:

Is it my job as solution architect to learn all these laws and see how they apply to the software we are going to make or should this be a task for somebody else? like the project manager?

I would prefer to get a list like "we need x, y z" and it would be my job to describe how this should technically implemented.

1
  • Welcome! interesting question you ask - I hope you like my approach, if not feel to talkback. Sep 14 '20 at 8:04
6

There are two sides to this - laws and regulations. I would not necessarily expect someone on a project team, regardless of their role, to be an expert in either law or regulatory requirements. I would, however, expect an organization to have access to experts in these fields, either as employees or some kind of contractor or consultant relationship. I would also expect that the whole project team, again regardless of role, to make an effort to understand the applicable laws and regulations to effectively communicate and collaborate with the experts on these topics.

Having worked in multiple regulated industries, organizations in these spaces tend to have legal and quality/compliance departments. They exist outside of the product development or engineering organizations but are a resource for teams as needed. Depending on your organizational structure, whoever is responsible for staffing the projects should be coordinating with the management of these organizations to make sure that there is an ability to support the product teams. This dependency can also be managed as a risk.

8

Is it my job as solution architect to learn all these laws and see how they apply to the software we are going to make or should this be a task for somebody else?

If you don't want to learn the laws, you are basically asking to receive complete requirements with everything perfectly laid out for you, so that in turn, you can then lay out a technical solution. Even if you do get everything handed to you, you still need to understand it all, otherwise you have no guarantee you will be building the right thing (until it gets rejected by quality control or testing, which isn't very efficient or effective).

In heavy regulated environments, the company usually has a legal and/or compliance department that makes sure things get respected and implemented accordingly, but everyone involved in building the solution needs to know what they are doing. Developers and architects need to know the business domain, which in this case involves learning about some laws.

Danny Schoemann gave a nice car example in one of his comments, so I'll give another car related example: as a taxi driver, do you need to learn the city you are driving in, or do you just handle the car and expect the GPS to tell you where you need to go?

So yes, you need to learn the laws. The question isn't if you should learn them, but how much (or to what level of detail) you should learn them, to which the answer is: enough to be able to do your job efficiently and effectively.

1
  • 1
    Tahnk you, i do like your answer, and specially the last part.
    – SmallDev
    Sep 14 '20 at 13:31
7

Even if you - as solution architect - get a list of "we need x, y z" and you describe how this should be implemented, you still need to be aware of the laws related to security, privacy, scalability and more.

E.g.: if the law says you need to use a Secure Connection, then your "solution how to communicate" needs to deal with SSL and/or HTTPS and how to deal with connections that start off, say, with HTTP.

If the security laws say that a user must be allowed to delete all traces of their activity, then your "solution how to communicate" needs to deal with - for example - removing traces even when said user interacted with other users.

You can't possibly be a good Solution Architect if your solutions cause trouble with the law.

Obviously the Project Manager, QA and programmers all have to be aware of the "law" as well so that they don't implement something "illegal". But, as the "top of the dogpile" you cannot start by creating solutions that ignore - or are ignorant of - the law.

4
  • Thank you for your answer. I do understand your answer, but i feel this is kind of addressing some responsiblity to me and that responsiblity is outside my scope. I do understand the software should follow the law, but why is this something the developer or solution architecht should be responsible for? I'm a techinal person, not lawyer and I'm not very comfortable with this responsiblity.
    – SmallDev
    Sep 14 '20 at 10:31
  • 3
    @SmallDev - let's take a simple case. You need to find a solution to prevent cars from being stolen. You come up with a brilliant idea - if unauthorized people touch the car a loud siren goes off. However, the law says (in my country since 2010) that car alarms are illegal. So: is this something you need to know before coming up with a solution? Or do you say that you've provided a technical solution, let the lawyers figure out the legal aspect? Clearly you need to come up with a different technical solution.... Sep 14 '20 at 12:31
  • 4
    @SmallDev you can think of the laws as just as one of the (many!) things that impose a constraint on the possible solution space. If your proposed solution involves doing X, or does not allow to do Y, then you need to know whether law allows X or requires that you permit the customers to do Y. You don't need to be an expert on the nuances of the law, you can (and should - proactively) consult lawyers on that, but you do need to know the general principles of the law, and it's your responsibility to ensure that legally impossible plans are detected early when it's simpler to alter them.
    – Peteris
    Sep 14 '20 at 16:07
  • 5
    @SmallDev In essence, I would treat this as part of the general domain knowledge - you can't be an effective solution architect if you don't know the main properties, problems, challenges and pitfalls of the problem domain. That includes knowledge about the technologies, about the business, about internal processes, about external relations, about the habits of people (both employees and customers), about the market and competition, and also about the legal issues that are applicable to your field.
    – Peteris
    Sep 14 '20 at 16:10
3

Every employee of any organisation has a responsibility to comply with laws and regulations. For example the General Data Protection Regulation applies to all employees of an organisation. I suggest your team as a whole needs to take ownership of the regulatory compliance matters and as a solution architect you ought to play a key role in that, but what's critical is presumably going to be the relationship with your product owner/sponsor or other stakeholder(s) who make decisions on project priorities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.