It's worth saying that there is no such thing as software which isn't GDPR compliant.
Rather, it is certain forms of data collection, storage, and processing that aren't compliant.
It is the organisation who process the data who are responsible for compliance with data protection laws, not the developer of any software that organisation uses as part of their processing.
Obviously, Alice may have responsibilities, either as someone also responsible for data protection compliance at the relevant organisation, or as a contractor or senior employee who is expected to understand what is required for compliance and to design the software in an appropriate way.
But if Alice has raised the concerns and has been directed to work in a particular way inconsistent with her recommendations or warnings, then any professional liability is likely discharged.
What may remain is some kind of criminal liability, if it would be obvious to Alice that the software could only have a criminal application. This might apply if she is writing special malware to exfiltrate data for example.
But there would likely be a high bar, and if the criminality would only be contingent on further action by the employer or client, then it is unlikely Alice would be caught up.
Alice could also make a report to a relevant authority, such as the police or the information commissioner, or seek advice from them. If there were a criminal allegation later, the fact of having made such contact would almost certainly absolve Alice.
