All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - January 30, 2026 - 202601.2.0

Fixed

Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for AI systems, Models, and Projects. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.
Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Existing Public Preview Features

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Risk Aggregation for Related Records

Enable systemic risk visibility across linked inventory objects in AI Governance. When enabled, parent objects (such as AI Systems or Projects) inherit risks from related child entities (such as Models or Datasets), allowing organizations to automate comprehensive risk views.

For more information, see Risk Aggregation for Related AI Records.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Permissions

Assessments – Invited User Security Enhancements

OneTrust is implementing new permission controls for Invited Users and Project Respondents to align front-end access controls with back-end API behaviors. This update ensures that low-privilege users cannot access metadata or assessment content outside their assigned scope. A new permission will be available for customers who need to restore the broader access level previously granted to their Invited Users.

No action is required unless you want Invited Users to retain their previous access. If you want Invited Users to retain their previous access, you can assign the newly introduced Advanced assessment metadata permission manually to a custom copy of the Invited User role after the change goes live in OneTrust 202601.2.0. Those users with the Invited User role will then need to be reassigned to the custom invited user role with the new permission.

For more information, see Assessments – Invited User Security Enhancements, Invited Users FAQ, and Project Respondents FAQ. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: AI Governance. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Download all attachments from an assessment by clicking theDownload allbutton on theAttachmentspane. This enhancement streamlines attachment downloading and prevents you from downloading multiple attachments individually.

Remove workflow approvers when an assessment is copied or reassessed by enabling theRemove workflow approvers when reassessing or duplicatingsetting on theTemplate detailsscreen. This enhancement allows you to configure workflow approvers when reassessing or copying assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Consent & Preferences

Cookie Consent - January 30, 2026 - 202601.2.0

General Availability

Improved Support for Google Additional Consent

The OneTrust Consent Management Platform (CMP) now supports Google Additional Consent V2. This update corrects string format and adds a disclosedVendors section within the string to enhance compatibility with Google Additional Consent.

For more information, see Using Google Additional Consent.

Fixed

Resolved an issue that prevented the Show banner setting from automatically enabling if users selected an IAB TCF 2.2 template when configuring geolocation rules with audience logic enabled.
Resolved an issue that prevented some banners from displaying in their correct default language when published with the Enable language detection on scripts setting disabled.
Resolved an issue that displayed banner buttons with inconsistent sizing based on button text length.
Resolved an issue that prevented some purposes on IAB TCF 2.2 preference centers from displaying as inactive after Do Not Track was enabled for the purposes and the script was republished with the Do you require users to reconsent? setting enabled.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

Identify known vendor services when scanning your websites.
Categorize the vendor services active on your websites.
Link tracking technologies to identified vendor services.
Allow end users to configure consent for vendor services on the Preference Center.
Capture records of consent at the vendor service level.
Configure IAB templates to capture and disclose vendor service information.
View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

Focus is now correctly applied to the appropriate on-screen elements when opening the preference center from the banner and and closing the preference center with the close button (WCAG-A 2.4.3: Focus Order).
Screen readers correctly announce banner content and no longer repeat banner elements (WCAG- A 4.1.2: Name, Role, Value).
Description list elements (<dl>) now correspond to single list item elements (<li>) on the cookie list within the preference center.

Things to Know

Deactivate compliance frameworks when leveraging CMP Compliance Assistant to disable regulatory frameworks not relevant to your CMP.

For more information, see Leveraging CMP Compliance Assistant.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Mobile & OTT/CTV App Consent - January 30, 2026 - 202601.2.0

General Availability - Admin

Configure Logos and Layout for the CTV Banner and Preference Center

Add custom logos to your banner and configure the alignment of button sets on your CTV preference center within the General and Layout sections of the Template Details screen. This feature improves parity between CTV, mobile, and web CMP configuration options.

For more information, see Customizing the CTV Banner Template and Customizing the CTV Preference Center Template.

General Availability - SDKs

Improved Support for Google Additional Consent

All OneTrust SDKs now support Google Additional Consent V2. This update corrects string format and adds a disclosedVendors section within the string to enhance compatibility with Google Additional Consent.

For more information, see Using Google Additional Consent.

Fixed iOS

Resolved an issue that caused the banner to reappear after users had confirmed their consent preferences.

Fixed Android TV

Resolved an issue that displayed a backwards navigation button on the preference center after the preference center was accessed directly.
Resolved an issue that intermittently highlighted the backwards navigation button on the preference center when users scrolled through the SDK list.
Resolved an issue that caused some purpose names to display incorrectly when navigating through the preference center's purposes if the Title field was left blank in the CMP template.
Resolved an issue that prevented the number of partners from displaying for bundle group purposes and displayed a blank space for bundle groups without descriptions.

Fixed Apple TV

Resolved an issue that positioned the Continue without accepting button as centered when the banner title was left blank in the CMP template.
Resolved an issue that prevented the number of partners from displaying for bundle group purposes.

Fixed HTML5

Resolved an issue that prevented consent toggles from displaying alongside purposes on the preference center.
Resolved an issue that prevented some preference center buttons from displaying with their configured styling.
Divider bars no longer display between button sets on the preference center when the button order is re-configured.

Fixed APIs

Resolved an issue that prevented the ConsentLanguage value within the TCF string from correctly reflecting the language of the Consent Management Platform (CMP) when loading banner details using the Get Banner Data API.
Resolved an issue that displayed disabled IAB purpose keys in the storageKeys object of the Get Banner Data API and Get Preference Center Data API response when the purposes were configured outside the TCF stack.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

iOS
Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

This feature is available for the following platforms:

iOS
Android
Apple TV
Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

Android
Android TV
Apple TV
HTML5
iOS
Roku
Unity
Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Accessibility Conformance

Users can now successfully navigate to buttons positioned below the Purpose description section and stack section of the preference center when using screen readers on Android TV devices (WCAG-A 2.4.3: Focus Order).

Things to Know

The(Legacy) PDF Formatexport option has been deprecated and is no longer available when exporting scan results from mobile or CTV applications.

The following Android SDK helper methods have been added to return accurate values when leveraging fetch UI methods. These methods enable you to more reliably debug your Android implementation.

getPurposeConsentLocal()
getConsentStatusForGroupId()
getVendorListUI()
getVendorDetails()

Additionally, the saveConsent() method has been updated to support fetch UI methods.

TheOneTrust.getVendorConsent()method has been added to the HTML5 SDK for consistent functionality across OneTrust SDKs.

ThestartSDK()method now loads preference center and vendor data based on geolocation when devices are offline.

An enhanced version of the React Native library, compatible with React Native 0.76 and later, is now available for use with Android, iOS, and Apple TV. For more information, seeOneTrust Next Generation CMP SDKs.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Notice Management - January 30, 2026 - 202601.2.0

General Availability

Privacy Notice Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the new Privacy Notice Insights Dashboard to analyze data captured across Privacy Notice Management. This dashboard can be used to view key metrics related to privacy notices, workflows, and notice expiration details.

For more information, see Insights Privacy Notice Management Dashboard.

Fixed

Resolved an issue that prevented embedded iframes from appearing after being added to a notice in the Document Builder.
Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for privacy notices. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Universal Consent & Preference Management - January 30, 2026 - 202601.2.0

General Availability

Table Enhancements for Trust Center

Tables and table functionalities on the Trust Center portals screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping you to work more efficiently with data and tailor your experience to your specific needs.

Note:

Select tables across the Trust Center may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that returned consent receipts without purposes when filtering the Create Bulk Export API for a specific purpose ID.
Resolved an issue that prevented users from importing consent receipts using the Stream Consent Receipts import template if the receipts leveraged the NO_OPT_OUT transaction type.
The Trust Center now saves users' preferred language to their profile to ensure the Trust Center loads in the appropriate translation.
Resolved an issue that prevented the Trust Center from displaying correctly translated content when configured in Czech (Czech Republic).

New Public Preview Features

Intelligent Rules for the Trust Center

Tailor your Trust Center to dynamically display content most relevant to your end users based on configured rules. This enhancement allows you to define conditions and actions that personalize content based on your data subjects' profile, interaction type, and session context.

For more information, see Configuring Intelligent Rules for the Trust Center.

Existing Public Preview Features

CMP Consent Context: Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

Deletion for data subjects and data subject purposes has been improved to allow manual deletion actions to execute faster when performed alongside in-progress retention rules.

Retention policy logic has been improved to preserve any receipts received after the retention policy is executed.

The Trust Center now displays highlight colors that correspond to your branding preferences when end users hover over tabs and drop-downs.

For more information on Trust Center branding, see Customizing the Appearance of a Trust Center.

TheCollection point alerts enabledsetting on theGlobal Settingsmenu has been renamed toSend email notifications for errorsto reflect its updated functionality. This setting now only determines if emailed error notifications are sent to collection point owners.

For more information, see Universal Consent & Preference Management Settings.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Use Governance

Data Catalog - January 30, 2026 - 202601.2.0

Existing Public Preview Features

Data Governance Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Governance Insights Dashboard to analyze data captured across Data Catalog. This dashboard can be used to view essential information about your data assets, manage your data and associated metadata in response, and enact policies and procedures necessary for proper data governance.

For more information, see Insights Data Governance Dashboard.

Access Intelligence Insights Dashboard

Now enabled for every Data Catalog customer, data governance managers can now utilize highly customizable reporting and analytic capabilities using the Access Intelligence Insights Dashboard that collects data captured by Data Catalog and Data Discovery. This dashboard can be used to understand what sensitive data you have and how it is shared across the company so admins can quickly identify data-related risks present in your data ecosystem.

For more information, see Insights Access Intelligence Dashboard.

Note:

This dashboard is available by default only for Data Catalog customers.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Discovery - January 30, 2026 - 202601.2.0

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Data Discovery Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Discovery Insights Dashboard to analyze data captured across the module. This dashboard can be used to view information about job insights, scan metrics, worker node progress, and more related to your discovery business outcomes.

For more information, see Insights Data Discovery Dashboard.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Platform Capabilities

Dashboards & Reporting - January 30, 2026 - 202601.2.0

General Availability

Insights Dashboards Available by Default in OneTrust 202601.2.0

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following Insights Dashboards are now available by default with the OneTrust 202601.2.0 release:

Privacy Notice Management Dashboard

Insights Dashboards empower you to evaluate their organization's performance, business needs, and more with improved, dynamic visualizations that represent key metrics most important to the organization.

Fixed

Resolved an issue that prevented AI systems from being selected as subobjects for AI Governance Entities when configuring custom attributes on the Attribute configuration modal.
Resolved an issue that caused edited numerical single select values for Risk attributes to be added as new entries on Insights dashboards instead of updating the existing records.
Users with custom roles assigned to a child organization can no longer view issues in the Issues default dashboard that fall outside of their organization hierarchy.
Resolved an issue that caused line charts on Insights dashboards to display months and days alphabetically instead of in chronological order for collection points.
Resolved an issue that prevented column names from being translated correctly when exporting empty column reports to Excel.

Existing Public Preview Features

Insights Dashboards

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following seeded dashboards are available under Public Preview:

Expanded Custom Attributes for Privacy & GRC Insights Dashboards

Track additional metrics by adding up to 10 custom attributes to each tab on custom Insights Dashboards created using the Privacy and Governance, Risk, Compliance data sources. This enhancement provides more flexibility in customizing your Insights Dashboards, allowing you to visualize unique data points relevant to your organization’s business context.

For more information, see Using Object-Based Attribute Tables for Custom Insights Dashboards.

Things to Know

Insights as Default for Net New Customer Accounts: Starting in the OneTrust 202410.1.0 release, Insights Dashboards will be the default dashboard experience for all new OneTrust accounts. Users within new OneTrust accounts created after the respective environment is upgraded to 202410.1.0 will now see Insights Seeded Dashboards when available for a given module. Legacy dashboards will only appear for modules that do not currently have an Insights Seeded Dashboard. Existing accounts that already have access to Legacy Dashboards will not be affected by this change.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Global Data Manager - January 30, 2026 - 202601.2.0

New Public Preview Features

Data Migration

Gain full oversight into all regulatory-driven data processing activities with the Legal Basis, Transfer Mechanism, and Entity Type constructs in Global Data Manager. This enhancement standardizes how these attributes are defined, collected, and represented in Data Mapping Automation.

For more information, see Global Reference Data Feature Guide.

Note:

No action is required from customers once enabled as these objects will appear across any template configured with an associated attribute. For existing customers, any custom values for these attributes will now be available as options for the given core construct. If you need to remove this feature once enabled, please contact OneTrust.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Integrations - January 30, 2026 -202601.2.0

Fixed

Resolved an issue that caused integrations to fail due to a reused charset (character set) in HTTP requests.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Settings & Administration - January 30, 2026 - 202601.2.0

Fixed

Resolved an issue that prevented user list drop-down fields from loading when the user list contained a large volume of 2100+ users.
Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

Task Add Attachment
Task Add Comment
Task Created
Task Deleted
Task Remove Attachment
Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Automation

Data Mapping Automation - January 30, 2026 - 202601.2.0

General Availability

Table Enhancements for Documents

Tables and table functionalities on the Documents tab of the Inventory details screens have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping you work more efficiently with data and tailor your experience to your specific needs.

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that prevented some filters with criteria including numerical single select attribute from applying correctly when filtering the Assets list screen.
Resolved an issue that prevented some related inventory records from populating in Article 30 Excel exports.
Resolved an issue that prevented some Article 30 reports from loading successfully.
Resolved an issue that caused the Projects list export to not match the total displayed in the UI.
Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

New Public Preview Features

Data Migration

For more information, see Global Reference Data Feature Guide.

Note:

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Important:

This feature was originally reported under General Availability for 202510.2.0. It has been rescheduled for General Availability in 202602.1.0 and will remain in Public Preview until that release.

Inventory Similarity Scan

|Available with Solution Packaging Only

Detect similar records in your data map for new records that have been added through various sources. Different than our duplicate asset functionality, the scan displays information about similar records within the new records to ensure users can easily find a record that is similar to the new entry.

For more information, see Inventory Similarity Scan.

Important:

This feature was originally reported under General Availability for 202510.2.0. It has been rescheduled for General Availability in 202602.1.0 and will remain in Public Preview until that release.

Permissions

Assessments – Invited User Security Enhancements

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Download all attachments from an assessment by clicking the Download all button on the Attachments pane. This enhancement streamlines attachment downloading and prevents you from downloading multiple attachments individually.
Remove workflow approvers when an assessment is copied or reassessed by enabling the Remove workflow approvers when reassessing or duplicating setting on the Template details screen. This enhancement allows you to configure workflow approvers when reassessing or copying assessments.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Incident Management - January 30, 2026 - 202601.2.0

Fixed

Resolved an issue with the Create Incident API and Update Incident API that permitted values entered for the dateDiscovered parameter to be earlier than values entered for the dateOccurred parameter. Validation has been added for the date order and a 400 response is now returned.
Resolved an issue that prevented some stage rules from triggering Incident workflows when the Assignee was set to User Group.
Resolved an issue that prevented users from exporting incident PDF reports.
Resolved an issue that prevented Incidents submitted through a web form from being logged in the Incident Register.
Resolved an issue that caused incidents created via web form to omit required fields.
Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Permissions

Assessments – Invited User Security Enhancements

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Assessment Automation - January 30, 2026 - 202601.2.0

Fixed

Resolved an issue that prevented risk details from displaying with correct formatting when generating a PDF report.
Resolved an issue that added the default approver as a respondent on reassessments triggered by automation rules.
Resolved an issue that caused some text editor sections in assessment PDF reports to render with incorrect formatting and layout in App-EU environments.
Resolved an issue that prevented users from editing links via hovering over, highlighting, or selecting.
Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Existing Public Preview Features

AI Inventory Record Analysis

|Available with Solution Packaging Only

Pre-populate questions on newly created assessments with AI-generated responses using the new AI Inventory Record Analysis feature.

These responses are based on data from previous, directly related assessments and inventories. This feature streamlines DPIA completion by reducing the time respondents spend on completing assessments and transferring previously entered information from PIAs.

For more information, see Leveraging AI Inventory Record Analysis and AI Document Scanning to Complete Assessments.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Permissions

Assessments – Invited User Security Enhancements

Things to Know

For more information see Adding, Viewing, and Downloading Assessment Attachments.

For more information see Configuring Assessment Template Settings.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Rights Automation - January 30, 2026 - 202601.2.0

Fixed

Resolved an issue that caused some non-applicable requests to display when filtering the Requests screen by Deadline.

New Public Preview Features

Stage Rules for Workflows

Configure rules on workflows to conditionally change workflows or their stages. This feature streamlines your workflows by automating changes based on your specific criteria. 

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Existing Public Preview Features

Import and Export Web Form Translations

|Available with Solution Packaging Only

Export web form translations as Excel files to manually update translations. Once complete, you can upload the file to add the updated translations to your web form. This enhancement includes support for AI translations, which allows you to enable AI translation on fields without values when configuring your export.

For more information, see Managing Language Options for Privacy Rights.

Accessibility Conformance

Screen readers no longer announce an additional region in the footer of some web forms (WCAG‑A 4.1.2: Name, Role, Value).

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Tech Risk and Compliance

Audit Management - January 30, 2026 - 202601.2.0

Fixed

Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for audits, workpapers, and findings. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Compliance Automation - January 30, 2026-202601.2.0

General Availability

Editable Collection Period Start Date for Evidence Tasks

Update the collection start month for evidence tasks on the Edit evidence task modal or in bulk via the new Update evidence task implementations template in Global Settings. This enhancement allows you to specify a calendar start month when creating an evidence task and update the start month of existing tasks, ensuring accuracy by adjusting all downstream impacts automatically.

For more information see Collecting and Managing Evidence Task and Managing Evidence Tasks in Bulk. This feature is related to the following idea: GCIA-I-303.

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Framework Changes

New China Personal Information Protection Law Framework Added

The China Personal Information Protection Law, effective November 1, 2021, establishes a comprehensive framework for the processing of personal information in China, setting clear requirements for transparency, lawful basis, and accountability. The law grants individuals robust rights over their personal information while imposing specific obligations on organizations—particularly for sensitive personal information, cross-border transfers, and the use of processors—to ensure responsible handling throughout the data lifecycle.

We’ve made implementing the PIPL easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of the PIPL.

Important:

The China Personal Information Protection Law will be available on the OneTrust platform effective February 6, 2026.

For more information, see Supported Control Frameworks.

New Databricks AI Governance and Security Framework Added

The Databricks AI Governance & Security Framework provides a structured approach to managing AI risks across the full AI lifecycle—spanning data, models, infrastructure, and operations—while embedding governance and security controls directly into the AI stack.

We’ve simplified adoption of the Databricks AI Governance & Security Framework by offering a unified framework on the our platform, combining both the Databricks AI Governance Framework and the Databricks AI Security Framework into a single, integrated control set. The framework includes controls, implementation guidance, evidence tasks, policies, and risks aligned to Databricks’ governance and security expectations, enabling organizations to operationalize AI governance and security in a scalable way.

Important:

The Databricks AI Governance & Security Framework will be available on the OneTrust platform effective Feb 15, 2026.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Enterprise Policy Management - January 30, 2026 - 202601.2.0

Fixed

Resolved an issue that prevented embedded iframes from appearing after being added to a document in the Document Builder.
Resolved an issue that caused the incorrect document name to appear on the Review document screen when opening procedures and standards from the My documents menu in the Employee Portal.
Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for policies, standards, procedures, and privacy notices. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Issues Management - January 30, 2026 - 202601.2.0

Fixed

Enhancements have been made to improve performance when processing complex workflow and routing rule configurations for issues. Validation to flag archived or deleted workflows and data, such as attributes, response options, organizations, etc., is now only applied ahead of time when a configuration contains 20 rules or fewer. When more than 20 rules are present, validation will be completed only when the rule details are expanded.

Existing Public Preview Features

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization's risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

IT & Security Risk Management - January 30, 2026 - 202601.2.0

Fixed

Resolved an issue that prevented workflow rules from allowing Operator values when using a formula-type attribute as the condition.
Resolved an issue that prevented the Risk hierarchy list screen from exporting to Excel.
Resolved an issue that prevented users with the View risk activity permission from viewing finding activities on the Activity tab of the Risk details screen.
Resolved an issue where users with only the View risk levels permission could view the Settings navigation menu due to an incorrect linkage with the Risk V2 Setting permission.
Resolved an issue that prevented control workflows from launching assessments from stage rules when a control entered the designated stage for the first time.
Resolved an issue that caused users to receive duplicate evidence collection notifications.
Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility: Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.
Relationship Management: Add risks to existing control implementations or associate additional controls directly to risks.
Merge & Split Controls: Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Permissions

Assessments – Invited User Security Enhancements

Standard / Framework Changes

New China Personal Information Protection Law Framework Added

Important:

The China Personal Information Protection Law will be available on the OneTrust platform effective February 6, 2026.

For more information, see Supported Control Frameworks.

New Databricks AI Governance and Security Framework Added

Important:

The Databricks AI Governance & Security Framework will be available on the OneTrust platform effective Feb 15, 2026.

For more information, see Supported Control Frameworks.

Things to Know

: Download all attachments from an assessment by clicking theDownload allbutton on theAttachmentspane. This enhancement streamlines attachment downloading and prevents you from downloading multiple attachments individually.
: Remove workflow approvers when an assessment is copied or reassessed by enabling theRemove workflow approvers when reassessing or duplicatingsetting on theTemplate detailsscreen. This enhancement allows you to configure workflow approvers when reassessing or copying assessments.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Management

Third-Party Due Diligence- January 30, 2026 - 202601.2.0

Fixed

Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Permissions

Assessments – Invited User Security Enhancements

Things to Know

: You can now create up to 300 custom text‑type attributes forEngagementsandContracts.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Risk Exchange - January 30, 2026 - 202601.2.0

Fixed

Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Permissions

Assessments – Invited User Security Enhancements

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Risk Management - January 30, 2026 - 202601.2.0

Fixed

Resolved an issue that prevented the Data Mapping vendor view comments permission from appearing in the platform.
Resolved an issue that prevented the ability to add issues via the Vendor Details screen.
Resolved an issue that prevented data from appearing on the Engagement tab of vendor column reports.
Resolved a permission issue that prevented users with the Project owner role from assigning assessments to unrecognized respondents. The User can create invited user permission has been re-enabled for the Project owner system role.

Permissions

Assessments – Invited User Security Enhancements

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

You can now create up to 300 custom text‑type attributes for Engagements and Contracts.
You can now change a contract's status using the Change status Context Menu option on the Contract Details screen.