Data Compliance Program Manager

Working across Legal, Information Security, Information Technology (IT), and Data teams, this teammate will translate evolving privacy and data protection regulations into practical policies, product requirements, and operational controls to drive the initiatives that keep Buckle's data practices compliant, auditable, defensible, and worthy of guest trust.

The teammate in this role owns the privacy compliance roadmap and embeds privacy by design into products, processes, and the software development lifecycle. The teammate in this role will oversee scalable privacy capabilities such as data mapping and inventory, consent and preference management, data subject request (DSR) fulfillment, and data privacy risk assessments, while serving as a key coordinator for audits, regulatory inquiries, and data incident response.

This description intends to describe the general nature and level of work performed by Teammates assigned to this job. It is not intended to include all duties, responsibilities, and qualifications. To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Own the enterprise data compliance program strategy and multi-year roadmap, aligning priorities with regulatory requirements, business initiatives, and the Company's risk appetite.
• Prepare program status, metrics, and risk reporting for executive leadership, and support periodic updates to other stakeholders as necessary and appropriate.

• Establish program charters, RACI models, KPIs, and maturity assessments; manage the program backlog, timelines, budgets, and resource plans across work streams.
• Monitor and implement practices to comply with U.S. federal and state privacy and data protection laws, including the CCPA/CPRA, the Nebraska Data Privacy Act, and other comprehensive state privacy laws, as well as COPPA, CAN-SPAM, the TCPA, state data breach notification laws, and FTC guidance on unfair or deceptive data practices.
• Draft and maintain internal privacy and data handling policies, standards, and procedures, and partner with counsel to keep external privacy notices accurate and current.
• Coordinate internal and external audits and assessments, manage evidence collection and remediation tracking, and coordinate responses to regulatory inquiries and consumer complaints related to data practices.
• Conduct regulatory gap assessments and translate findings into remediation plans with clear owners, deadlines, and evidence of completion.
• Design and maintain documented, testable data compliance controls that integrate with the Company's enterprise risk management framework and, where applicable, Sarbanes-Oxley (SOX) IT general controls.
• Lead privacy impact and data protection assessments for new products, marketing programs, vendors, and technologies, including AI, analytics, and personalization use cases.
• Partner with business owners and Information Security and Legal Teams to assess vendor data practices, support data processing agreement negotiations, and monitor ongoing third-party compliance.
• Partner with Company leaders to monitor and operationalize artificial intelligence use and governance tools.

• Oversee data mapping, data inventory, records of processing activities, and data retention and deletion schedules across systems and business units.
• Embed privacy by design into the software development lifecycle by translating legal requirements into product requirements, user stories, and acceptance criteria, and partner with IT and Data Teams on privacy tooling and automation.
• Coordinate with Information Security and Finance Teams on compliance obligations for payment card data (PCI DSS) and customer loyalty and rewards program data.
• Serve as program coordinator for data incident response; maintain response playbooks, facilitate tabletop exercises, and support counsel in breach notification analysis and post-incident reviews.
• Develop and deliver role-based privacy and data protection training for Teammates and build a network of privacy champions across business units.

• Fulfill mission statement by performing job duties with a high level of customer service while contributing to a positive team spirit.
• Special projects and other duties as assigned.

This job has no supervisory…