Privacy Program Manager

Privacy Program Manager @ Clay

Personal data is at the center of how Clay works. It comes from our data provider marketplace, our own proprietary B2B dataset, the web research our agents run, and the records our customers bring to Clay. Every person in that data, and every customer who relies on it, needs to trust how Clay handles it. As we build agents that research and act for our customers, that trust also depends on how we build and use AI.

We're looking for a Privacy Program Manager to help build and run Clay's privacy program, including the operational side of AI governance. You'll report to our Head of Product, Privacy & AI Legal and work closely with Product, Engineering, Data Platform, Data Partnerships, Security, Marketing, and Sales. Our Legal team sets the standards and makes the legal calls. As part of that team, you'll turn them into processes, records, and tooling that work at Clay's pace.

This role is for someone who wants to build and own a privacy program that differentiates Clay. You'll connect the privacy work already happening across Clay into one program with clear owners, reliable operations, and evidence we can stand behind. You'll also automate as much as possible, so Product and Engineering can spend more time building.

What You'll Do

• Own the program plan. Turn Legal's privacy strategy into a prioritized plan with owners, dependencies, and six- and twelve-month outcomes. Flag early when work lacks an owner or capacity.
• Own our records of processing: Maintain Clay’s records of processing for the product and our own operations, and set the privacy requirements for the data inventory our GRC team maintains: sources, uses, recipients, storage, retention, and restrictions.
• Run privacy and AI assessments. Run PIAs, DPIAs, transfer and legitimate interests assessments, and AI assessments from fact gathering through follow-up. Legal makes the legal determinations.
• Build privacy into how Clay ships. Help run privacy and AI review inside EPD’s product development process, so teams get fast, consistent answers and the right questions reach Legal early.
• Run the operational side of AI governance. Keep records of how Clay's products and internal tools use AI. Gather evidence on how agent features are controlled, and keep review conditions and customer guidance current as models and permissions change.
• Run provider and vendor privacy diligence. Review data providers, marketplace partners, and vendors at onboarding, change, renewal, and exit. Maintain our subprocessor list and customer notices.
• Operate privacy rights requests. Own access, deletion, correction, and opt-out requests end to end, including California Delete Act (DROP) requests, across the systems that hold a person's data, using our privacy platform (Transcend). Close every request with evidence.
• Make retention and deletion work. Turn approved retention rules into a system-by-system map with technical owners, and coordinate fixes with Engineering and Data Platform.
• Keep our commitments accurate. Keep privacy notices, our subprocessor list, and other public commitments to customers and regulators aligned with how Clay actually processes data. Support incident response with Legal and Security.
• Automate, train, and measure. Automate routine work with Clay and AI tools, build short role-specific training, and report program metrics to Legal and EPD leadership.

How You'll Work with Others

• Your team, Legal, sets privacy and AI standards and makes the legal calls. You put them into practice and flag early when something needs one.
• Product, Engineering, and business teams own what we build and why, including model choices, evaluations, and agent safety. You make review fast and predictable, gather the evidence, and follow through.
• Our GRC team owns security certifications such as SOC 2, the vendor and product review process, Clay’s data inventory, and security questionnaire. You own the privacy side of each and keep handoffs clean.

What You'll Bring

• 6 to 8+ years building and running privacy programs or privacy operations at a technology company, ideally high-growth B2B SaaS, data, or AI
• Hands-on experience with privacy requests, data mapping, PIAs and DPIAs, vendor diligence, and consent management
• Working knowledge of GDPR, UK GDPR, CCPA/CPRA, and other US state privacy laws, and good judgment about when to bring in Legal
• AI fluency: you understand how LLM features and agents use data, and you can put frameworks like the EU AI Act into practice
• Technical fluency: you can follow data across systems and APIs and ask engineers precise questions
• A track record of building a program from scratch and making it stick with teams that didn't report to you
• Clear, plain writing, and a habit of using AI and automation to remove routine work
• CIPM or equivalent certification
• A law degree is not required

Nice to Haves

• CIPP/E, CIPP/US, CIPT, or AIGP
• Hands-on AI governance experience, such as AI inventories, AI impact assessments, ISO/IEC 42001, or the NIST AI RMF
• Experience at a B2B data or enrichment company, or with data partnerships and licensing
• Experience with Transcend, OneTrust, DataGrail, or similar
• Experience with Clay or building GTM workflows