Sr. Privacy Compliance Specialist

Edible Brands; Atlanta (GA); On-site; USD 95,000 - 145,000; Full time

Job summary

Edible Brands is hiring a Sr. Privacy Compliance Specialist to oversee privacy operations, DSAR management, and regulatory compliance across our portfolio of brands.

This onsite role collaborates with Legal, Engineering, Marketing Operations, and Data Analytics to ensure enterprise-wide privacy governance. The position reports to Legal/Compliance leadership and supports GDPR/CCPA compliance, consent management, and privacy notices as we scale.

Qualifications

• Bachelor's degree required; privacy/compliance background preferred.
• 3–5 years in privacy/compliance roles with hands-on configuration of consent/privacy platforms.
• Experience with Shopify/e-commerce privacy compliance.
• Knowledge of GDPR, CCPA and state privacy laws; DSAR/deletion handling.

Responsibilities

• Serve as primary privacy platform owner and manage vendor interactions.
• Define and improve privacy operations including DSAR intake and deletion workflows.
• Manage DSAR and data deletion across systems with deadlines.
• Coordinate governance meetings and cross-functional privacy projects.
• Support privacy notices and data processing agreements.
• Stay current on privacy laws and prepare compliance reports.

Skills

Privacy

Compliance

DSAR

Vendor management

Cross-functional collaboration

Project management

Documentation

Education

Bachelor's degree

CIPP certification

Tools

OneTrust

Shopify

Microsoft 365

Collibra

Traction

Alation

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Sr. Privacy Compliance Specialist

Atlanta, GA, US

2 days ago Requisition ID: 2009

Sr. Privacy Compliance Specialist

Edible Brands® was launched in 2022 to bring together powerful, purpose-led brands under one unified purpose: to enrich everyday life through celebration, nourishment, and wellness. Today, Edible Brands powers three bold and growing concepts across 700+ locations worldwide.

Our portfolio spans Edible Arrangements®, the iconic gifting brand; Rōti ®, a Mediterranean-inspired fast-casual restaurant; edibles.com™, a trusted marketplace for low-dosage THC & CBD wellness products; and BerryDirect ®, our robust supply chain infrastructure. Together, these brands are fueled by The Edible Way —a set of employee-driven values that keep us committed, collaborative, adaptable, results-driven, and always ready to celebrate.

The Big Picture:

Edible Brands® is committed to maintaining the highest standards of privacy compliance and regulatory adherence as we scale our operations across our portfolio of brands and geographies. The Privacy Compliance Specialist is a hands-on technical ownership role for our privacy and consent management platform (currently OneTrust ), and the operational backbone of our Data Subject Access Request (DSAR) and consent management programs. This role strategically bridges Legal, Information Security, Engineering, Marketing Operations, and Data Analytics to establish and maintain enterprise-wide privacy governance, data subject request management, and regulatory compliance.

As privacy regulations expand (GDPR, CCPA, state privacy laws, and emerging frameworks), this role ensures our organization has clear ownership of Data Subject Access Requests (DSARs), deletion workflows, consent management, and cross-system compliance. The ideal candidate is detail-oriented, technically hands-on, systems-minded, and comfortable navigating ambiguity while coordinating across technical, legal, and business teams. This role reports to Legal/Compliance leadership and is essential to our post-Shopify migration strategy.

Location: This position will work onsite out of our Corporate Office in Sandy Springs, GA Monday – Friday.

What this looks like day to day:

• Serve as the primary point of contact and relationship owner for the privacy platform vendor, managing support escalations, tracking contract terms and renewal timelines, and coordinating any implementation or professional services engagements.
• Define, document, and continuously improve privacy operations, including consent governance, Data Subject Access Request (DSAR) intake, identity verification, deletion workflows, cross-functional execution procedures, and audit-ready documentation.
• Manage end-to-end DSAR and data deletion processes across all business systems, meeting statutory response deadlines and other applicable laws, ensuring timely completion, regulatory compliance, and maintenance of audit trails and proof of deletion.
• Monitor DSAR response timelines, coordinate execution with internal teams and third-party vendors, verify request completion across systems, and escalate risks or delays as needed.
• Serve as the primary privacy operations partner to Legal, Engineering, Marketing, Information Security, Data Analytics, and external vendors by coordinating governance meetings, compliance initiatives, vendor privacy reviews, and cross-functional projects.
• Partner with Legal to support privacy notices, data processing agreements, regulatory interpretation, and broader privacy governance initiatives.
• Stay current on GDPR, CCPA, and emerging U.S. state privacy laws; prepare compliance reports and audit documentation while identifying, mitigating, and escalating privacy risks and compliance gaps.
• Support the development of privacy policies, data governance standards, and best practices for data collection, processing, retention, and deletion across the organization.
• Maintain and continuously update the organization’s data inventory / Records of Processing Activities ( RoPA ) across business systems.

What you bring:

• Bachelor's degree required; background in privacy, compliance, legal operations, or data governance preferred.
• Minimum 3–5 years of experience in privacy, compliance, legal operations, or data governance roles, including direct hands-on configuration (not just use) of consent management or privacy platforms ( OneTrust , TrustArc , Termly, or similar)
• Hands-on experience with Shopify, e-commerce platforms, or retail-specific privacy compliance.
• Demonstrated knowledge of GDPR, CCPA, and state privacy laws; experience managing Data Subject Access Requests (DSARs) or data deletion requests against statutory deadlines.
• Experience partnering directly with vendors including support escalation, contract renewals and negotiations, and evaluation of vendor performance.
• Familiarity with engineering/development workflows and the ability to work with technical teams.
• Proficiency with Microsoft 365, data inventory/mapping tools, and analytics platforms.
• Preferred:
• CIPP (Certified Information Privacy Professional) certification or willingness to pursue.
• Experience with data inventory or data governance platforms (Collibra, Traction, Alation).
• Background in a multi-brand, regulated, or scaled legal/compliance function.

How you work:

• Strong project management and organizational skills, with the ability to manage multiple priorities and coordinate across teams.
• Excellent written and verbal communication skills, with the ability to translate technical and legal concepts for diverse audiences.
• Strong attention to detail, discretion, and the ability to handle confidential information.
• Comfortable being the in-house technical owner of a critical compliance system, proactively flagging risk rather than being asked.

We are proud to be an EEO/AA employer. Applicants for employment are considered without regard to race, creed, color, religion, sex, sexual orientation, marital status, national origin, age, disability, or veteran status.