All Solutions Release Notes

Existing Public Preview Features

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Risk Aggregation for Related Records

Enable systemic risk visibility across linked inventory objects in AI Governance. When enabled, parent objects (such as AI Systems or Projects) inherit risks from related child entities (such as Models or Datasets), allowing organizations to automate comprehensive risk views.

For more information, see Risk Aggregation for Related AI Records.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Things to Know

The following data tables have been added to Insights Dashboards created using theAI Governancedata source to display objects related to AI Systems, Models, Datasets, and Projects data:

• Related Assessments folder

  • Assessment Respondent

  • Assessment Approver

  • Assessment Question & Response Tabular

  • Assessment Stage Change Tracker

  • Assessment Tag

• Related Risks folder

  • Risk Related Assessment

  • Risk Related Inventory Attribute Value Tabular

  • Risk Related Inventory Attributes for Graphics & Slicers

  • Risk Stage Change Tracker

  • Risk Vulnerability

• Related Inventory folder

  • Inventory

  • Inventory Attribute value Tabular

  • Inventory Attribute for Graphics & Slicers

  • Inventory Attributes Configuration

  • Inventory Link V2 Attribute Value Tabular

  • Inventory Link V2 Attribute for Graphics & Slicers

  • Inventory Link V2 Attributes Configuration

  • Inventory Link V2

• Related Control Implementations folder

  • Control Implementation

  • Control Implementation Approver

  • Control Implementation Attribute Value for Graphics & Slicers

  • Control Implementation Attribute Value Tabular

  • Control Implementation Attributes Configuration

  • Control Implementation Owner

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Permissions

New Permissions

• AI Governance Insights view

• AI System insights view

• AI System insights view

• Dataset insights view

• Model insights view

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

• AI Governance Manager

• Site Admin

These permissions have been granted to custom roles that were previously assigned the AiGovernanceView permission.

General Availability

Table Enhancements for Geolocation Rules, Mobile Apps, and Templates

Various tables and table functionalities within Cookie Consent have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, and clearer row actions. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Geolocation rule groups screen

• Mobile apps screen

• Templates screen

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that prevented the date in the Last found column on the Tags tab of the Tracking technologies screen from displaying the most recent scan date where the tag was found.

• Resolved an issue that prevented the scanner from detecting some cookies dropped after login and recorded a false login failure when scanning behind authentication.

• Resolved an issue that incorrectly enabled categories that were set to Always Inactive in geolocation rules if users accepted the banner when Global Privacy Control (GPC) was enabled.

• Resolved an issue that prevented some scan results from exporting correctly.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

• Create Bulk Export API

• Get List of Bulk Exports API

• Get Bulk Export Status API

• Cancel Bulk Export API

• Get Bulk Export Download Details API

• Get Bulk Export Credit Details API

• Get List of Bulk Export Download Details API

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

• Identify known vendor services when scanning your websites.

• Categorize the vendor services active on your websites.

• Link tracking technologies to identified vendor services.

• Allow end users to configure consent for vendor services on the Preference Center.

• Capture records of consent at the vendor service level.

• Configure IAB templates to capture and disclose vendor service information.

• View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Things to Know

The Web Button Customization feature (Define Order of Buttons on the CMP) is temporarily available only upon request to address compatibility issues with custom CSS.

TheReconsent will occur afterfield on theGeolocation rule group detailsscreen can now be configured to a maximum of 99 years.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed iOS

• Resolved an issue that prevented consent status values from returning correctly when users closed the preference center without providing consent.

• Resolved an issue that caused the US Privacy string to save in the incorrect storage location.

Fixed Apple TV

• Resolved an issue that caused tvOS apps to quit unexpectedly because dedicated storage was already full.

• Resolved an issue that caused the US Privacy string to save in the incorrect storage location.

New Public Preview Features

New Parameter for CMP APIs

Updated the Get Banner Data, Log Consent, and Get Preference Center Data APIs to add the OT_AlwaysActiveIds parameter within the storageKeys object of the response. This parameter allows users to view IDs of purposes, vendors, and SDKs leveraging the Always Active consent model.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

• Get Banner Data API

• Get Preference Center Data API

• Get IAB and Google Vendors API

• Log Consent API

• Get Universal Consent Purposes API

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

• iOS

• Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

• iOS

• Android

• Apple TV

• Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

• Android

• Android TV

• Apple TV

• HTML5

• iOS

• Roku

• Unity

• Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users without Site Admin access from being assigned as approvers or owners when updating or creating privacy notices in bulk.

Existing Public Preview Features

Privacy Notice Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the new Privacy Notice Insights Dashboard to analyze data captured across Privacy Notice Management. This dashboard can be used to view key metrics related to privacy notices, workflows, and notice expiration details.

For more information, see Insights Privacy Notice Management Dashboard.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Table Enhancements for Collection Points

Tables on the Collection points screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

New Parameter for Get Data Subject’s Preferences API

Updated the Get Data Subject's Preferences API to include the authorization header parameter. This ensures secure, authenticated access to a user’s consent profile by leveraging a JSON Web Token (JWT) generated through the cross-device consent process.

Fixed

• Resolved an issue when saving data elements on a consent profile that caused some data elements to retain older values despite receiving updated information from more recent interactions.

• Resolved an issue that caused the Get Data Subject Details V4 API to return a 404 error after merging data subjects.

• The Profiles screen has been enhanced for improved performance when accessed by users in a non-root organization.

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

End of Support Notification for Get Data Subject’s Preferences V1 API

The Sunset Period for the Get Data Subject’s Preferences V1 API has ended. As of November 23, 2025, this API is now deprecated. Any customers leveraging this API are encouraged to use the Get Data Subject’s Preferences V2 API.

For more information, see OneTrust API Sunsetting & Deprecation Guidelines.

Salesforce single sign-on (SSO) is now supported when users log in to preference centers.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Data Governance Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Governance Insights Dashboard to analyze data captured across Data Catalog. This dashboard can be used to view essential information about your data assets, manage your data and associated metadata in response, and enact policies and procedures necessary for proper data governance.

For more information, see Insights Data Governance Dashboard.

Access Intelligence Insights Dashboard

Now enabled for every Data Catalog customer, data governance managers can now utilize highly customizable reporting and analytic capabilities using the Access Intelligence Insights Dashboard that collects data captured by Data Catalog and Data Discovery. This dashboard can be used to understand what sensitive data you have and how it is shared across the company so admins can quickly identify data-related risks present in your data ecosystem.

For more information, see Insights Access Intelligence Dashboard.

Note:

This dashboard is available by default only for Data Catalog customers.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Parquet files regardless of file extension can now be scanned and produce recommended terms according to the classification profile as expected.

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Data Discovery Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Discovery Insights Dashboard to analyze data captured across the module. This dashboard can be used to view information about job insights, scan metrics, worker node progress, and more related to your discovery business outcomes.

For more information, see Insights Data Discovery Dashboard.

Things to Know

The storage and handling of keys used in worker node deployments has been enhanced for improved security and compliance standards.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused custom attribute metadata and option values within data tables to not retain the latest records during updates.

• Resolved an issue that prevented visuals from being added to Incident Insight Dashboards when using the Add to dashboard icon on the Attribute configuration modal.

• Resolved an issue that prevented the correct translated values from displaying in the Changed Name Attribute column of activity reports using the Third-Party Risk Management data source.

• Resolved an issue that caused inventory risk column reports to duplicate control risk relationships when exported.

• Resolved an issue that prevented users from exporting column reports using the Privacy Rights Automation data source.

• Resolved an issue that prevented users from being able to successfully export control PDF reports.

Existing Public Preview Features

Insights Dashboards

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following seeded dashboards are available under Public Preview:

• Data Governance Dashboard

• Data Discovery Dashboard

• Access Intelligence Dashboard

• Privacy Notice Management Dashboard

Expanded Custom Attributes for Privacy & GRC Insights Dashboards

Track additional metrics by adding up to 10 custom attributes to each tab on custom Insights Dashboards created using the Privacy and Governance, Risk, Compliance data sources. This enhancement provides more flexibility in customizing your Insights Dashboards, allowing you to visualize unique data points relevant to your organization’s business context.

For more information, see Using Object-Based Attribute Tables for Custom Insights Dashboards.

Insights Dashboard Updates

• The following data tables have been added to Insights Dashboards created using the Enterprise Policy Management data source:

  • Control Related Entities

  • Control Related Entities Link

  • Control Related Entity Attribute Value for Graphics & Slicers

  • Control Related entity Attribute Value Tabular

  • Control Related Entity Attributes Configuration

  • Control Related Entity Workflow Stage Change

  • Risk Related Assessment

  • Risk Related Entities

  • Risk Related Entities Link

  • Risk Related Entity Attribute value for Graphics & Slicers

  • Risk Related Entity Attribute Value Tabular

  • Risk Related Entity Attributes Configuration

  • Risk Related Entity Workflow Stage Change Tracker

  • Risk Related Inventory Attribute Value Tabular

  • Risk Related Inventory Attributes configuration

  • Risk Related Inventory Attributes for Graphics & Slicers

  • Risk Related Objects

• The following data tables have been added to Insights Dashboards created using the AI Governance data source to display objects related to AI systems data, models, datasets, and projects:

  • Related Assessments folder

    • Assessment Respondent

    • Assessment Approver

    • Assessment Question & Response Tabular

    • Assessment Stage Change Tracker

    • Assessment Tag

  • Related Risks folder

    • Risk Related Assessment

    • Risk Related Inventory Attribute Value Tabular

    • Risk Related Inventory Attributes for Graphics & Slicers

    • Risk Stage Change Tracker

    • Risk Vulnerability

  • Related Inventory folder

    • Inventory

    • Inventory Attribute value Tabular

    • Inventory Attribute for Graphics & Slicers

    • Inventory Attributes Configuration

    • Inventory Link V2 Attribute Value Tabular

    • Inventory Link V2 Attribute for Graphics & Slicers

    • Inventory Link V2 Attributes Configuration

    • Inventory Link V2

  • Related Control Implementations folder

    • Control Implementation

    • Control Implementation Approver

    • Control Implementation Attribute Value for Graphics & Slicers

    • Control Implementation Attribute Value Tabular

    • Control Implementation Attributes Configuration

    • Control Implementation Owner

Things to Know

TheReport Namefield for PDF reports now supports up to 500 characters.

Insights as Default for Net New Customer Accounts

Starting in the OneTrust 202410.1.0 release, Insights Dashboards will be the default dashboard experience for all new OneTrust accounts. Users within new OneTrust accounts created after the respective environment is upgraded to 202410.1.0 will now see Insights Seeded Dashboards when available for a given module. Legacy dashboards will only appear for modules that do not currently have an Insights Seeded Dashboard. Existing accounts that already have access to Legacy Dashboards will not be affected by this change.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented documents from being uploaded as a result of unhandled session closures.

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

• Task Add Attachment

• Task Add Comment

• Task Created

• Task Deleted

• Task Remove Attachment

• Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented some custom saved views from applying correctly.

• Resolved an issue that caused some records to display more than once on Record of Processing Activities (RoPA) Reports.

• Resolved an issue that caused some data subjects and data categories to display more than once on Article 30 reports.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Important:

This feature was originally reported under General Availability for 202510.2.0. It has been rescheduled for General Availability in 202602.1.0 and will remain in Public Preview until that release.

Inventory Similarity Scan

|Available with Solution Packaging Only

Detect similar records in your data map for new records that have been added through various sources. Different than our duplicate asset functionality, the scan displays information about similar records within the new records to ensure users can easily find a record that is similar to the new entry.

For more information, see Inventory Similarity Scan.

Important:

This feature was originally reported under General Availability for 202510.2.0. It has been rescheduled for General Availability in 202602.1.0 and will remain in Public Preview until that release.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Incident Platform Workflow Enhancements

Incident Workflow rules now support automatic stage advancement or workflow changes based on event triggers and conditions, with the option to run current stage rules during stage advancement. This enhancement introduces the following workflow improvements:

• Required attributes are now available in incident workflow Stage details. This enforces the completion of the required attribute before the workflow will advance to the next stage. Additionally, you can customize the title and guidance that appear on the confirmation modal of the selected attribute.

• Comments are now available in incident workflow Stage details. This provides users an opportunity to add a comment before moving to the next stage. You can also mark if a comment is required before the stage can be advanced.

• Incident workflow stages enabled as approval stages can now be configured with approval requirement conditions in workflow Stage details. This can enforce if any or all approvers must give approval before advancement.

• Attribute updated is now available as an Event trigger in Workflow rules.

• The capability to add a custom assessment name in the Launch Assessment action under Stage Rules has been removed.

• The Incident Workflows screen has been enhanced with search and sorting capabilities to help better organize and manage incident workflows. You can now search the Workflow screen by Workflow name, and sort the Workflow screen by the following columns:

  • Workflow Name

  • Default

  • Status

  • Date Modified

  • Date Created

For more information, see Managing Incident Workflows.

Fixed

• Resolved an issue that prevented incident exports from working unless the Create Incidents permission was enabled for custom roles.

• Resolved an issue that prevented incidents from appearing in the correct location when created at the sub organization level.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Screen Header Enhancements

 

OneTrust is introducing updated screen headers to select screens across the platform to improve consistency and usability. These enhancements can include:

• Standardized screen titles and new in-app descriptions across applicable areas of the platform, providing clearer context and quick guidance to help users understand each screen’s purpose and available actions.

• Consolidated action buttons into a Context menu on select screens to reduce clutter and streamline navigation.

• Renamed buttons on select screens to make actions more immediately understandable and easier to follow.

These enhancements make it easier for users to orient themselves, understand workflows, and complete tasks with greater confidence and efficiency.

Note:

While some screens already feature updated headers, not all enhancements are applied universally and may vary depending on the screen's functionality and context. Enhancements to additional screens may also become visible across the next several releases.

For more information, see Screen Header Enhancements Across the OneTrust Platform.

Fixed

• Resolved an issue that prevented users from viewing AI sources in the Reference pane when leveraging AI Document Scanning for privacy assessments.

• Resolved an issue that displayed an error when users attempted to view AI suggestions on archived assessments.

• Resolved an issue that prevented the Cancel and Choose this Template buttons from displaying correctly when adding a new template from the template gallery.

• Resolved an issue that displayed an inconsistent naming structure for inventory questions when the responses were submitted via the Submit Responses API. The format for responses to inventory questions is now enforced to mirror the structure found in the OneTrust Platform.

• Resolved an issue that caused some attribute options to display intermittently on assessments.

• Resolved an issue that included questions in assessment exports with skip/show logic that had not been triggered.

• Resolved an issue that prevented some saved views on the Assessments screen from displaying correctly when the views contained filters with Approver equals Unassigned or various risk levels.

• Resolved an issue that displayed errors when updating some assessment rules with the Auto-Complete Assessment Upon Submission action.

Existing Public Preview Features

AI Inventory Record Analysis

|Available with Solution Packaging Only

Pre-populate questions on newly created assessments with AI-generated responses using the new AI Inventory Record Analysis feature.

These responses are based on data from previous, directly related assessments and inventories. This feature streamlines DPIA completion by reducing the time respondents spend on completing assessments and transferring previously entered information from PIAs.

For more information, see Leveraging AI Inventory Record Analysis and AI Document Scanning to Complete Assessments.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Accessibility Conformance

• Links no longer contain table cell (<td>) markup, which caused screen readers to announce some hyperlinks as lists (WCAG-A 1.3.1: Info and Relationships).

Things to Know

The confirmation modal that appears when updating assessment templates now specifies that changes to the template settings will affect all assessments using the template, including completed assessments, regardless of template version.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

New Share Results Summary API

Added the Share Results Summary API to allow users to share the results summary with the data subject based on the input request ID. This API allows users to share the results summary automatically.

Fixed

• Resolved an issue that caused the names of the following languages to display in the Data Subject Portal without capitalization:

  • Català (Catalan)

  • Français (Canadien)

  • Hrvatski (Croatia)

  • Русский (Russia)

  • Eesti (Estonia)

  • Lietuvių (Lithuania)

  • Српски (Serbia)

  • Shqip (Albania)

• Resolved an issue that prevented comments from being properly redacted when the Redact subtask comments, Redact public comments, or Redact internal comments settings were enabled for the Deidentify requests policy action on a retention policy.

• Resolved an issue that prevented workflow filters on the Requests screen from applying correctly when filtering for requests imported via the Bulk Import Historic Data Subject Requests functionality.

• The Last sync timestamp now updates correctly, ensuring archived requests are visible on the Requests screen.

Permissions

• The DSAR request view status bar permission has been renamed to DSAR request queue workflow stage change. No changes were made to the permission's functionality.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Permissions

• The following permissions have been added to give users the ability to view, create, and manage saved views for the evidence collection calendar:

  • Create collection calender saved views

  • Edit collection calender saved views

  • Delete collection calender saved views

  • View collection calender saved views

  These permissions have been granted to the following system roles:

  • Compliance manager

  • Site admin

  • Tech Risk & Compliance Admin

  These permissions have been granted to custom roles with the following permissions:

  • Create Initiative saved views

  • Edit Initiative saved views

  • Delete Initiative saved views

  • View Initiative saved views

Standard / Framework Changes

New Indiana Consumer Data Privacy Act Framework Added

The Indiana Consumer Data Privacy Act (ICDPA), effective January 1, 2026, establishes a comprehensive framework for data privacy, ensuring that personal data of Indiana residents is managed with care and transparency. This legislation grants consumers substantial rights over their data while defining clear requirements for businesses to uphold transparency and responsible data management. 

We’ve made implementing the ICDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of the ICDPA.

For more information, see Supported Control Frameworks.

California Consumer Privacy Act (CCPA as amended) 2025 Framework Updated

Framework content updated to align with the latest CPPA regulations, approved by the California Office of Administrative Law in September 2025, related to automated decision-making technology (ADMT), privacy risk assessments, and cybersecurity audits. The regulations introduce new requirements for businesses to assess and document risks associated with their data processing and cybersecurity practices, incorporate enhanced notices, and extend consumer choice mechanisms to individuals impacted by ADMT.

The updated California Consumer Privacy Act (CCPA, as amended) (2025) framework is now available on the OneTrust platform.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented attributes from being translated into Italian when policies were added or removed from the Document library and when attributes were updated in the Attribute manager.

Things to Know

The following data tables have been added to Insights Dashboards created using theEnterprise Policy Managementdata source:

• Control Related Entities

• Control Related Entities Link

• Control Related Entity Attribute Value for Graphics & Slicers

• Control Related entity Attribute Value Tabular

• Control Related Entity Attributes Configuration

• Control Related Entity Workflow Stage Change

• Risk Related Assessment

• Risk Related Entities

• Risk Related Entities Link

• Risk Related Entity Attribute value for Graphics & Slicers

• Risk Related Entity Attribute Value Tabular

• Risk Related Entity Attributes Configuration

• Risk Related Entity Workflow Stage Change Tracker

• Risk Related Inventory Attribute Value Tabular

• Risk Related Inventory Attributes configuration

• Risk Related Inventory Attributes for Graphics & Slicers

• Risk Related Objects

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Issue Attribute Grouping on Creation Modal

Create new issue records using all attributes and attribute groupings configured in the Attribute manager. This enhancement allows you to easily view relevant attributes during issue creation, with the same organization as the Issue details screen for a more intuitive experience. The Add issue modal now includes a Show only required fields checkbox that can be used to view only the system and custom attributes needed to create a record.

For more information, see Creating Issues. This feature is related to the following idea: XI-I-9.

Fixed

• Resolved an issue that caused issues flagged on assessment questions to appear for invited users.

• Resolved an issue that prevented attribute descriptions from appearing on the Issue type details screen in the Attribute manager.

Existing Public Preview Features

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization's risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from re-adding a deleted framework to the Framework library after its controls were moved to a different framework.

• Resolved an issue that prevented custom controls from appearing during risk creation when more than two controls were added to the new risk record.

• Resolved an issue that caused incorrect control implementation details to appear on the Control details screen after changing the control’s workflow stage.

• Resolved an issue that caused disabled control attributes to appear when creating a new control.

• Users can no longer manage risk control, threat, and vulnerability categories when the View category manager for controls, threats, and vulnerabilities permission is disabled.

• Users can now access comments in which they were mentioned directly from an email notification link without encountering an error.

• Resolved an issue where risks added through an assessment did not save data entered in the Treatment field.

• Resolved an issue that prevented highlighted text in the Description field from saving when configuring a workflow stage rule to create a task.

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility

Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.

Relationship Management

Add risks to existing control implementations or associate additional controls directly to risks.

Merge & Split Controls

Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Standard / Framework Changes

New Indiana Consumer Data Privacy Act Framework Added

The Indiana Consumer Data Privacy Act (ICDPA), effective January 1, 2026, establishes a comprehensive framework for data privacy, ensuring that personal data of Indiana residents is managed with care and transparency. This legislation grants consumers substantial rights over their data while defining clear requirements for businesses to uphold transparency and responsible data management. 

We’ve made implementing the ICDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of the ICDPA.

For more information, see Supported Control Frameworks.

California Consumer Privacy Act (CCPA as amended) 2025 Framework Updated

Framework content updated to align with the latest CPPA regulations, approved by the California Office of Administrative Law in September 2025, related to automated decision-making technology (ADMT), privacy risk assessments, and cybersecurity audits. The regulations introduce new requirements for businesses to assess and document risks associated with their data processing and cybersecurity practices, incorporate enhanced notices, and extend consumer choice mechanisms to individuals impacted by ADMT.

The updated California Consumer Privacy Act (CCPA, as amended) (2025) framework is now available on the OneTrust platform.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Permissions

The following permissions have been added to give users the ability to access and view content available within tabs on theRisk detailsscreen:

• Risk comments tab

• Risk controls tab

• Risk workflow and approval tab

• Risk history tab

• Risk related tab

These permissions have been granted to custom roles with the Access risks permission and the following system roles:

• AI Governance manager

• Assessments manager

• Audit manager

• Compliance manager

• Data access and usage manager

• Data governance manager

• Data mapping manager

• ERM manager

• ESG Manager

• Enterprise policy manager

• Privacy notice author

• Privacy notice manager

• Exchange manager

• IT risk manager

• Incidents manager

• Invited user

• Managed service provider

• Privacy officer

• Privacy program auditor

• Project owner

• Project respondent

• Project viewer

• TPDD compliance manager

• TPDD enhanced due diligence requester

• TPDD admin

• Tech risk & compliance admin

• Vendor manager

• Vendorpedia assessment coordinator

• IT risk approver

• Site admin

New Permissions

• Risk assessments tab

• Risk issues tab

• Risk activity tab

• Risk related risks tab

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

• AI Governance manager

• Assessments manager

• Audit manager

• Compliance manager

• Data access and usage manager

• Data governance manager

• Data mapping manager

• ERM manager

• ESG Manager

• Enterprise policy manager

• Privacy notice author

• Privacy notice manager

• Exchange manager

• IT risk manager

• Incidents manager

• Invited user

• Managed service provider

• Privacy officer

• Privacy program auditor

• Project owner

• Project respondent

• Project viewer

• TPDD compliance manager

• TPDD enhanced due diligence requester

• TPDD admin

• Tech risk & compliance admin

• Vendor manager

• Vendorpedia assessment coordinator

• IT risk approver

• Site admin

These permissions have been granted to custom roles that were previously assigned the following combination of permissions:

• View risk assessment list

• Issue view related

• Audit access

• ERM risk hierarchy view

• Relate risks view

General Availability

2026 SIG Updates

Configure vendor assessments using new SIG (Standardized Information Gathering) templates in the Gallery. These newly seeded templates are the current standardized questionnaires used by OneTrust to assess the security posture and risk profile of third-parties. The templates available include:

• 2026 SIG Lite

• 2026 SIG Core

• 2026 SIG Detail

For more information, see Adding a New Vendor Template from the Gallery.

Fixed

• Resolved an issue that removed published workflows when new workflows were published.

• Resolved an issue that prevented engagement column reports from opening properly in the Reports module.

• Resolved an issue that prevented the Reorder options button in the Attribute Manager from working in APP-JP, APP-UK, and UAT environments.

Things to Know

TheManage Data Elementsmodal now loads as expected when users are granted theEngagements personal data editpermission forAssignments.

AI document scanning now only answers questions for sections that are specifically assigned to the user.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Permissions

TheTrust profile create private sharepermission has been split into theTrust profile create private share,Delete the public link of a Trust Profile, andDelete access to a Trust Profilepermissions.

New Permissions

Linked Permissions