Data Compliance Program Manager

Summary

Working across Legal, Information Security, Information Technology (IT), and Data teams, this teammate will translate evolving privacy and data protection regulations into practical policies, product requirements, and operational controls to drive the initiatives that keep Buckle’s data practices compliant, auditable, defensible, and worthy of guest trust.

The teammate in this role owns the privacy compliance roadmap and embeds privacy by design into products, processes, and the software development lifecycle. The teammate in this role will oversee scalable privacy capabilities such as data mapping and inventory, consent and preference management, data subject request (DSR) fulfillment, and data privacy risk assessments, while serving as a key coordinator for audits, regulatory inquiries, and data incident response.

Essential Duties and Responsibilities
This description intends to describe the general nature and level of work performed by Teammates assigned to this job. It is not intended to include all duties, responsibilities, and qualifications. To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Strategic Leadership

• Own the enterprise data compliance program strategy and multi-year roadmap, aligning priorities with regulatory requirements, business initiatives, and the Company’s risk appetite.
• Prepare program status, metrics, and risk reporting for executive leadership, and support periodic updates to other stakeholders as necessary and appropriate.

Governance and Compliance

• Establish program charters, RACI models, KPIs, and maturity assessments; manage the program backlog, timelines, budgets, and resource plans across workstreams.
• Monitor and implement practices to comply with U.S. federal and state privacy and data protection laws, including the CCPA/CPRA, the Nebraska Data Privacy Act, and other comprehensive state privacy laws, as well as COPPA, CAN-SPAM, the TCPA, state data breach notification laws, and FTC guidance on unfair or deceptive data practices.
• Draft and maintain internal privacy and data handling policies, standards, and procedures, and partner with counsel to keep external privacy notices accurate and current.
• Coordinate internal and external audits and assessments, manage evidence collection and remediation tracking, and coordinate responses to regulatory inquiries and consumer complaints related to data practices.

Risk Management

• Conduct regulatory gap assessments and translate findings into remediation plans with clear owners, deadlines, and evidence of completion.
• Design and maintain documented, testable data compliance controls that integrate with the Company’s enterprise risk management framework and, where applicable, Sarbanes-Oxley (SOX) IT general controls.
• Lead privacy impact and data protection assessments for new products, marketing programs, vendors, and technologies, including AI, analytics, and personalization use cases.
• Partner with business owners and Information Security and Legal Teams to assess vendor data practices, support data processing agreement negotiations, and monitor ongoing third-party compliance.
• Partner with Company leaders to monitor and operationalize artificial intelligence use and governance tools.

Privacy Operations

• Oversee data mapping, data inventory, records of processing activities, and data retention and deletion schedules across systems and business units.
• Manage DSR processes within statutory timelines and oversee consent and preference management, including cookies and tracking technologies, opt-out preference signals (e.g., Global Privacy Control), and marketing preferences.
• Embed privacy by design into the software development lifecycle by translating legal requirements into product requirements, user stories, and acceptance criteria, and partner with IT and Data Teams on privacy tooling and automation.
• Coordinate with Information Security and Finance Teams on compliance obligations for payment card data (PCI DSS) and customer loyalty and rewards program data.
• Serve as program coordinator for data incident response; maintain response playbooks, facilitate tabletop exercises, and support counsel in breach notification analysis and post-incident reviews.
• Develop and deliver role-based privacy and data protection training for Teammates and build a network of privacy champions across business units.

General

• Fulfill mission statement by performing job duties with a high level of customer service while contributing to a positive team spirit.
• Special projects and other duties as assigned.

Supervisory Responsibilities

This job has no supervisory responsibilities.

Education and/or Experience

• Bachelor’s degree in business, Information Management, Compliance, Public Policy, Information Security, or a related field, or equivalent experience.
• Seven or more years of experience in privacy, data protection, regulatory compliance, risk management, information security, or program management, including at least two years leading cross-functional compliance projects, programs, or initiatives.
• Strong written and verbal communication skills, including the ability to present complex risk topics clearly to executive audiences.
• Sound judgment and discretion in handling confidential, privileged, and sensitive information.

Preferred Qualifications

• Working knowledge of U.S. federal and state privacy laws and enforcement; familiarity with the GDPR and other international frameworks.
• Hands-on experience with privacy operations, such as data mapping, DSR fulfillment, consent management, and privacy or data protection assessments.
• Demonstrated ability to translate legal and regulatory requirements into practical, auditable operational controls and product requirements.
• IAPP certification (CIPP/US, CIPM, or CIPT); ISACA certification (CISA or CRISC); or a project management credential (PMP, Agile, or Scrum).
• Experience at a publicly traded company, including exposure to SEC disclosure processes, SOX controls, or internal audit.
• Experience in retail, e-commerce, or other consumer-facing businesses, including loyalty programs, digital marketing, and PCI DSS environments.
• Familiarity with the NIST Privacy Framework, NIST Cybersecurity Framework, and ISO/IEC 27001 and 27701.
• Experience implementing or administering privacy management platforms (e.g., OneTrust, TrustArc, Transcend, BigID, etc.).
• Exposure to AI governance practices and frameworks, such as the NIST AI Risk Management Framework.

Tools and Technologies

• Privacy management platforms (OneTrust, TrustArc, or similar)
• Project and work management tools (Jira, Confluence, Aha!)
• Cloud environments (AWS, Azure, GCP)
• Microsoft 365, including Excel, PowerPoint, and SharePoint

Key Competencies

• Program and project management
• Regulatory analysis and risk assessment
• Cross-functional collaboration and stakeholder management
• Roadmap planning and prioritization
• Analytical and process-improvement mindset
• Clear executive communication
• Integrity and discretion

Physical Demands

The physical demands described here are representative of those that must be met by a Teammate to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

While performing the duties of this Job, the Teammate is regularly required to sit; use hands to finger, handle, or feel and talk or hear. The Teammate is occasionally required to stand; walk; reach with hands and arms and stoop, kneel, crouch, or crawl. The Teammate must frequently lift and/or move up to 25 pounds. Specific vision abilities required by this job include close vision, distance vision, color vision, peripheral vision, depth perception and ability to adjust focus.

Ability to operate a motor vehicle and complete errands based on business needs.

Work Environment

While performing the duties of this job, the Teammate regularly works in an office setting. The noise level in the work environment is usually moderate.

Equal Employment Opportunity
Buckle is committed to hiring and developing the most qualified Teammates from the available workforce in the communities we serve.

Equal employment opportunity has been, and will continue to be, a fundamental principle at Buckle, where employment is based upon personal capabilities and qualifications without discrimination and retaliation because of veteran status, uniformed service member status, race, color, national origin or ancestry, creed, religion, sex, sexual orientation, gender identity or expression, age, pregnancy (including childbirth, lactation, and related medical conditions), national origin or ancestry, physical or mental disability, genetic information (including characteristics and testing), or any other protected characteristic as established by applicable local, state, or federal law. For state specific information, refer to the Teammate Center.