The things you will be asked to build

The requests are ordinary, which is what makes them hard

Nobody asks you to build a surveillance state. They ask, pleasantly, under deadline, for something that sounds reasonable in the room:

• Scrape a competitor’s site, including the personal details of their customers or staff.
• Score job applicants on features that stand in for something you are not allowed to use: postcode, name, university, a photograph.
• Ship an assistant with no route to a human, on a service where some of the people using it are in distress.
• Reuse customer data collected for one purpose for a different one, because it is already in the warehouse.
• Publish a metric you know is wrong, because the deadline is fixed and the correct number arrives on Friday.
• Automate a decision that affects people, with no way to appeal it.

Each arrives from somebody you like, who is under pressure, who is not being malicious. That is the mechanism you have to prepare for, and it is why deciding in the meeting is so hard. Decide before.

What to do, in order

1. Ask a clarifying question that surfaces the risk without accusing anyone.

“Which lawful basis are we relying on for that data?”

“What happens for the person the model gets wrong?”

“If a customer asks why they were declined, what do we tell them?”

Half the time the request changes here, because nobody had thought about it and the question is easier to answer with a change than with a defence.

2. Offer the version you can build. “I cannot do it with the applicant photographs. I can do it with the structured application fields, and here is what that costs us in accuracy.” Being the person with an alternative is far more effective than being the person with an objection.

3. Put the concern in writing, once, plainly, to your manager. Not a manifesto. Three sentences naming the specific risk. This matters ethically (it makes the decision visible to someone accountable) and it matters for you, because a verbal objection did not happen.

4. Escalate to legal, privacy or the data protection officer if one exists. People assume these functions are obstacles. In practice they would far rather hear about a problem now than after it ships, and they carry authority you do not.

5. Decide whether you stay. If it ships anyway and it crosses your line, that is a decision you should already have thought about, in the calm, before you needed it.

The rules that exist, in outline

You do not need to be a lawyer. You need to know these questions exist and who to ask.

• Purpose limitation. Data collected for one purpose generally may not be silently reused for another. This is the core of GDPR-style regimes and of India’s DPDP Act, and it is the rule most often broken by accident inside data teams.
• A right to human review of significant automated decisions, in several jurisdictions. If a model declines someone’s loan or job application, there is often a legal requirement for a person to be reachable.
• Sector rules. Health, credit, employment, insurance and children’s services all carry additional obligations that override general practice.
• Scraping. Public availability is not permission, particularly for personal data. The terms of the site, copyright, and data protection law all apply separately.

Regulators publish their own guidance, free and written for non-lawyers. Your national data protection authority’s website is a better source than any paid summary, and citing it in a meeting is unusually effective.

The honest career cost

Refusing has a cost. Usually small: a slightly awkward meeting, a reputation for asking difficult questions, which in a decent organisation is an asset. Occasionally large: the project happens anyway and you are the person who objected.

People who navigate this well share three habits. They pick their hills: not every imperfection is a resignation. They are specific about the harm rather than moralising, because “this will decline legitimate customers in three states and we will not be able to explain why” moves a room and “this is unethical” does not. And they always bring the alternative.

Where this advice stops

None of it helps much if you are the only technical person and the founder wants the thing. There is no committee, no legal function and no ally. Then the question reduces to whether you can afford to leave.

Which is the practical, unromantic conclusion: three months of savings is the thing that lets you hold a line. It is a career asset, and almost nobody thinks of it as one.