Privacy Intern

Xpansiv%20; New York (NY); On-site; USD 28,000 - 48,000; Part time

Benefits offered by this job

Paid internship

Job summary

Xpansiv is seeking a Privacy Intern to support the Risk & Compliance Department in maturing our enterprise privacy program. The initial focus will be on refining GDPR privacy obligation matrices and documenting processing registers for the EU and globally.

If time permits, the intern will contribute to broader privacy program buildout activities and work with stakeholders across Legal, Security, Product, and operations.

Qualifications

• Currently pursuing undergraduate or graduate degree in law, privacy, or related field.
• Strong understanding of GDPR concepts and RoPA principles.
• Excellent written communication and documentation skills.

Responsibilities

• Support GDPR privacy obligation matrices with controls, owners, evidence, and documentation requirements.
• Review RoPA and processing register documentation for EU operations.
• Perform research on international privacy obligations and translate requirements into practical documents.
• Collaborate with internal stakeholders to collect purposes of processing, data categories, retention, transfers, processors/sub-processors, and security measures.
• Identify documentation gaps and propose governance process improvements.
• Assist in building privacy program materials (procedures, playbooks, trackers, audit-ready files).
• Maintain organized documentation with version control and traceability.

Skills

GDPR concepts

Documentation

Stakeholder coordination

Legal research

Education

Undergraduate or graduate degree in related field

Tools

OneTrust or similar

Job description

Xpansiv is the leading infrastructure provider for the energy transition markets.

Our comprehensive platform includes registries, online marketplaces, market execution services, wholesale power solutions, and market data for energy and environmental commodity markets. Trusted worldwide, Xpansiv enables stakeholders to deliver transparent, credible, and auditable environmental claims to address the growing global demand for assurance and accountability on climate action and sustainability performance.

From our founding in 2009 through more than 10 acquisitions, Xpansiv has become a global leader in environmental commodity markets. We are backed by Blackstone and other leading investors.

Position summary

We are seeking a Privacy Intern to support the Risk&Compliance Department in maturing our enterprise privacy program. Theinitialfocus will be to help refine and expand our GDPR privacy obligation matrices and support the documentation of required processing registerswiththe EU andacross theglobe. If timepermits, the intern will also contribute to broader privacy program buildout activities.

Key responsibilities

• Support development and maintenance of GDPR privacy obligation matrices (e.g., mapping obligations to controls, owners, evidence, and documentation requirements).
• Assistin reviewing and updating Records of Processing Activities (RoPA) and related processingregisterdocumentation for EU operations.
• Conduct research on international privacy obligations and interpret requirements into practical documentation and program artifacts.
• Partner with internal stakeholders to collect required information (e.g., purposes of processing, data categories, retention, transfers, processors/sub-processors, security measures).
• Identifydocumentation gaps and propose improvements to privacy governance processes and templates.
• Help prepare materials to support privacy program buildout (e.g., procedures, playbooks, trackers, audit-ready evidence files) as timepermits.
• Maintain organized, high-quality documentation with strong version control and traceability.

Qualifications

• Currently pursuing a later-stage undergraduate degree or a graduate degree (Master’s or Juris Doctor / law degree preferred) in a related field (e.g., law, privacy, compliance, risk management, information security, public policy, or business).
• Strong understanding of GDPR concepts and key privacy program structures (e.g.,RoPA, lawful bases, DPIAs, data subject rights, data transfers, controller/processor roles).
• Exceptional attention to detail and ability to produce clear, well-structured documentation.
• Self-motivated, driven, and comfortable working independently with minimal supervision.
• High curiosity and willingness to learn and ask thoughtful questions.
• Strong written communication and stakeholder coordination skills.

Preferred / bonus skills

• Coursework or experience with international privacy regulations (e.g.,EU and UKGDPR,U.S. state privacy laws).
• Exposure to privacy operational artifacts such as DPIAs/PIAs, vendor/processor assessments, and transfer impact assessments.
• Comfort working with structured trackers and matrices (Excel/Sheets) andmaintainingdocumentation quality at scale.
• Familiarity with common privacyor GRCtooling (e.g.,OneTrustor similar),notrequired.

Core competencies

• Analytical thinking: able to translate regulatory text into actionable requirements.
• Documentation excellence: produces organized, consistent, audit-ready work products.
• Accountability/Ownership: follows through on tasks and proactively manages open items.
• Collaboration: works effectively with Legal, Security, Product, and operational teams.
• Integrity anddiscretion: handles sensitive information appropriately.

Compensation

The anticipated hourly pay range for this internship is $20–$25 per hour for undergraduate students and $30–$35 per hour for graduate‑level students, based on a good‑faith estimate. Actual pay within these ranges may vary based on academic level, skills, and relevant experience, in accordance with applicable pay transparency laws.

Here at Xpansiv, we cultivate diversity, celebrate individuality, and believe unique perspectives are key to our collective success in building trust and transparency in global efforts toward net-zero future. Xpansiv is committed to equal employment opportunity regardless of race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, disability, genetic information, protected veteran status, or any status protected by applicable federal, state, or local law.