All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

AI Policy Manager & Seeded AI Policies

Automatically detect AI policy violations across platforms to provide AI governance teams with actionable steps to ensure governance and compliance throughout the lifecycle of an AI entity, including AI systems, agents, and models. This policy orchestration experience allows users to create custom policies for unique scenarios and support guardrail enforcement and detection.

To complement the AI Policy Manager, seeded AI policies are also available to help organizations get started quickly with AI governance and compliance monitoring. These out-of-the-box policies help identify common governance gaps and provide remediation guidance, while also serving as templates for customers to build and customize their own AI policies in OneTrust.

For more information, see AI Policies Feature Guide.

Guardrail Detection & Enforcement

Automatically detect policy violations related to guardrail coverage and enforce missing guardrails on AI agents and models across supported AI development platforms. This enhancement helps enforce guardrails more consistently across the following platforms:

Amazon Bedrock
Azure Foundry
Databricks

For more information, see AI Policy Enforcement Guide.

AI Guard SDK and Classification for Worker Node Deployments

Protect critical AI systems by introducing the AI Guard SDK by OneTrust for worker node deployments, a comprehensive classification and inspection layer that helps ensure AI interactions are safe, secure, and compliant during development and runtime. This enhancement helps identify PII risks early through advanced data classification, enabling teams to test AI agents and quantify PII risk before moving to production. Integrate easily using the SDK-based approach designed for Python runtime environments, ideal for build-phase validation rather than high-volume, externally facing AI use cases.

For more information, see OneTrust AI Guard SDK Guide.

AI Guard SDK and Classification for On-Premises Deployments

Protect critical AI systems with the AI Guard SDK for standalone on-premises deployments. This enhancement enables AI classification and inspection within your environment while maintaining local control of AI Guard.

For more information, see OneTrust AI Guard SDK Guide.

AI Policy Email Digest

Send daily and weekly email digests of policy activity, including policy-violation trends, severity breakdowns, and the most critical policy findings, to help policy owners and governance teams stay informed without manually monitoring each policy. Configure recipients and severity thresholds for each digest to help ensure the right stakeholders are informed about critical issues and can take action when needed.

For more information, see AI Policy Email Notifications.

AI Policy - Lifecycle Management

Manage AI policy lifecycles more effectively by duplicating policies to create organization-specific variants and suppressing violations for specific AI models and agents. This enhancement helps manage policies and handle exceptions more efficiently.

For more information, see the following:

addendum: The release stage for this release note was corrected from Public Preview to General Availability on August 14, 2026.

AI Governance Program Efficiency Insights

Improve visibility into AI governance reviews with Program Efficiency Insights, which shows how long reviews take, where records are getting stuck, and which approval groups are involved. Use these insights to identify bottlenecks, adjust routing or capacity, and keep reviews moving with more predictability.

For more information, see AI Governance Program Efficiency Insights.

Observability for Amazon Bedrock

Extend continuous AI monitoring for Amazon Bedrock to gain visibility into AI agent and model activity. This enhancement supports ongoing governance by capturing agent and model metadata, usage information, evaluation metrics, and more directly from Amazon Bedrock-powered AI systems as they operate in production.

Additionally, you can detect and measure PII leakage for Amazon Bedrock using the AI Log Analyzer by scanning AI logs stored in Amazon S3, identifying sensitive prompts and responses, and surfacing PII counts in OneTrust for the associated AI assets to reduce risk from non-deterministic AI behavior.

For more information, see the following:

Observability for Databricks

Extend AI Governance for Databricks models and agents with runtime observability, including evaluation metrics for agents and operational visibility. This enhancement improves understanding of agent behavior before production, monitoring of Databricks model and agent activity through usage and token metrics, and support of automated governance at scale.

For more information, see the following:

Observability for Google Vertex (now Gemini Enterprise Agent Platform)

Add runtime observability for Google Vertex (now Gemini Enterprise Agent Platform) to bring native evaluation metrics and operational visibility for agents into AI Governance. This enhancement helps teams monitor agent behavior through agent-level request and latency metrics, enabling automated governance at scale.

For more information, see the following:

Observability for Microsoft Foundry

Enable continuous monitoring for AI agents and models built on Microsoft Foundry by surfacing Evaluation Metrics for Agents and Models, shifting from AI systems. This enhancement helps shift from one-time assessments to ongoing evaluation using live telemetry from Foundry-based AI systems.

For more information, see the following:

Formula/Score Type Attributes Support in Workflows and Automation Rules

Use formula and score attributes in AI Governance workflows and automation rules. This enhancement helps you use configured scoring attributes to drive workflow and automation behavior across AI Governance objects.

For more information, see Risk Aggregation Scoring in AI Inventories.

User Type Condition Support in Automation Rules

Configure automation rules using User type attributes for user selection, in addition to system users. This enhancement helps governance teams automate reassessments and follow-up assessments more flexibly by routing each assessment to the appropriate record-level owner.

For more information, see Configuring Automation Rules for AI Governance.

Cloudflare Integration for AI Systems

Integrate with the seeded Cloudflare: App Discovery workflow to automatically discover, inventory, and govern AI systems in use by ingesting Cloudflare “AI activity” signals, including unsanctioned Shadow AI, into OneTrust AI Governance. This helps teams identify sanctioned and unsanctioned AI use earlier, maintain a more complete AI inventory, and reduce governance risk across the organization.

For more information, see Cloudflare Integration for AI Governance Systems.

AWS Bedrock AgentCore Detection Connector

Automatically scan AWS Bedrock AgentCore environments to discover agent runtimes and related governance, evaluation, and observability data, then map them into AI Governance as AI agents. This creates a searchable inventory of AgentCore systems in OneTrust, helping teams govern, approve, and monitor them over time.

For more information, see AI Automation Feature Guide.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

User Groups as Respondents in Launch Assessment Actions

Assign user groups as respondents in the Launch Assessment action for supported object workflows, and send assignment notifications to the selected group. This makes it easier to assign assessments to groups of users without adding each user individually.

Impacted object workflows:

AI agents
AI systems
Models

addendum: This release note was updated on August 14, 2026 to remove Project workflow support for User Groups as Respondents in Launch Assessment actions.

addendum: The release note pertaining to Preserve/Delete Hidden Data to AI Governance Objects was removed on August 14, 2026.

Fixed

Resolved an issue that caused renaming a URL-type document in a project’s Documents tab to update a different document.
Resolved an issue that prevented users from adjusting column widths in the AI systems screen.
Resolved an issue that prevented users with Data Mapping access from creating or editing Project summary reports when they did not have AI Governance access.
addendum: The release note pertaining to AI system records displaying the source object ID instead of the source object name in task reports was removed on August 14, 2026.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across AI Governance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for AI Governance.

Microsoft Copilot Studio Agent Detection

Automatically scan Microsoft Copilot Studio environments to detect agents and capture key metadata such as ownership, environment, model bindings, connected channels, and authentication settings. This creates a searchable inventory of Copilot Studio agents and their configurations in OneTrust, helping teams support governance, risk assessment, and audit readiness.

For more information, see AI Automation Feature Guide.

GenAI Component Intelligence for AI Models

Create and enrich AI model records by using the Model library with information from commonly used third-party AI models. This gives teams a continuously updated technical context to understand model behavior, assess suitability and risk, and start governance workflows without manual research.

For more information, see Creating and Managing AI Models.

AI Policy - Automation Actions

Configure automated actions for AI policies to automatically flag risks and send email notifications when AI models and agents violate policies. This enhancement helps governance teams reduce manual monitoring, streamline governance workflows, and respond more quickly to issues by triggering actions based on policy compliance outcomes.

For more information, see AI Policy Enforcement Guide.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: AI Governance. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

addendum: This release note was added on August 14, 2026.

Things to Know

: Added support for bulk importing risks through theBulk importflow for AI systems, AI agents, projects, models, and datasets.
: Moved the Context Menu icon from the left to the right side of the AI Governance entity details screen.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Consent & Preferences

Cookie Consent - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Enhanced Tracking Technologies Interface

Leverage the new Tracking technologies interface to log, categorize, and report on tracking technologies found on your websites or SDKs. This feature improves the existing Tracking technologies interface and enhances insight into your websites' or apps' tracking technologies by linking them to known vendors and hosts.

For more information, see Managing Tracking Technologies. This feature is related to the following ideas: CONTENT-I-81, PDGI-I-1592, CSC-I-9, PDGI-I-1739, OT-I-14035.

Note:

This feature was previously available as Vendor Identification, Categorization, and Consent.

CMP Governance through Ownership & Notifications

Automatically define default owners for your websites and tracking technologies when configuring scans. This enhancement enables you to configure users within OneTrust who are responsible for managing changes to tracking technology details and the CMP configuration on specific websites and are notified of these updates.

For more information, see Scanning a Website and Managing Tracking Technologies. This feature is related to the following ideas: CONTENT-I-320, OT-I-6353, PDGI-I-899, PDGI-I-1505, CSC-I-125.

Website Scan Observability

Access the new scanner Job queue to review scan statuses and start times for each of your scanned domains. This feature provides a higher degree of insight into each of your scans, enabling you to more easily monitor scan progress and diagnose failures.

For more information, see Scanning a Website. This feature is related to the following ideas: OT-I-514, OT-I-4946, OT-I-12712, OT-I-15978, PDGI-I-595.

Enhancements to the Publish Script to Website API

Updated the Publish Script to Website API with the following enhancements:

Added the scriptVersion request parameter to specify the SDK version to publish to.
Added the regionRules request parameter to specify individual geolocation rules that require reconsent.
Added the gaTrackingEnabled and gaAssignCategory request parameters to configure Google Analytics event tracking behavior and category assignment.
Added the commonTrackers request parameter to specify hosts that should be automatically blocked when common tracker auto-blocking is enabled.
Added the sameSiteNone and separateCookieByDomain request parameters to configure cookie behavior for cross-site and partitioned cookie scenarios.
Added the supportSPA request parameter to support banner reloading for single-page application (SPA) experiences.
Added the supportCSP request parameter to support Content Security Policy (CSP) configurations that require the use of nonces for inline styles.
Added the autoRefreshEnabled request parameter to automatically refresh the web page and consent banner after a user submits a consent choice.

This feature is related to the following idea: OT-I-13234.

addendum: This release note was added on August 21, 2026.

Fixed

Resolved an issue that caused a console error and prevented annotation styling from applying correctly in Apryse WebViewer when a Content Security Policy (CSP) was enabled.

New Public Preview Features

Global Opt-Out Flow

|Available with Solution Packaging Only

Enable end users to opt out of a purpose across all of their linked devices, services, and accounts at once using the Global opt-out settings in your preference center template. This feature enables your end users to opt out of a purpose from every known identifier associated with their account and automatically submits a DSR request to process their opt-out from the specified purpose or purpose group. This enhancement is designed to improve your compliance with California privacy law.

For more information, see Customizing the Preference Center Template. This feature is related to the following ideas: OT-I-9627.

New CMP Experience

Enable the New CMP Experience setting to leverage the redesigned Cookie Consent interface. This new interface streamlines multiple interfaces within Cookie Consent to create a unified experience that improves navigation and makes it easier to deploy and manage your CMP.

For more information, see Enabling the New CMP Experience.

addendum: This release note was added on August 14, 2026.

Existing Public Preview Features

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

Users can no longer dismiss the banner using the Esc key if the Require banner interaction setting is enabled on the template (WCAG-A 1.3.1 Info and Relationships).
The banner no longer incorrectly receives focus by default upon page load when the Banner focus setting is disabled on a template (WCAG-A: 4.1.2 Name, Role, Value).

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Cookie Consent. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

: APartially completedscan status now displays on theWebsiteslist screen andScan detailsscreen when a login failure occurs during a scan.
: TheTagstab on theTracking technologiesscreen is now only available upon request.
: Local and session storage is now removed from the user's browser for specific purposes when users opt out of a specific purpose and is removed for all purposes when users selectReject allon the CMP.
: TheActive usersdashboard has been updated with clearer language to improve how usage metrics are reported.

addendum: This release note was added on September 4, 2026.
: ThePublishpane on theScriptsscreen now includes theShow CCPA out-out iconsetting, which allows you to display a CCPA-specific opt-out icon when deploying scripts with CCPA or CPRA templates.

addendum: This release note was added on September 4, 2026.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Mobile & OTT/CTV App Consent - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Link Age Ranges to Purposes

Link age ranges to categories and purposes for enhanced compliance with Age Gate requirements. This enhancement allows you to configure your SDK to hide specific categories or purposes to prevent users from consenting to those specified categories or purposes.

This feature is available for the following platforms:

Android
iOS
Roku
Maui
HTML5
Unity

For more information, see Configuring Age Gate Prompts for Mobile Apps,

New Applications APIs

|Available with Solution Packaging Only

Added APIs to retrieve application scan results, detected SDKs, permissions, and iOS privacy manifest analysis data. These APIs help developers programmatically analyze mobile applications, monitor scan results, identify detected SDKs and permissions, and review iOS privacy manifest compliance data.

Fixed Admin

Resolved an issue that prevented the Identifier column from populating on mobile app exports.

Fixed Android

Resolved an issue that prevented text configured in right-to-left languages from displaying with the correct formatting on the banner and preference center.

Fixed iOS

Resolved an issue that recategorized apps to their default category and overwrote previous manual categorization upon scan completion.
Resolved an issue that prevented text configured in right-to-left languages from displaying with the correct formatting on the banner and preference center.

Fixed Android TV

Resolved an issue that prevented hyperlinks in the banner description from responding when selected.

Fixed Apple TV

Resolved an issue that caused tvOS apps to quit unexpectedly when scrolling through parent category details for bundle groups and IAB stacks on the preference center.

Fixed API

Resolved an issue that caused restricted linked categories to be included in IAB legitimate interest (LI) consent processing when the App Tracking Transparency (ATT) permission was not granted. Restricted linked categories are now excluded from LI consent calculations and their LI status is returned as inactive (groupLIConsent = 0).
Resolved an issue that caused DSAR requests to fail when using unsupported language codes. The language is now hardcoded to en-us to prevent empty translations when a language is not enabled in the web form.
Resolved an issue that caused the CMP APIs to create separate cache entries for requests that differed only by query parameters. Cache keys now use only the URL origin and pathname while preserving the full URL for request processing, improving cache efficiency and ensuring consistent cache hits across requests with different query parameter values.
Resolved an issue that caused the Get List of Applications API to return an error when valid requests were submitted.
Resolved an issue that skipped CCPA consent processing for Age Gate and App Tracking Transparency (ATT) interaction types. Consent processing is now applied consistently for these interaction scenarios.

addendum: This release note was added on August 14, 2026.
Resolved an issue in Age Gate consent processing where an undefined upper age bound could result in incorrect consent range evaluation. Age ranges without a specified upper bound are now treated as open-ended to ensure accurate age eligibility calculations.

addendum: This release note was added on August 14, 2026.

New Public Preview Features

New Submit Global Opt-Out Request API

Added the Submit Global Opt-Out Request API as part of the CMP APIs to allow applications to submit a Global Opt-Out Data Subject Access Request (DSAR) on behalf of a data subject. This API enables organizations to support global opt-out workflows and honor data subject opt-out preferences across devices and services.

addendum: This release note was added on August 14, 2026.

Enhancements to Consent Management Platform (CMP) APIs

The following enhancements have been made to the CMP APIs:

Added the GlobalOptOutMobileSectionHeader and GlobalOptOutEmailFieldPlaceholderText keys and removed the GlobalOptOutDescription key. These changes enable correct display of the mobile section header and email placeholder text in Global Opt-Out implementations.
Updated the Global Opt-Out implementation to use customCategoryId for a group instead of groupId when determining the associated purpose. This enhancement ensures purpose values are resolved consistently across languages when new languages are added to the Global Opt-Out configuration.
Enhanced Age Gate consent string generation to represent hidden, non-actionable purposes as not applicable (0) instead of opted out (1). When a purpose is hidden because a user is below the permitted age range, generated consent strings now reflect that consent could not be provided, aligning privacy string output with Age Gate behavior.
Applied performance optimizations to CMP APIs, reducing response processing times for the Get Banner Data API, Get Preference Center Data API, and Get IAB and Google Vendors API.
Added the OT-Cache-Status response header to provide cache hit and miss visibility for CMP API requests. The header returns cache status information for individual fetch operations, helping developers troubleshoot caching behavior and monitor API performance.

addendum: This release note was added on August 14, 2026.
Added support for the globalOptOutData response object in the following APIs to return Global Opt-Out configuration data and UI elements, including linked categories, confirmation messages, instructional content, communication preferences, and display text:
addendum: This release note was added on August 14, 2026.
Added support for the ERROR_CODE_GLOBAL_OPT_OUT_NOT_CONFIGURED, ERROR_CODE_GLOBAL_OPT_OUT_DISABLED, and ERROR_CODE_DSAR error codes to provide more detailed error handling and troubleshooting for Global Opt-Out and DSAR-related scenarios.

addendum: This release note was added on August 14, 2026.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

iOS
Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

This feature is available for the following platforms:

iOS
Android
Apple TV
Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

Android
Android TV
Apple TV
HTML5
iOS
Roku
Unity
Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Universal Consent & Preference Management - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Unsubscribe/Subscribe Sections for the Trust Center

Add an Unsubscribe / pause section and Subscribe section to Trust Center pages that contain Consent preferences sections to allow end users to easily disable or enable purposes and preferences. You can also provide a survey to allow users to document their reasons for unsubscribing and a Pause button so users can disable notifications without unsubscribing.

For more information, see Adding Consent Preferences and Data Element Sections to the Trust Center. This feature is related to the following ideas: CSC-I-160, OT-I-1667, UCPMXP-I-14.

Enhancements to Bulk Actions Import Template and Bulk Export APIs

Change a data subject's identifier type using the CHANGE_IDENTIFIER_TYPE action when using the Consent data subjects bulk actions import template. This enhancement allows you to specify a new identifier type for multiple data subjects at once.

Additionally, leverage the newIdentifierType parameter in the Create Bulk Export API when completing DATA_SUBJECTS_BULK_ACTION exports. This parameter allows you to specify the new identifier type to assign to data subjects and is required when the action type is set to CHANGE_IDENTIFIER_TYPE.

For more information, see Bulk Importing Consent Records.

addendum: This release note was updated on August 14, 2026.

Enhancements to Universal Consent & Preference Management APIs

Added the reactivationDate response parameter to return the date and time when a temporarily paused consent purpose will be automatically reactivated.

This enhancement applies to the following APIs:

Enhancements to Consent Receipts APIs

The clearExpiration object within the receiptOptions parameter on the following APIs has been updated to allow users to remove the expiration for purposes configured with a status of Implicit consent from a receipt.

Fixed

Updated the collectionPointType query parameter in the Get List of Collection Points API to align with current collection point types.
- Added: HOSTED_WEB_FORM, EMBEDDED_WEB_FORM, and BULK_IMPORT
- Removed: EMAIL, CALL_CENTER, PAPER, IN_PERSON, and OTHER

Existing Public Preview Features

CMP Consent Context: Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

OriginalandEnhancedpreference center types have been deactivated for allUniversal Consent & Preference Managementusers. These preference center types were deprecated in 202602.1.0 (Winter Release).

For more information, see Retirement of Original and Enhanced Preference Centers.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Use Governance

Data Catalog - August 7, 2026 - 202608.1.0 (Summer Release)

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Discovery - August 7, 2026 - 202608.1.0 (Summer Release)

General availability

Enhancements to Data Discovery APIs: Added parameter validation to support periods (.) in classifier names. This validation has been added for the classifierName path parameter in the Get Custom Classifier API, Update Custom Classifier API, and Delete Custom Classifier API, and for the name body parameter in the Create Custom Classifier API and Update Custom Classifier API.

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Things to Know

Added a cancel option for test connection scans, allowing users to start a new test connection without waiting for the current scan to complete.

Added support for creating and copying custom classifiers with period (.) characters in theClassifier name, preventing related validation errors.

For more information, see Using Custom Classifiers for Discovery.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Platform Capabilities

Dashboards & Reporting - August 7, 2026 - 202608.1.0 (Summer Release)

Fixed

Resolved an issue that prevented translated attribute names from appearing correctly in Exception reports.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing ABAC-enabled reporting as part of Attribute-Based Access Control (ABAC) Phase 1: Foundations. ABAC-enabled reporting extends record-level access controls into supported reporting experiences by using assignments through sharing, attributes, or workflows to determine which report data users can access. This feature introduces assignment-aware reporting for supported objects, helping organizations align report visibility with operational access controls, support least-privileged access, improve governance, and provide more consistent reporting experiences.

For more information on ABAC, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC-enabled reporting is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects and reporting experiences.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Reporting Considerations for Attribute-Based Access Control (ABAC).

Existing Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

AI Governance inventories:
- AI systems
- Datasets
- Models
- Projects
Assessments
CMP time series
Consent time series
Contracts
Controls / Control implementations
Engagements
Incidents
Inventories:
- Assets
- Entities
- Processing activities
- Vendors
Issues
Privacy requests and subtasks
Risks

Note:

This feature does not currently support consent data subject details.

For more information, see Using Conversational Analytics Insights Chatbot.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Integrations - August 7, 2026 - 202608.1.0 (Summer Release)

New Public Preview Features

Key Pair Rotation

Refresh expiring Snowflake key pairs directly from the credentials flow instead of replacing them manually outside of OneTrust. Expiration reminder emails help teams rotate keys on time and maintain authentication continuity during the transition to the new key pair.

For more information, see Rotating Key Pairs for Integrations Credentials.

Existing Public Preview Features

AI-Powered Individual Log Error Analysis

|Available with Solution Packaging Only

Identify failed actions with AI-powered error summaries, root cause explanations, and actionable recommendations inside the log. This allows you to see exactly which workflow step failed, the type of error, and suggested next steps, which enables you to resolve issues faster and more confidently.

For more information, see Using Integration Logs.

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the new Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Settings & Administration - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

New AI Feature Management Experience

|Available with Solution Packaging Only

The AI Feature Management experience in Global Settings has been improved to simplify how admins enable, organize, and manage AI features in their accounts. This interface update includes the following changes:

AI feature management has moved from the Support > Feature management menu to the new AI management > AI features menu in Global Settings.
Added a top-level Enable OneTrust AI control to manage bulk access to all supported OneTrust AI capabilities.
AI features are now organized into feature groups that include related yet dedicated feature settings for precise access management.
Turning a feature group on or off now manages access for all included features in that group, making it easier to enable/disable related AI features in bulk.

For more information, see Managing AI Features in the OneTrust Platform and Available AI Platform Features.

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

Leverage our Third-Party Risk Agent in Copilot to conduct deep research to automate and accelerate the onboarding of new vendors and launch inherent risk assessments. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

AI Agents

|Available with Solution Packaging Only

Accelerate privacy impact and vendor risk assessments by using AI Agents to answer personal data questions during questionnaire completion. This feature analyzes assessment documents to identify likely data subjects and personal data types, then uses those results to support answers and update the linked inventory data map when the assessment is submitted.

For more information, see Leveraging AI Auto-Responses for Assessments.

AI Agents

|Available with Solution Packaging Only

Upload supplemental documentation during privacy impact and vendor risk assessment setup so AI Agents in Copilot can use additional context to answer assessment questions more effectively. This feature lets users add, remove, or skip documents before launch and makes those files available for AI auto-completion, improving output quality, transparency, and assessment completeness.

For more information, see OneTrust Privacy Risk Agent Feature Guide.

User Experience Enhancements

The Add User flow has been enhanced with the following changes to make user setup and role assignment more intuitive and efficient:

Improved progress tracking: The progress bar on theAdd Userscreen now includes labeled steps,Add detailsandAssign roles, providing clearer guidance throughout the workflow and helping users quickly understand where they are in the process.
Redesigned Add Role experience: TheAdd Rolemodal has been streamlined to align with the natural role assignment workflow. Users now select an organization before choosing roles, can assign multiple roles in a single action, and can review all selected roles before saving. These improvements are available when both adding and editing user roles, reducing clicks and improving administrative efficiency.

With these enhancements, administrators can onboard users more efficiently, navigate the role assignment process with greater confidence, and review role selections more easily before saving changes.

New Documents APIs

Added the new Get Download Token API and Download Document API to support secure document and attachment downloads through token-based access. These APIs allow developers to generate short-lived download tokens and retrieve document content without exposing direct file access.

New Get List of Event Types API

Added the Get List of Event Types API to retrieve the event types used to track user and system activity. Results can be filtered by product area or record type to help identify relevant audit events.

Fixed

Resolved an issue that prevented attribute groups from being deleted when translation values were applied.
Resolved an issue that prevented the full list of organizations from loading in the Organization filter on select inventory screens.
Resolved an issue that caused duplicate attachments to be created when a user quickly reselected a record during the upload process.
Resolved an issue that caused the last column in tables to display with an incorrect width when the screen contained a small number of columns or short cell data.
Resolved an issue that caused toast notifications with descriptions to remain persistent instead of automatically disappearing after six seconds.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

ABAC Phase 1: Foundations is available for supported objects across AI Governance, Privacy Automation, Tech Risk & Compliance, and Third-Party Management, and introduces the following core capabilities to manage record-level access and collaboration:

Basic Role: : Use the new minimal-access Basic role available on theRolesscreen to configure users with access only to the OneTrust Platform homepage, supporting least-privileged access from the start.
Assignments: : Leverage out-of-the-box or custom assignments, which are sets of permissions that define what users can do on a record. Assignments can be applied through record sharing or inherited through user attributes and workflow stages to automatically grant record-level permissions for owners, approvers, reviewers, and other users involved in the record lifecycle.
Sharing, Requesting & Managing Access: : Share records directly with users, request access to records, review who currently has access, and modify or revoke access as needed.
Record-Level Auditing: : Review audit history for record access and assignment configuration changes to understand what changed, who made the change, and when the change occurred.

ABAC helps organizations manage access more precisely by aligning permissions to records and assignments rather than relying on increasingly complex role structures. This enables granular record-level access control, improves governance, and simplifies collaboration across teams and workflows. With this enhancement, administrators can reduce access-management complexity while strengthening security and accountability across the OneTrust Platform.

For more information, see Attribute-Based Access Control (ABAC) User Guide. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0, with support initially available for a subset of objects and functionality. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

OneTrust Activity Log

Gain a unified, real-time view of user and system audit events across the OneTrust Platform with the Activity logs screen to increase visibility and control, investigate issues faster, and meet compliance requirements with a complete, traceable audit trail. Through a centralized audit experience, teams can quickly search and filter audit records, monitor activity across solutions from a single location, and export audit data for broader reporting and analysis.

For more information, see OneTrust Activity Log.

Existing Public Preview Features

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

Task Add Attachment
Task Add Comment
Task Created
Task Deleted
Task Remove Attachment
Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

: Performance enhancements have been made to theOrganizationmenu in theGlobal Headerto better support tenants with a large number of organizations, making navigation and organization selection easier.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Automation

DataGuidance - August 7, 2026 - 202608.1.0 (Summer Release)

Things to Know

DataGuidance Daily Retirement | Collections Transition

DataGuidance Daily emails are retired as of August 3, 2026 and are no longer available. Collection emails are now the path for continuing regulatory update monitoring in DataGuidance as they give users a more personalized way to follow relevant developments and receive updates based on the scopes they choose.

For more information, see DataGuidance Collections and Setting Up DataGuidance Emails & Notifications.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Mapping Automation - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Table Enhancements for Data Mapping Automation

Tables and table functionalities on the Policies tab of the Inventory details screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that prevented users from launching assessments for inventory records when a data transfer relationship included a context processing activity.
Resolved an issue that caused saved views on the Third parties screen to display in a random order, instead of numerical or alphabetical order.
Resolved an issue that prevented updated column configurations on the Third parties screen from being saved.
Resolved an issue that caused renaming a URL-type document in a project’s Documents tab to update a different document.
Resolved an issue that prevented IT & Security Risk Management assessment templates from appearing as options when configuring stage rules in a project workflow.

addendum: This release note was added on August 14, 2026.
Resolved an issue that prevented assessments from launching for all selected records when selections were made across multiple pages on the Assets screen.

addendum: This release note was added on August 14, 2026.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Privacy Automation.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Things to Know

You can now prevent invited users from viewing and selecting inventory records from drop-down fields when answering assessment questions by enabling theAccess control override for invited user inventory drop-down visibilitysetting.

For more information, see Data Mapping Automation Settings and Invited Users FAQ.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Incident Management - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Enhancements to Incident APIs

Updated the Get Incident API and the Update Incident API to return the attachments response object that contains attachment details and metadata. This enhancement enables downstream systems to identify attachments and associate them with the originating incident.

User Groups as Respondents in Launch Assessment Actions

Assign user groups as respondents in the Launch Assessment action for Incident workflows, and send assignment notifications to the selected group. This makes it easier to assign assessments to groups of users without adding each user individually.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Fixed

Resolved an issue that prevented jurisdiction fields from displaying in incident reports when related jurisdiction information was associated with an incident.
Resolved an issue that caused an Error updating incident message to appear when editing the Incident type field on the Incident register screen.
Resolved an issue that allowed the Date occurred field to be incorrectly configured to a time after the Date discovered field during the assessment review process.

addendum: This release note was added on August 14, 2026.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Assessment Automation - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Question-Level Scoring in Column Reports

View a more detailed breakdown of assessment scores in column reports with question-level score details that show how each question contributed to the final profile score. This enhancement improves score transparency and auditing for newly-completed assessments.

For more information about configuring column reports, see: Configuring a Column Report. This feature is related to the following ideas: OT-I-15164 and ADAN-I-61.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Enhancements to Assessment Automation APIs

The following enhancements have been made to the Assessment Automation APIs:

Updated the Launch Assessment V3 API to include the recordAdminId request parameter. This parameter specifies the user who will be assigned as the record admin for the assessment.
Updated the Get Assessment Record API to include the questionResponseWithAiMetadata response object. This object will return AI-generated answer metadata, including confidence scores, flags, and answer source information.
Updated the Get List of Assessments by Criteria API with the following enhancements:
- Added the completedBy response parameter to return the unique identifier of the user who completed the assessment.
- Added the assessmentCompletedBy response object to return details about the user who completed the assessment, such as the full name and email address.
- Added the assessmentDetailUrl response parameter to return a direct link to the assessment.
- Added the recordAdminId, recordAdmin, and recordAdminData response parameters to return record admin information, including the record admin's identifier and user details.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Fixed

Resolved an issue that caused the PDF reports containing risks and controls to display object IDs for Control owners and approvers instead of names.
Resolved an issue that prevented the Submit button from responding when attempting to submit sections during a reassessment, which caused users to be unable to complete or progress through their reassessment workflow.
Resolved an issue that prevented users from submitting an assessment when a project referenced in the assessment had been deleted.

addendum: This release note was added on August 14, 2026.
Resolved an issue that prevented text formatting, such as bullet points and lists, from displaying correctly in assessment template descriptions after saving the template.

addendum: This release note was added on August 14, 2026.
Resolved an issue that prevented risk data from displaying in assessment reports and also prevented reports containing risk data from becoming available for download in the Alert Center.

addendum: This release note was added on August 14, 2026.

Existing Public Preview Features

Privacy Risk Agent

|Available with Solution Packaging Only

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Assessment Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Template Updates

OnePIA (Full) - 7.6 Change Log

The Vietnam Personal Data Protection Law and related implementing decree establish a comprehensive framework governing the processing of personal data, setting clear requirements for lawful processing. It imposes core controller obligations such as contractual requirements and the performance of data protection and transfer impact assessments, broadly aligning with other global privacy frameworks. The law also grants individuals enforceable rights over their personal data. Customers interested in compliance with this framework are impacted by this release.

The following is the change log for this release:

The Welcome Text was updated to account for the Vietnam Personal Data Protection Law (2025) and related implementing decree.
Updated conditional logics throughout the template to account for the addition of the above-mentioned framework.
Updated applicable laws on question 3.1.
Removed question 7.24.
Added new question 6.26 for Automated processing of personal data [VN].
Updated the description text of question 4.13.
Updated the description text of question 4.39.
Updated the question and description text of question 4.58.
Updated the Consent rule.
Created the new Impact Assessment Dossier on the Personal Data Processing [VN] rule.
Created the new Impact Assessment Dossier on Personal Data Cross-border Transfer [VN] rule.
Created the new Image Collection [VN] rule.
Created the new Automated processing of personal data [VN] rule.

OnePIA (Lite) - 7.6 Change Log

The following is the change log for this release:

The Welcome Text was updated to account for the Vietnam Personal Data Protection Law (2025) and related implementing decree.
Updated applicable laws on question 3.1.
Created the new Impact Assessment Dossier on the Personal Data Processing [VN] rule.
Created the new Impact Assessment Dossier on Personal Data Cross-border Transfer [VN] rule.

OneVendor Lite v6.5 Change Log

The following is the change log for this release:

The Welcome Text was updated to account for the Vietnam Personal Data Protection Law (2025) and related implementing decree.
Added a new answer option to question 2.3 to account for the newly introduced framework.
Updated the description text of question 2.10.
Created the new Data Transfer [VN] rule.
Updated conditional logics throughout the template to account for the addition of the newly introduced framework.

OneVendor Full v6.5 Change Log

The following is the change log for this release:

The Welcome Text was updated to account for the Vietnam Personal Data Protection Law (2025) and related implementing decree.
Added a new answer option to question 3.1 to account for the newly introduced framework.
Removed question 3.20.
Updated the question and description text of question 3.24.
Renamed question 3.24.
Updated conditional logics throughout the template to account for the addition of the newly introduced framework.
Created the new Cloud Computing [MX] rule.
Created the new Cloud Computing [PE] rule.
Created the new Cloud Computing [VN] rule.
Created the new Data Transfer [VN] rule.
Created the new Data Processing Agreement [DPA] rule.
Deleted Vendor Contract [US].

Things to Know

: Assessment submission now provides a specific error message when an inventory name exceeds the 2,000-character limit, explaining that users must shorten the name, instead of displaying a generic server error.
: Assessment responses containing unsupported HTML or invalid text content are now identified before final submission. Assessments now display an actionable error message that identifies the affected question or field and explains what needs to be corrected.

addendum: This release note was added on August 14, 2026.
: Assessments launched through theSelf-Service Portalnow inherit the template’s configuredDeadlineandSend email remindersettings.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Rights Automation - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

New EU Privacy Workflows

Leverage the new EU privacy workflows for enhanced compliance with EU and member-state privacy laws. The following workflows are now available:

European Union General Data Protection Regulation Automated Decision-making Rights - 1.0
European Union General Data Protection Regulation Right to Access - 1.0
European Union General Data Protection Regulation Right to Data Portability - 1.0
European Union General Data Protection Regulation Right to Erasure - 1.0
European Union General Data Protection Regulation Right to Object - 1.0
European Union General Data Protection Regulation Right to Rectification - 1.0
European Union General Data Protection Regulation Right to Restriction of Processing - 1.0
European Union General Data Protection Regulation Right to Withdraw Consent - 1.0
Germany Federal Data Protection Act and GDPR Automated Decision-making Rights - 1.0
Germany Federal Data Protection Act and GDPR Right to Access - 1.0
Germany Federal Data Protection Act and GDPR Right to Data Portability - 1.0
Germany Federal Data Protection Act and GDPR Right to Erasure - 1.0
Germany Federal Data Protection Act and GDPR Right to Object - 1.0
Germany Federal Data Protection Act and GDPR Right to Rectification - 1.0
Germany Federal Data Protection Act and GDPR Right to Restriction of Processing - 1.0
Germany Federal Data Protection Act and GDPR Right to Withdraw Consent - 1.0
Ireland Data Protection Act 2018 and GDPR Automated Decision-making Rights - 1.0
Ireland Data Protection Act 2018 and GDPR Right to Access - 1.0
Ireland Data Protection Act 2018 and GDPR Right to Data Portability - 1.0
Ireland Data Protection Act 2018 and GDPR Right to Object - 1.0
Ireland Data Protection Act 2018 and GDPR Right to Rectification - 1.0
Ireland Data Protection Act 2018 and GDPR Right to Restriction of Processing - 1.0
Ireland Data Protection Act 2018 and GDPR Right to Withdraw Consent - 1.0
Ireland Data Protection Act 2018 and GDPR Right to Erasure - 1.0
UK Data Protection Act 2018 and GDPR Automated Decision-making Rights - 1.0
UK Data Protection Act 2018 and GDPR Right to Access - 1.0
UK Data Protection Act 2018 and GDPR Right to Data Portability - 1.0
UK Data Protection Act 2018 and GDPR Right to Erasure - 1.0
UK Data Protection Act 2018 and GDPR Right to Object - 1.0
UK Data Protection Act 2018 and GDPR Right to Rectification - 1.0
UK Data Protection Act 2018 and GDPR Right to Restriction of Processing - 1.0
UK Data Protection Act 2018 and GDPR Right to Withdraw Consent - 1.0
UK Data Protection Act Right to Submit a Complaint - 1.0

For more information, see Managing Language Options for Privacy Rights.

Fixed

Resolved an issue that caused an internal server error when attempting to share or download redacted files that had been through a Quick Review.

New Public Preview Features

Table Enhancements for Results Summary

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following tabs and modals within the Data subject request details screen:

Attachments tab
Review file segments modal
Structured data tab
Suggested Redactions tab

Note:

Select tables across Privacy Rights Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Existing Public Preview Features

Manage DROP Requests with OneTrust

Leverage OneTrust's DROP support to automate DROP request intake and status reporting. This enhancement enables California-registered data brokers to automatically download hashed requests on a defined schedule and posts status updates back to DROP.

For more information, see Managing Delete Request and Opt-Out Platform (DROP) Requests and Creating a Workflow for Managing DROP Requests.

New DROP Management APIs

Added the Create Data Subject Request for DROP Record API and the Update DROP Record API to create and update the status of Delete Request and Opt-out Platform (DROP) requests, respectively. These APIs support California-registered data brokers in managing DROP requests for deleting or opting out data subjects permanently.

Note:

The Create Drop Request API has been renamed to the Create Data Subject Request for DROP Record API. The Update Drop Status API has been renamed to Update DROP Record API.

Things to Know

Support CCPA opt-out requirements by configuring your web forms to allow opt-out requests to be submitted and processed without identity verification.

For more information, see Configuring Opt-Out Requests for CCPA.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Tech Risk and Compliance

Audit Management - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

addendum: The release note for object workflow support for User Groups as Respondents in Launch Assessment actions was removed on August 14, 2026.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Compliance Automation - August 7, 2026 - 202608.1.0 (Summer Release)

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Restore Deleted Inventory Records

For more information, see Restoring Deleted Inventory Records.

Existing Public Preview Features

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

addendum: This release note was added on August 14, 2026.

Things to Know

: TheAnalyze Evidencebutton is now available in theEvidence taskspane, allowing you to retry evidence analysis when a previous analysis fails.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Enterprise Policy Management - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

addendum: The release note for object workflow support for User Groups as Respondents in Launch Assessment actions was removed on August 14, 2026.

Fixed

Resolved an issue that allowed users to view and export reporting data from managing organizations to which they were not assigned.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Existing Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

Controls
Risks
Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

: TheSharebutton on thePolicy detailsscreen has been renamed toCopy shareable link.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Issues Management - August 7, 2026 - 202608.1.0 (Summer Release)

Fixed

addendum: The release note pertaining to validation errors for issue creation rules was removed on August 14, 2026.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Existing Public Preview Features

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Issues Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

addendum: This release note was updated on August 14, 2026 to include additional permission changes.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

IT & Security Risk Management - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Risk Register Table Enhancements

Tables and table functionalities on the Risk register screen across all products have been upgraded to improve usability, accessibility, and customization. Updates include resizable columns, more records per view, simplified row actions, and a more consistent user experience. The default Risk register view has also been updated to display columns in the following order:

ID
Risk name
Description
Residual risk score
Risk owners
Stage

Note:

If needed, you can create a custom view and add these columns previously included in the default view: ID, Risk Name, Risk Template, Description, Residual Risk Score, Organization, Source, Risk Owners, Type, Controls, Stage, Treatment Status, and Inherent Risk Score.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

User Groups as Respondents in Launch Assessment Actions

Impacted object workflows:

Controls

addendum: This release note was updated on August 14, 2026 to remove Issues, Objectives, and Risk workflow support for User Groups as Respondents in Launch Assessment actions.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Fixed

Resolved an issue that prevented invited users assigned as Risk owners from submitting exception requests.
Resolved an issue that prevented users from adding controls to risks within TPRM assessments.
addendum: The release note pertaining to the Risk Approver field continuously loading was removed on August 14, 2026.
addendum: The release note pertaining to the Processing Activity Status column displaying blank values was removed on August 14, 2026.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

The Approval rejected workflow rule event trigger has been added and allows you to change the workflow or current workflow stage when a workflow stage is rejected.
Workflow stage rules can now be configured to send notifications using system or custom email templates. Notifications can also be configured manually.
The Reason for Closure attribute can now be used as a condition when configuring Stage rules and Workflow rules. The Reason for closure and Closure note attributes have been added to the system-generated Treatment details attribute group.

For more information, see Managing Risk Workflows.

Restore Deleted Inventory Records

For more information, see Restoring Deleted Inventory Records.

Existing Public Preview Features

Risk Workflow Enhancements

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

Create task
Send notification
Update attribute
Generate PDF report
Launch assessment

Stage Settings:

Required attributes and comments upon stage change
Stage approval requirements
Close stage

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: IT Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

addendum: This release note was updated on August 14, 2026 to include additional permission changes.

Things to Know

: Control owners and Control approvers can now view related controls, issues, and evidence task details to perform required actions, even if they do not have the corresponding view access.
: TheDelete controloption on theControlstab of theInventory detailsscreen is now only available on the primary inventory record.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Management

Third-Party Due Diligence - August 7, 2026 - 202608.1.0 (Summer Release)

Fixed

Resolved a localization issue that prevented the Close label in the Third-Party Due Diligence comments panel from correctly corresponding to the selected tenant language.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Risk Management - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Deep Research Assessments

|Available with Solution Packaging Only

Automate vendor intelligence generation by triggering Deep Research directly from the vendor workflow when an assessment is launched. By calling the Deep Research service directly via workflow stage rules, OneTrust creates evidence-based vendor intelligence for standard and custom assessment templates, helping teams move onboarding forward without relying on outdated pre-generated research or manual investigation.

For more information, see AI Deep Research: Workflow-Initiated Assessments.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

DORA - LEI Updates

Enable inheritance for child copies to pass the following DORA attributes from a parent record to the child copy:

Identification Code of the ICT Third Party Service Provider
Function Identifier (Function)
LEI of entity (LEI number)
Identification code of the branch (Branch)

This enhancement helps organizations maintain the data required for DORA reporting when creating copies of parent records.

For more information, see DORA Data Validation Bulk Update Step-By-Step Instructions and DORA Report Data Validation Reference.

Fixed

Resolved an issue that caused archived assessments linked to engagements to appear in the Third parties screen but not in the Engagements screen.
Resolved an issue that prevented contracts from loading when a Contract type option was missing a translation key.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Third-Party Management.

Existing Public Preview Features

Table Enhancements for Third-Party Risk Management: Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:
Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Prevent invited users from viewing and selecting inventory records from drop-down fields when answering assessment questions by enabling theAccess control override for invited user inventory drop-down visibilitysetting.

For more information, see Third-Party Risk Management Settings and Invited Users FAQ.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.