Privacy Program Manager

Clay Labs; San Francisco (CA); On-site; USD 180,000 - 230,000; Full time

Job summary

Clay Labs is seeking a Privacy Program Manager to build and run a scalable privacy program for data-driven products and AI governance. You’ll own the privacy roadmap, manage records of processing, and coordinate with Legal, Product, Engineering, and Security to embed privacy by design.

Strong knowledge of GDPR/CCPA and hands-on PIAs/DPIAs are required. You will also oversee vendor diligence, data inventory controls, and privacy notices while driving automation to reduce manual work and ensure

Qualifications

• 6 to 8+ years building and running privacy programs or privacy operations at a technology company, ideally high-growth B2B SaaS, data, or AI
• Hands-on experience with privacy requests, data mapping, PIAs and DPIAs, vendor diligence, and consent management
• Working knowledge of GDPR, UK GDPR, CCPA/CPRA, and other US state privacy laws, and good judgment about when to bring in Legal
• AI fluency: you understand how LLM features and agents use data, and you can put frameworks like the EU AI Act into practice
• Technical fluency: you can follow data across systems and APIs and ask engineers precise questions
• A track record of building a program from scratch and making it stick with teams that didn't report to you
• Clear, plain writing, and a habit of using AI and automation to remove routine work
• CIPM or equivalent certification
• A law degree is not required

Responsibilities

• Own the privacy program plan with owners, dependencies, and six- and twelve-month outcomes
• Maintain records of processing for product and operations, set privacy requirements for data inventory
• Run PIAs, DPIAs, transfer and legitimate interests assessments, and AI assessments
• Integrate privacy into product development processes to speed decision-making and keep Legal involved early
• Run the operational side of AI governance and maintain records of product and internal tool use of AI
• Conduct provider and vendor privacy diligence across onboarding, renewal, and exit
• Operate privacy rights requests end-to-end including California DROP requests
• Turn retention rules into system mappings with technical owners and coordinate fixes
• Keep privacy notices and subprocessor lists aligned with actual data processing
• Automate, train, and measure privacy program effectiveness and metrics

Skills

Privacy program management

Privacy operations

GDPR/CCPA knowledge

AI governance

Data mapping

PIAs/DPIAs

Vendor diligence

Consent management

Clear writing

Law/Regulatory framework

Education

CIPM or equivalent certification

Job description

About Clay

AI is unleashing the biggest wave of company creation in history. Clay's mission is to be the engine those companies use to grow to their full potential.

Clay predicts the next best action for your business and then helps you take it. We started by aggregating the best data for B2B companies. Then, we built the infrastructure to run any personalized campaign on top of it, including emails, ads, landing pages, and workflows that make reps more productive. Now, we're building agents that can help grow your company for you. We're already helping thousands of customers — including Anthropic, OpenAI, Google, and Visa — go to market with unique data, signals, and AI research.

In 2026, we raised a $115M Series D at $7.1B Valuation led by Wellington — and are on track to cross $200M in revenue this quarter. We also launched a $1M Scholarship fund for GTME Education.

Some things to know about us:

• Our community includes 17,000+ customers, 200+ integration partners, 125+ agencies, 50+ Clay clubs, and 30k members on Slack.

• Our culture is unique inside and outside of work. Our team members are also DJs, activists, writers, clowns, marathoners, skydivers, psychedelic therapists, social workers, and more.

• All employees can work with world-class coaches who specialize in creativity, management, and more.

• Our operating principles — including negative maintenance and non-attached action — guide our work. Read more about them here.

• Read about us in the NYT, Forbes, First Round Review, and more.

Hear from our employees directly on our Glassdoor page!

Privacy Program Manager @ Clay

Personal data is at the center of how Clay works. It comes from our data provider marketplace, our own proprietary B2B dataset, the web research our agents run, and the records our customers bring to Clay. Every person in that data, and every customer who relies on it, needs to trust how Clay handles it. As we build agents that research and act for our customers, that trust also depends on how we build and use AI.

We're looking for a Privacy Program Manager to help build and run Clay's privacy program, including the operational side of AI governance. You'll report to our Head of Product, Privacy & AI Legal and work closely with Product, Engineering, Data Platform, Data Partnerships, Security, Marketing, and Sales. Our Legal team sets the standards and makes the legal calls. As part of that team, you'll turn them into processes, records, and tooling that work at Clay's pace.

This role is for someone who wants to build and own a privacy program that differentiates Clay. You'll connect the privacy work already happening across Clay into one program with clear owners, reliable operations, and evidence we can stand behind. You'll also automate as much as possible, so Product and Engineering can spend more time building.

What You'll Do

• Own the program plan. Turn Legal's privacy strategy into a prioritized plan with owners, dependencies, and six- and twelve-month outcomes. Flag early when work lacks an owner or capacity.

• Own our records of processing: Maintain Clay’s records of processing for the product and our own operations, and set the privacy requirements for the data inventory our GRC team maintains: sources, uses, recipients, storage, retention, and restrictions.

• Run privacy and AI assessments. Run PIAs, DPIAs, transfer and legitimate interests assessments, and AI assessments from fact gathering through follow-up. Legal makes the legal determinations.

• Build privacy into how Clay ships. Help run privacy and AI review inside EPD’s product development process, so teams get fast, consistent answers and the right questions reach Legal early.

• Run the operational side of AI governance. Keep records of how Clay's products and internal tools use AI. Gather evidence on how agent features are controlled, and keep review conditions and customer guidance current as models and permissions change.

• Run provider and vendor privacy diligence. Review data providers, marketplace partners, and vendors at onboarding, change, renewal, and exit. Maintain our subprocessor list and customer notices.

• Operate privacy rights requests. Own access, deletion, correction, and opt-out requests end to end, including California Delete Act (DROP) requests, across the systems that hold a person's data, using our privacy platform (Transcend). Close every request with evidence.

• Make retention and deletion work. Turn approved retention rules into a system-by-system map with technical owners, and coordinate fixes with Engineering and Data Platform.

• Keep our commitments accurate. Keep privacy notices, our subprocessor list, and other public commitments to customers and regulators aligned with how Clay actually processes data. Support incident response with Legal and Security.

• Automate, train, and measure. Automate routine work with Clay and AI tools, build short role-specific training, and report program metrics to Legal and EPD leadership.

How You'll Work with Others

• Your team, Legal, sets privacy and AI standards and makes the legal calls. You put them into practice and flag early when something needs one.

• Product, Engineering, and business teams own what we build and why, including model choices, evaluations, and agent safety. You make review fast and predictable, gather the evidence, and follow through.

• Our GRC team owns security certifications such as SOC 2, the vendor and product review process, Clay’s data inventory, and security questionnaire. You own the privacy side of each and keep handoffs clean.

What You'll Bring

• 6 to 8+ years building and running privacy programs or privacy operations at a technology company, ideally high-growth B2B SaaS, data, or AI

• Hands-on experience with privacy requests, data mapping, PIAs and DPIAs, vendor diligence, and consent management

• Working knowledge of GDPR, UK GDPR, CCPA/CPRA, and other US state privacy laws, and good judgment about when to bring in Legal

• AI fluency: you understand how LLM features and agents use data, and you can put frameworks like the EU AI Act into practice

• Technical fluency: you can follow data across systems and APIs and ask engineers precise questions

• A track record of building a program from scratch and making it stick with teams that didn't report to you

• Clear, plain writing, and a habit of using AI and automation to remove routine work

• CIPM or equivalent certification

• A law degree is not required

Nice to Haves

• CIPP/E, CIPP/US, CIPT, or AIGP

• Hands-on AI governance experience, such as AI inventories, AI impact assessments, ISO/IEC 42001, or the NIST AI RMF

• Experience at a B2B data or enrichment company, or with data partnerships and licensing

• Experience with Transcend, OneTrust, DataGrail, or similar

• Experience with Clay or building GTM workflows