Privacy Associate

Handshake•San Francisco, CA

1d•$120,000 - $149,000

About The Position

Handshake is seeking a Privacy Associate to support the day-to-day execution of its global privacy program as part of the Legal team. The role reports to the Senior Director & Counsel, Compliance, and works closely with Security, Finance, Product, and Engineering to review products and vendors, respond to inquiries, maintain program records, and implement privacy requirements. It offers hands-on experience across privacy activities, including AI governance, with ownership of recurring workflows. The successful candidate will be organized and practical, follow through reliably, and recognize when an issue requires legal review.

Requirements

At least 2 years of experience supporting privacy, compliance, risk management, or related legal operations.
Experience conducting, reviewing, or supporting privacy assessments, vendor reviews, individual-rights requests, or compliance audits.
Working knowledge of GDPR, CCPA/CPRA, other US state privacy laws, and core privacy principles.
Familiarity with DPAs, DPIAs, RoPAs, LIAs, and TIAs.
Ability to read and summarize technical documentation, such as data flows and architecture diagrams, with help from Engineering.
Strong organizational skills and attention to detail, including managing competing requests and meeting deadlines.
Comfort with workflow tools such as Linear and Notion, and with spreadsheets for tracking.
Clear written and verbal communication skills, including the ability to explain privacy requirements to colleagues across the business.
Sound judgment in identifying issues that require further assessment or legal review.
Interest in how AI and automated decision-making intersect with privacy, and willingness to learn this fast-moving area.

Nice To Haves

Experience with privacy in a consumer-facing, student, or employment context.
Experience supporting a privacy program at a technology company or global organization.
Hands-on experience configuring or operating a privacy or consent management platform such as Ketch, OneTrust, or TrustArc.
Hands-on experience with AI governance, algorithmic impact assessments, or automated decision-making rules.
Experience with cookie and tracking technology compliance, including consent management and opt-out signals.
Experience with incident response or breach notification analysis.
Experience responding to customer questionnaires or supporting procurement and vendor diligence.
A privacy certification such as CIPP, CIPM, CIPT, or AIGP.

Responsibilities

Assess vendors’ data handling practices, review DPAs, coordinate findings with cross-functional partners, and escalate exceptions.
Maintain subprocessor records and disclosures, coordinate required notices, and track diligence requirements.
Support preparation and review of DPIAs, LIAs, and TIAs by gathering information, documenting findings, and tracking mitigation actions with guidance from the Privacy Program Manager.
Keep RoPAs, data inventories, and retention schedules current as products and systems change; coordinate retention and deletion with business owners.
Administer Ketch, maintaining consent experiences, purposes, and jurisdiction-specific rules, including Global Privacy Control and other universal opt-out signals.
Run consent testing and cookie and tag scans; work with Marketing and Engineering to categorize tracking technologies, resolve compliance issues, and deploy configuration changes.
Maintain the automated individual-rights request process, monitor workflows and deadlines, handle exceptions, spot-check fulfillment, and partner with Engineering on integration issues.
Track rights-request volume and turnaround times and recommend workflow improvements.
Prepare customer questionnaire and audit responses, coordinate evidence collection, support Sales and Customer Success with privacy questions, and maintain approved response materials.
Assist Security with breach triage, notification analysis, and post-incident documentation.
Draft and update privacy notices and the public privacy policy as products, practices, and laws change.
Track new and amended privacy and AI laws and summarize their implications for Handshake.
Support privacy reviews of new features and AI-enabled functionality by logging launch intake, gathering data-flow information, tracking follow-up items, and escalating questions to counsel and the Privacy Program Manager.
Help deliver privacy training and keep internal guidance current, particularly for teams that frequently handle student and customer data.
Monitor the privacy inbox and internal Slack channels, answer routine questions, and promptly escalate complex or sensitive matters.
Track assessments, requests, and follow-up actions; prepare metrics and status updates; and recommend improvements to recurring processes.