All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - April 2, 2026 - 202604.1.0

General Availability

New Get List of Relationship Records by Entity API

Added the Get List of Relationship Records by Entity API to retrieve all related entities for an AI Governance inventory record and describe the relationship type for each related entity. This API is only supported for AI Systems, Datasets, and Models.

New Parameters for Attribute Management APIs

The following changes have been made to the Attribute Management APIs:

Existing Public Preview Features

AI Governance Inventory Global/Local Functionality

|Available with Solution Packaging Only

Establish standardized global records for AI systems, models, and datasets while maintaining contextual, local records across business units, use cases, and lifecycle stages. This capability lets teams track AI asset evolution through a clear audit trail, enforce standardized attributes at the global level, and manage jurisdiction-specific or use case-specific requirements at the local level.

For more information, see AI Governance Global/Local Feature Guide. This feature is related to the following ideas: AI-I-31, PDGI-I-1416

Amazon Bedrock AI Model & Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Amazon Bedrock accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Databricks Unity Catalog AI Models, Agents, and Datasets Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models, agents, and datasets in your Databricks accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

GCP Vertex AI Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Google Cloud accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

SageMaker AI Model Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models in your SageMaker accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Azure Foundry Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Azure Foundry accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Permissions

Things to Know

OneTrust is planning to upgrade all environments to the new AI Governance Services, which provide improved permission granularity, expanded inventory support, foundations for agent governance, and a more unified management experience through the Inventory Manager. For more information and rollout schedules, seeAI Governance Services Upgrade Notice.

OneTrust is planning to unify the export output of AI Governance inventories to standardize values forSystem usersattributes. This change will replace the user's display name (e.g. John Smith) in favor of their email address (e.g. john.smith@onetrust.com) across all inventory types. Currently the platform has mixed behavior across the available inventory times, leading to import failures where the schema expects email address for these user fields.

Tenants will be automatically updated with this enhancement in the OneTrust 202604.2.0 release.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to AI Governance and has been retroactively added to the release notes. Restrictions apply for some AI Governance inventory.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Consent & Preferences

Cookie Consent - April 2, 2026 - 202604.1.0

General Availability

Deploy the CMP at Scale via Public API

Added the following APIs to enable end‑to‑end provisioning, scanning, branding, publishing, and governance of applications and domains. These new APIs allow you to further automate consent configuration, enforce regional rules, manage branding at scale, and operationalize scans and publishing workflows through API‑driven integrations.

Clearer Opt-Out Signal Notification for CPRA

Provide an improved notification on the Persistent cookie settings hover button to confirm end users' Global Privacy Control (GPC) signal was detected when using California Consumer Privacy Act (as amended by CPRA) templates. This enhancement allows your end users to more easily view GPC notifications and confirm the signal was honored without opening the preference center.

For more information, see Leveraging the Global Privacy Control Signal.

Fixed

  • Resolved an issue that prevented the Global Privacy Control (GPC) opt-out confirmation notification logo from displaying with correct alignment on the banner.

  • Resolved an issue that prevented consent status labels from displaying on the preference center when the Show consent status labels setting was enabled on a preference center template with Tab layout.

  • Resolved an issue that displayed inconsistent lists of domains in exports generated from the Websites screen.

  • Resolved an issue that prevented banners configured in Chinese - Taiwan, Republic of China (ZH-TW) from displaying Traditional Chinese text.

  • Resolved an issue that produced JavaScript errors when publishing locally hosted scripts with the Use distinct script src URL setting enabled.

  • Resolved an issue that prevented some banner text from translating accurately on IAB TCF 2.2 templates configured in Hebrew (modern) [HE].

  • Resolved an issue that prevented the the ACv2 string from refreshing consistently and required additional page refreshes or listeners. Handling for the Google Additional Consent (ACv2) string has been improved to align with Google’s updated consent model.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

  • Delaware

  • Iowa

  • Nebraska

  • New Hampshire

  • New Jersey

  • Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

  • Identify known vendor services when scanning your websites.

  • Categorize the vendor services active on your websites.

  • Link tracking technologies to identified vendor services.

  • Allow end users to configure consent for vendor services on the Preference Center.

  • Capture records of consent at the vendor service level.

  • Configure IAB templates to capture and disclose vendor service information.

  • View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

  • The “Cookie List Filters” text remains fully visible when browsers are configured to display text with increased line height, letter spacing, or word spacing (WCAG-AA 1.4.12: Text Spacing).

Things to Know

TheActivitytab on theCookie detailsscreen now captures cookie deletion information, including timestamp and user details, when cookies are deleted individually or in bulk.

Configure theAllow compliance assistant to operatesetting inGlobal settingsto enable or disableCompliance assistant.

For more information, see Leveraging CMP Compliance Assistant.

TheIncludeoption withinTarget specific sectionsof theAdd websitescreen has been renamed toInclude onlyfor improved specificity.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Mobile & OTT/CTV App Consent - April 2, 2026 - 202604.1.0

Fixed Android

  • Resolved an issue that enabled all general vendors associated with a category if end users enabled the category on the preference center.

  • Resolved an issue that caused apps to quit unexpectedly.

  • Resolved an issue that caused consent statuses to return incorrect values after the consent status was updated.

  • Resolved an issue that prevented consent configurations provided offline from being preserved correctly, which reset the user's consent preferences and caused the banner to reappear when connectivity was restored.

Fixed iOS

  • Resolved an issue that prevented consent from being properly updated if preference center data was not yet downloaded.

  • Resolved an issue that caused consent statuses to return incorrect values after the consent status was updated.

Fixed APIs

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

  • iOS

  • Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

  • iOS

  • Android

  • Apple TV

  • Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

  • Android

  • Android TV

  • Apple TV

  • HTML5

  • iOS

  • Roku

  • Unity

  • Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

The Android SDK has been improved to more reliably load using cached or offline data, as needed. This enhancement enables the SDK to successfully load under slow or unavailable network conditions and ensures consent can be consistently captured.

The iOS SDK now preserves the full server response, including previously unused keys, when reading CMP API responses for the banner, preference center, and vendor list.

The Cordova/Ionic SDK framework now supports theOTConsentUpdatedevent, allowing apps to reliably detect when a user has completed consent. This enhancement provides parity with native SDKs and enables clients to safely trigger consent‑dependent actions, such as updating webviews, at the right time.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Universal Consent & Preference Management - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that caused profiles to display older notice versions after the purpose was reassigned to a new notice and the consent transaction succeeded.

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Permissions

Things to Know

Leverage a new saved view forAlertson theCollection pointlist screen to display collection points with outstanding warning or error alerts. This enhancement streamlines monitoring and actioning at-risk collection points by avoiding manual filter configuration.

TheOrganizationfield is now required when configuring purposes and purpose preferences. This field defaults to the current user’s organization when creating purposes, improving data consistency and reducing setup effort.

Note:

Purposes without Organizations defined will receive retroactive updates beginning in OneTrust 202604.2.0. Purposes without an organization will be automatically assigned to the root organization unless you opt for a one-time adjustment to the organization.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Data Use Governance

Data Catalog - April 2, 2026 - 202604.1.0

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16. For more information, see the following:

Data Governance Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Governance Insights Dashboard to analyze data captured across Data Catalog. This dashboard can be used to view essential information about your data assets, manage your data and associated metadata in response, and enact policies and procedures necessary for proper data governance.

For more information, see Insights Data Governance Dashboard.

Access Intelligence Insights Dashboard

Now enabled for every Data Catalog customer, data governance managers can now utilize highly customizable reporting and analytic capabilities using the Access Intelligence Insights Dashboard that collects data captured by Data Catalog and Data Discovery. This dashboard can be used to understand what sensitive data you have and how it is shared across the company so admins can quickly identify data-related risks present in your data ecosystem.

For more information, see Insights Access Intelligence Dashboard.

Note:

This dashboard is available by default only for Data Catalog customers.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Data Discovery - April 2, 2026 - 202604.1.0

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Data Discovery Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Discovery Insights Dashboard to analyze data captured across the module. This dashboard can be used to view information about job insights, scan metrics, worker node progress, and more related to your discovery business outcomes.

For more information, see Insights Data Discovery Dashboard.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Platform Capabilities

Dashboards & Reporting - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that prevented users from exporting content via the View builder tab of the PDF builder.

  • Resolved an issue that prevented Assessment Data tables on Insights Dashboards from displaying Measures for Medium Risks.

Existing Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

  • AI Governance inventories:

    • AI systems

    • Datasets

    • Models

    • Projects

  • Assessments

  • Contracts

  • Controls / Control implementations

  • Engagements

  • Inventories:

    • Assets

    • Entities

    • Processing activities

    • Vendors

  • Privacy requests and subtasks

  • Risks

For more information, see Using Conversational Analytics Insights Chatbot.

Insights Dashboards

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following seeded dashboards are available under Public Preview:

Expanded Custom Attributes for Privacy & GRC Insights Dashboards

Track additional metrics by adding up to 10 custom attributes to each tab on custom Insights Dashboards created using the Privacy and Governance, Risk, Compliance data sources. This enhancement provides more flexibility in customizing your Insights Dashboards, allowing you to visualize unique data points relevant to your organization’s business context.

For more information, see Using Object-Based Attribute Tables for Custom Insights Dashboards.

Things to Know

Insights as Default for Net New Customer Accounts

Starting in the OneTrust 202410.1.0 release, Insights Dashboards will be the default dashboard experience for all new OneTrust accounts. Users within new OneTrust accounts created after the respective environment is upgraded to 202410.1.0 will now see Insights Seeded Dashboards when available for a given module. Legacy dashboards will only appear for modules that do not currently have an Insights Seeded Dashboard. Existing accounts that already have access to Legacy Dashboards will not be affected by this change.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Settings & Administration - April 2, 2026 - 202604.1.0

General Availability

Flag New Permissions Improvements - Roles Column

View the number of roles updated for each recently added permission directly on the Recently added permissions tab of the Roles screen. The new Updated roles column has been added to show the role count for each permission and can be sorted to quickly assess impact, while the corresponding Details pane for each permission now displays the role count on the Updated roles tab and the linked permissions count on the Linked permissions tab. With this enhancement, administrators can more easily understand how permissions are used across roles, evaluate the impact of recent permission changes, and maintain accurate, least‑privilege access with greater confidence.

For more information, see Managing Recently Added Permissions.

Fixed

  • Resolved an issue that caused users to be assigned duplicate system roles when updating a user’s role and organization assignments via bulk import.

  • Resolved an issue that incorrectly displayed the Export icon on the Users screen for manager roles that did not have the necessary permissions to export the list of users.

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

  • Task Add Attachment

  • Task Add Comment

  • Task Created

  • Task Deleted

  • Task Remove Attachment

  • Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Privacy Automation

Data Mapping Automation - April 2, 2026 - 202604.1.0

General Availability

Table Enhancements for Data Mapping Automation

Tables and table functionalities within Data Mapping Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

  • Contracts tab of the Inventory details screen

  • Personal data tab of the Inventory details screen

  • Related tab of the Inventory details screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

  • Resolved an issue that caused data to display non-alphabetically when exporting an Article 30 report to Excel.

  • Resolved an issue that prevented Controller relationships from displaying in some Article 30 reports.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Inventory Similarity Scan

|Available with Solution Packaging Only

Detect similar records in your data map for new records that have been added through various sources. Different than our duplicate asset functionality, the scan displays information about similar records within the new records to ensure users can easily find a record that is similar to the new entry.

For more information, see Inventory Similarity Scan.

Table Enhancements for Data Mapping Automation

Tables and table functionalities within Data Mapping Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

  • Data lineage screen

  • Assessments tab of the Inventory details screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

  • For users with access to Data Mapping Automation, the Processing activities, Assets, Vendors, and Entities items on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.

Things to Know

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to Data Mapping Automation and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Incident Management - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that prevented the workflow stage on the Incident details screen from advancing after an assessment was submitted and the user was redirected back to the incident.

  • Resolved an issue that prevented collaborators from receiving email notifications when added to incident tasks.

  • Resolved an issue that allowed users to export incidents they were not assigned to or did not have visibility into.

  • Resolved an issue that allowed users with custom roles to view incident-related data in reports without having Incident Management permissions.

Things to Know

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to Incident Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Assessment Automation - April 2, 2026 - 202604.1.0

General Availability

Table Enhancements for Assessment Automation

Tables and table functionalities within Assessment Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

  • Archived assessments screen

  • Assessments screen

  • Assessments results screen

  • Benchmarking assessments list screen accessed via Program Benchmarking

  • Manage multi-select aggregation method modal accessed via the Score profiles tab of the Template details screen

  • Manage related assessments modal

  • Question library screen accessed via Third-Party Risk Management

  • Recycle bin screen

  • Select questions modal accessed via the Score profiles tab of the Template details screen

  • Submit sections modal when submitting open assessments

  • Translations tab of the Template details screen

Note:

Select tables across Assessment Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

  • Resolved an issue that prevented users from typing to search in the Response box when adding a condition to a rule.

  • Resolved an issue that prevented some users from submitting assessments.

  • Resolved an issue that prevented the Assessment screen from populating after a user submitted an assessment accessed via an email notification link.

  • Resolved an issue that prevented the I have reviewed all AI auto-responses checkbox from displaying, causing assessment submission to fail.

Existing Public Preview Features

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Template Updates

OneVendor Full v6.3

The Indian Digital Personal Data Protection Act, 2023 (DPDPA), and the Digital Personal Data Protection Rules, 2025 (the Rules), establish a comprehensive framework for the processing of personal data in India, setting clear requirements for transparency, lawful basis, and accountability. The law grants individuals robust rights over their personal data while imposing specific obligations on organizations to ensure responsible handling throughout the data lifecycle.

We’ve added coverage for the DPDPA and related rules to OneVendor by offering dedicated questions and rules.

  • The Welcome Text was updated to account for the India DPDPA rules.

  • Updated question 2.3 answer options.

  • Created new rules:

    • Question 3.10 - Data Transfers [IN]

    • Question 3.37 - Consent Manager [IN-DPDPA]

    • Vendor Contract [IN]

    • Security Safeguard [IN]

    • Data Transfer [IN]

    • Accountability / Privacy Principles [IN]

    • Consent Manager [IN]

OnePIA Full v7.4

The Indian Digital Personal Data Protection Act, 2023 (DPDPA), and the Digital Personal Data Protection Rules, 2025 (the Rules), establish a comprehensive framework for the processing of personal data in India, setting clear requirements for transparency, lawful basis, and accountability. The law grants individuals robust rights over their personal data while imposing specific obligations on organizations to ensure responsible handling throughout the data lifecycle.

We’ve added coverage for the DPDPA and related rules to OnePIA by offering dedicated questions and rules.

  • The Welcome Text was updated to account for the India DPDPA and related rules.

  • New conditional logic was configured throughout the template to account for India DPDPA and related rules.

  • Rectified incorrect conditional logics in questions: 6.4, 6.5, 8.4, 8.5, and 8.6.

  • Updated questions:

    • 3.1 on applicable laws

    • 4.6 and related description texts

    • 6.15 and related description texts

  • Created new questions:

    • 5.20 - Data Transfers [IN]

    • 7.27 - Significant Data Fiduciary [IN]

    • 9.17 - Reasonable Security Safeguards Implementation [IN]

    • 9.18 - Risk Management Measures [IN]

  • Created new rules:

    • Significant Data Fiduciary Designation [IN]

    • Lack of Minimum Reasonable Security Safeguards [IN]

    • DPIA Obligation [IN]

    • Data Transfer [IN]

  • Updated the Consent rule.

OnePIA Lite v7.4

The Indian Digital Personal Data Protection Act, 2023 (DPDPA), and the Digital Personal Data Protection Rules, 2025 (the Rules), establish a comprehensive framework for the processing of personal data in India, setting clear requirements for transparency, lawful basis, and accountability. The law grants individuals robust rights over their personal data while imposing specific obligations on organizations to ensure responsible handling throughout the data lifecycle.

We’ve added coverage for the DPDPA and related rules to OnePIA by offering dedicated rules.

  • The Welcome Text was updated to account for the India DPDPA and related rules.

  • Updated question 1.2 on applicable laws.

  • Created new question 5.4 - Significant Data Fiduciary [IN]

  • Created new rules:

    • Notice & Rights [IN]

    • Significant Data Fiduciary Designation [IN]

    • Minimum Reasonable Security Safeguards [IN]

    • Data Transfer [IN]

OneVendor Lite v6.3

The Indian Digital Personal Data Protection Act, 2023 (DPDPA), and the Digital Personal Data Protection Rules, 2025 (the Rules), establish a comprehensive framework for the processing of personal data in India, setting clear requirements for transparency, lawful basis, and accountability. The law grants individuals robust rights over their personal data while imposing specific obligations on organizations to ensure responsible handling throughout the data lifecycle.

We’ve added coverage for the DPDPA and related rules to OnePIA by offering dedicated rules.

  • The Welcome Text was updated to account for the India DPDPA rules.

  • Updated question 2.4 answer options.

  • Created new question 2.19 - Privacy Principles.

  • Created new rules:

    • Vendor Contract [IN]

    • Data Transfer [IN]

    • Accountability / Privacy Principles [IN]

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Rights Automation - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that prevented files shared with a data subject from being correctly redacted.

  • Resolved an issue that prevented the request queue from loading in some sandbox environments.

New Public Preview Features

Subtask Library

Create a library of subtask templates that can be reused across multiple requests and workflows. This feature streamlines the way you can create, edit, and manage subtasks.

This feature is related to the following idea: OT-I-15383.

For more information, see Leveraging the Subtask Library.

Add Subtasks and Subtask Resolution Conditions with Stage Rules for Workflows

Add a subtask to your workflow rule and configure workflow rules with subtask resolution conditions. This enhancement streamlines your workflows by making subtasks easier to manage.

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Existing Public Preview Features

Stage Rules for Workflows

Configure rules on workflows to conditionally change workflows or their stages. This feature streamlines your workflows by automating changes based on your specific criteria. 

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Tech Risk and Compliance

Compliance Automation - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that caused completed evidence to continue to display assigned actions.

Existing Public Preview Features

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Standard / Control Framework Changes

NIST SP 800-53 Updated from Release 5.1.1 to Release 5.2

NIST has issued Release 5.2 of Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, updating the framework to strengthen the security and reliability of software updates and patches. According to NIST, this revision was made in response to Executive Order 14306 and focuses on software and system resiliency by design, developer testing, update deployment and management, and software integrity and validation.

We have updated our NIST SP 800-53 framework on the OneTrust platform from Release 5.1.1 to Release 5.2 to reflect these changes. The update includes newly added controls and control enhancements, revisions to certain existing control requirements, and updates to control guidance section that provide additional implementation examples.

For more information, see Supported Control Frameworks.

India Digital Personal Data Protection Act (DPDPA) 2025 Rules Updated

Framework content has been updated to align with the Digital Data Protection Rules, 2025, issued by India’s Ministry of Electronics and Information Technology (MeitY), which operationalize the Digital Personal Data Protection Act, 2023. The Rules introduce detailed, enforceable requirements across notice and consent, data principal rights, breach notification and consent manager obligations.

Customers can review and accept these updates through the Framework Updates functionality within the Standards & Frameworks library.

Important:

The updated India Digital Personal Data Protection Act (DPDPA) (2025) framework will be available on the OneTrust platform on April 6, 2026.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Enterprise Policy Management - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that prevented users from saving updates to draft documents.

  • Resolved an issue that prevented pasted images from displaying correctly in the Document builder when replacing an existing image.

Existing Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

  • Controls

  • Risks

  • Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

Campaigns now reuse existing attestations instead of creating new attestations when users are assigned.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Issues Management - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that prevented users from adding the workflow and workflow stage to an attribute group on the Issue type details screen.

Existing Public Preview Features

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Permissions

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

IT & Security Risk Management - April 2, 2026 - 202604.1.0

Fixed

  • Resolved an issue that prevented users from deactivating score and formula-type attributes in the Attribute manager.

  • Resolved an issue that prevented users from adding related objects to risks on the Related tab of the Risk details screen.

  • Resolved an issue that prevented option values for Risk level attributes from appearing when exporting PDF and column reports.

  • Resolved an issue that caused risk comment fields to display HTML tags instead of rendered text when exporting PDF and column reports.

  • Resolved an issue that prevented rich text in control implementation guidance from appearing when exporting PDF and column reports.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

Standard / Control Framework Changes

NIST SP 800-53 Updated from Release 5.1.1 to Release 5.2

NIST has issued Release 5.2 of Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, updating the framework to strengthen the security and reliability of software updates and patches. According to NIST, this revision was made in response to Executive Order 14306 and focuses on software and system resiliency by design, developer testing, update deployment and management, and software integrity and validation.

We have updated our NIST SP 800-53 framework on the OneTrust platform from Release 5.1.1 to Release 5.2 to reflect these changes. The update includes newly added controls and control enhancements, revisions to certain existing control requirements, and updates to control guidance section that provide additional implementation examples.

For more information, see Supported Control Frameworks.

India Digital Personal Data Protection Act (DPDPA) 2025 Rules Updated

Framework content has been updated to align with the Digital Data Protection Rules, 2025, issued by India’s Ministry of Electronics and Information Technology (MeitY), which operationalize the Digital Personal Data Protection Act, 2023. The Rules introduce detailed, enforceable requirements across notice and consent, data principal rights, breach notification and consent manager obligations.

Customers can review and accept these updates through the Framework Updates functionality within the Standards & Frameworks library.

Important:

The updated India Digital Personal Data Protection Act (DPDPA) (2025) framework will be available on the OneTrust platform on April 6, 2026.

For more information, see Supported Control Frameworks.

Things to Know

TheView Risk Approverpermission no longer controls visibility of theRisk approvercolumn on theRisk registerscreen.

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to IT & Security Risk Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Third-Party Management

Third-Party Due Diligence - April 2, 2026 - 202604.1.0

Fixed

  • The monitoring usage count is now accurately reflected within the Usage breakdown for the current term widget on the Usage tracking dashboard.

Things to Know

The following mandatory fields are now validated when a vendor record is created via theCreate Inventory API:

  • Person Entity Attributes: Country, First Name, Last Name

  • Organization Entity Attributes: Country, Organization Name

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Third-Party Risk Management - April 2, 2026 - 202604.1.0

General Availability

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Question library screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Enhancements to Contracts and Engagements APIs

The following changes have been made to the Contracts and Engagements APIs:

Fixed

  • Resolved an issue that prevented questionnaire reports from sending via stage rules.

  • Resolved an issue that prevented vendor workflows from advancing to the next stage when triggered by the Assessment Auto-Approved trigger.

  • Resolved an issue that caused attribute values for Type of ICT Services in the DORA Report of Information export from consistently displaying expected rows for the combination of functions.

  • Resolved an issue that prevented saved views of the Contracts list screen from capturing the accurate filter results.

New Public Preview Features

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Existing Public Preview Features

Separated Files Export for DORA ROI Report

Generate the register of information (ROI) report as a compressed file containing separate .csv files for each tab of the report. This enhancement allows you to submit unique files to specific regulators instead of sending the single, multi-tabbed export.

For more information, see Step 3: Generate and Export the DORA Report.

Permissions

Standard / Control Framework Changes

NIST SP 800-53 Updated from Release 5.1.1 to Release 5.2

NIST has issued Release 5.2 of Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations, updating the framework to strengthen the security and reliability of software updates and patches. According to NIST, this revision was made in response to Executive Order 14306 and focuses on software and system resiliency by design, developer testing, update deployment and management, and software integrity and validation.

We have updated our NIST SP 800-53 framework on the OneTrust platform from Release 5.1.1 to Release 5.2 to reflect these changes. The update includes newly added controls and control enhancements, revisions to certain existing control requirements, and updates to control guidance section that provide additional implementation examples.

For more information, see Supported Control Frameworks.

India Digital Personal Data Protection Act (DPDPA) 2025 Rules Updated

Framework content has been updated to align with the Digital Data Protection Rules, 2025, issued by India’s Ministry of Electronics and Information Technology (MeitY), which operationalize the Digital Personal Data Protection Act, 2023. The Rules introduce detailed, enforceable requirements across notice and consent, data principal rights, breach notification and consent manager obligations.

Customers can review and accept these updates through the Framework Updates functionality within the Standards & Frameworks library.

Important:

The updated India Digital Personal Data Protection Act (DPDPA) (2025) framework will be available on the OneTrust platform on April 6, 2026.

For more information, see Supported Control Frameworks.

Things to Know

AI Auto-Responses for Assessments

Automatically fill out assessments based on past assessments or scanned documents with the AI auto-responses for assessments feature set, which includes AI Doc Scanner and AI Inventory Analysis.

This change was introduced in the Winter release and communicated for Assessment Automation in the release notes, but it also applies to Third-Party Risk Management and has been retroactively added to the release notes.

For more information, see Leveraging AI Auto-Responses for Assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.