The e-Evidence Regulation requires digital service providers to deliver data to a court in another EU country within 10 days, and in urgent cases within 8 hours. That calls for people who understand law, security and cloud architecture at the same time. That combination is already scarce, and demand for it is growing fast.

As a hiring manager, you're not waiting for yet another compliance project. Yet there's now a deadline on the table that is non-negotiable. No room for a pilot, no time to calmly test who fits.

As of mid-August, the regulation applies directly, without the Netherlands having to create its own legislation for it. Anyone offering cloud services, hosting or a SaaS platform must now have a process in place to recognize, assess and execute orders from foreign courts. Those who don't have that in order face fines of up to 2% of global revenue. And you notice that first on the labor market: the people who can build and safeguard this are simply too few.

The e-Evidence Regulation doesn't hit one team, but an entire chain: legal, security and data architecture. Companies are now looking for people who can work at the intersection of those disciplines, and a year ago that combination was barely on any job profile.

Think of a security architect who designs infrastructure so that data can be located quickly per customer and per country, without tearing up encryption and access management. Think also of a data protection officer who has to balance e-Evidence obligations with GDPR principles like data minimization. And SOC analysts who need to handle an incoming order within 8 hours as if it were an incident.

That last part is exactly the shift. An e-Evidence request is no longer paperwork, it's operational. Someone has to triage, extract data, and be able to justify it. Comparable to the demand for an infrastructure engineer who builds security requirements into the design instead of layering them on afterwards.

Companies that start looking after the deadline are too late. The profiles this law demands are the same people who also handle AI governance and data sovereignty. So that market is already tight before the first vacancy goes online.

Fines for non-compliance can run up to 2% of global annual revenue, and providers must be able to deliver data within 10 days of a valid order.

That number explains why large players are already bidding heavily on senior security and privacy profiles. Smaller hosting and SaaS companies can't always keep up with that pace. They reach for external compliance specialists or shared facilities faster, because they can't get it done in time themselves.

We see that reflected in the demand coming in. No longer just "a security engineer", but someone who can also explain to a lawyer why a certain dataset can't simply be handed over. That's a different kind of profile than three years ago.

A purely technical profile is no longer enough. Companies are looking for people who can translate technology into a legal framework, and vice versa. That's exactly the kind of role that's hard to fill through a standard job ad.

Take a data engineer who becomes responsible for audit trails: they need to be able to structure data, but also understand why reproducibility may become relevant in a courtroom. Or an IAM specialist who has to shield access to criminally relevant data with a four-eyes principle. That requires knowledge of identity management plus an awareness of what's at stake when it goes wrong.

Not every developer wants that responsibility. Fair enough. But those who do become scarce, and therefore expensive.

For a senior engineer already working on governance questions around AI, the step to e-Evidence compliance is small. The underlying question is the same: how do you prove your process is sound, not just that it works.

Waiting until the first order arrives is not a strategy. Companies starting now usually choose a combination: upskilling their own people, targeted hiring, and where needed an external party for the first period.

That starts with a point of contact. Not one person who does everything, but a small team: someone legal, someone security, someone who knows the data platforms. That's exactly how we're used to working at Doghouse. Not one consultant who solves the problem, but a team that runs through intake, sourcing and interviews in a structured way.

We regularly see companies thinking they're looking for a compliance officer, when they actually need a security architect with legal instincts. You only discover that difference when someone knows the field well enough to ask the right questions during the intake.

For a profile like a data analyst working with sensitive datasets, the same applies: the technical match is the starting point, not the end point.

If you're currently doing security, privacy or data architecture, this is an opportunity to broaden your profile. Not by taking a law course, but by joining projects where legal and technical requirements come together.

Whoever can explain why a certain logging choice is also legally defensible stands out. That's not theory, you simply see it back in the salary: senior profiles with this combination can already command higher rates.

At the same time, be careful not to say yes to everything. Not every company has thought this through seriously. Some are mainly looking for someone to survive the deadline, not someone who really builds the process. You usually notice that difference in the first conversation.

The e-Evidence Regulation is not an incident, it's a structural shift in what companies expect from their tech teams. Those who wait to recruit will soon be chasing a deadline that doesn't move.

At Doghouse we don't build a shortlist based on keywords in a CV. We look at who understands the process, who has already demonstrated the combination of law and technology in practice, and who fits how your organization solves this. If you're running into this, feel free to talk it through with us and see what it means for your team.