iHerb — Senior Counsel, Data Privacy & Emerging Technology

About iHerb

iHerb is a global e-commerce leader specializing in health and wellness products, serving millions of customers in over 185 countries. With a mission to offer the best overall value in the world for natural products, iHerb combines cutting-edge technology, data-driven logistics, and a customer-first philosophy to deliver a seamless online shopping experience. As a company that prioritizes innovation, integrity, and global reach, iHerb is committed to maintaining a robust and strategically aligned brand and intellectual property presence worldwide. To learn more about iHerb, visit https://corporate.iherb.com.

About the Role

iHerb is a leading global e-commerce retailer of herbal supplements, vitamins, and wellness products, selling directly to consumers across major international markets including the United States, Europe, the United Kingdom, China, Saudi Arabia, Japan, and Korea. We are seeking an experienced Senior Privacy Counsel to build, lead, and continuously mature our global privacy compliance program. Reporting directly to the Chief Legal Officer (CLO), this individual will serve as the company’s primary legal authority on data protection and privacy matters, translating a complex and evolving international regulatory landscape into practical, business-enabling policies and controls that support direct-to-consumer e-commerce operations worldwide. This role will also support the company’s AI governance and compliance efforts and assist with intellectual property matters as they intersect with the company’s data, technology, and other initiatives.

Key Responsibilities

Global Privacy Program Leadership

• Design, implement, and own the company’s global privacy compliance program, establishing governance, policies, standards, and controls that scale across all markets in which the company operates.
• Serve as the company’s senior-most privacy subject-matter expert, advising the CLO, executive leadership, and the Board on privacy risk, regulatory developments, and program maturity.
• Build and lead a privacy team (in-house counsel, privacy analysts, and/or outside counsel network) as the program scales.
• Own the privacy roadmap, reporting progress and risk posture to senior leadership on a regular cadence.

Multi-Jurisdictional Regulatory Compliance

• Ensure compliance with applicable privacy and data protection laws across the company’s major markets, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act, U.S. state privacy laws (e.g., CCPA/CPRA and comparable state statutes), China’s Personal Information Protection Law (PIPL) and related cybersecurity/data security regulations, Saudi Arabia’s Personal Data Protection Law (PDPL), Japan’s Act on the Protection of Personal Information (APPI), and Korea’s Personal Information Protection Act (PIPA).
• Monitor the global regulatory landscape for new and amended privacy laws, guidance, and enforcement trends, and proactively adapt company policies and practices in response.
• Manage relationships with data protection authorities and regulators as needed, including responding to inquiries, audits, and investigations.
• Oversee cross-border data transfer mechanisms (e.g., Standard Contractual Clauses, UK IDTA, binding corporate rules, and country-specific localization or transfer approval requirements).
• Review, draft, and negotiate privacy-related contractual provisions and Data Processing Agreements (DPAs) with vendors, customers, and business partners, ensuring terms reflect applicable legal requirements and the company’s risk tolerance.

E-Commerce & Direct-to-Consumer Privacy Operations

• Advise on privacy implications of direct-to-consumer e-commerce operations, including account creation, checkout and payment flows, marketing and personalization, loyalty and rewards programs, customer service, and mobile app data collection.
• Provide guidance on the collection and handling of health-adjacent and sensitive data arising from supplement and wellness purchases, ensuring appropriate safeguards given the sensitivity of such inferences.
• Oversee cookie consent, ad-tech, and marketing data practices, including compliance with ePrivacy, CAN-SPAM/marketing consent regimes, and analogous international requirements.
• Support data subject rights request handling (access, deletion, correction, portability, opt-out) at global scale, ensuring timely and compliant responses.

AI Governance & Compliance

• Assist in building and maintaining the company’s AI governance program, including policies, risk assessment frameworks, and approval processes for the responsible development, procurement, and deployment of AI and machine learning tools.
• Advise on the privacy and data protection implications of AI/ML systems, including training data sourcing, model outputs, automated decision-making, and profiling.
• Monitor emerging AI-specific laws and regulatory guidance (e.g., the EU AI Act and other jurisdictional AI regulations and guidance) and help translate requirements into practical internal standards and review processes.
• Partner with Engineering, Data Science, Product, and Information Security teams to conduct AI risk and impact assessments and to support the responsible use of AI in company products, customer-facing tools, and internal operations.
• Support contract review and vendor diligence for AI tools and platforms, including negotiating AI-related terms in vendor and data processing agreements.

Intellectual Property Support

• Assist in identifying, protecting, and managing the company’s intellectual property, including trademarks, copyrights, trade secrets, and, where applicable, patents, in coordination with outside IP counsel.
• Advise on IP considerations arising from product development, content creation, marketing campaigns, private-label branding, and packaging across the company’s global markets.
• Support review of IP-related provisions in commercial, vendor, licensing, and technology agreements, including ownership of AI-generated content and data used to train or fine-tune AI systems.
• Help manage IP risk arising from third-party claims, brand protection and enforcement matters, and online marketplace infringement issues, escalating to outside counsel as needed.

Risk Management, Governance & Incident Response

• Lead privacy risk assessments, Data Protection Impact Assessments (DPIAs), and privacy-by-design reviews for new products, features, markets, and vendor relationships.
• Own the global data breach and privacy incident response program, including coordination of legal analysis, regulatory notifications, and remediation across jurisdictions.
• Oversee third-party and vendor privacy risk management, including privacy and data processing terms in commercial contracts, and diligence on data processors and sub-processors.
• Partner closely with Information Security on the development, review, and maintenance of data security policies, standards, and controls, ensuring alignment between privacy requirements and technical and organizational security measures.
• Work with Information Security and IT on incident response protocols and tabletop exercises, providing legal guidance on breach assessment, regulatory notification obligations, and coordination during active security incidents.

Training, Culture & Cross-Functional Partnership

• Draft, review, and negotiate privacy-, AI-, and IP-related provisions in commercial agreements, data processing agreements, and vendor contracts.
• Develop and deliver company-wide privacy, AI governance, and IP awareness training programs tailored to relevant functions (engineering, marketing, customer service, HR, and international teams).
• Partner with Marketing, Product, Engineering, HR, and regional business teams to embed privacy, AI governance, and IP considerations into new initiatives, international expansion, and M&A activity.

Qualifications

Required

• J.D. and active bar membership in at least one U.S. jurisdiction (preferably California).
• 8+ years of relevant legal experience, including substantial in-house or law firm experience focused on privacy and data protection law.
• Demonstrated, hands-on experience advising on GDPR/UK GDPR, U.S. state privacy laws, and at least one Asia-Pacific or Middle East privacy regime (e.g., PIPL, APPI, PIPA, or PDPL).
• Some experience with intellectual property matters (e.g., trademarks, copyrights, trade secrets, licensing, or IP aspects of technology/commercial agreements), whether gained in-house or at a law firm.
• Experience building or scaling a global privacy compliance program within a multinational organization.
• Strong understanding of e-commerce, retail, or consumer products data practices, including marketing, ad-tech, and direct-to-consumer data flows.
• Excellent judgment translating complex legal requirements into clear, practical, business-friendly guidance.

Preferred

• Experience supporting privacy or IP diligence in M&A or international market-entry transactions.
• Privacy certification(s) such as CIPP/E, CIPP/US, CIPP/A, CIPM, or CIPT (IAPP).
• Prior experience advising on AI governance, AI risk assessment, or emerging AI regulation (e.g., the EU AI Act).
• Prior experience in the dietary supplement, health, wellness, beauty, or consumer health e-commerce sector.
• Experience managing outside counsel networks across multiple jurisdictions, including IP counsel.
• Familiarity with data localization and cybersecurity regulations in China and Saudi Arabia.

Compensation and Location

iHerb offers a base salary range of $245,000 to $275,000. The role is also eligible for an annual performance bonus and a long-term incentive award at hire, so the package rewards both near-term impact and long-term success. The location is flexible, with a preference for candidates based in California.

TO APPLY 

Interested, qualified professionals should submit a tailored cover letter and resume to the following search consultants: 

Steve John Partner John and Snyder, LLC steve@johnandsnyder.com (415) 505-6685

Jason Snyder Partner John and Snyder, LLC jason@johnandsnyder.com (415) 505-6687

All inquiries and/or application materials sent directly to the foundation will be redirected to John and Snyder, LLC for review, which may cause a significant delay in evaluation and response.

On behalf of iHerb, we thank you for your interest in the Senior Counsel, Data Privacy & Emerging Technology opportunity.