All Solutions Release Notes

Existing Public Preview Features

AI Guard SDK and Classification

Protect critical AI systems by introducing AI Guard SDK by OneTrust, a comprehensive classification and inspection layer that helps ensure AI interactions are safe, secure, and compliant during development and runtime. This enhancement helps identify PII risks early through advanced data classification, enabling teams to test AI agents and quantify PII risk before moving to production. Integrate easily using the SDK-based approach designed for Python runtime environments, ideal for build-phase validation rather than high-volume, externally facing AI use cases.

For more information, see OneTrust AI Guard SDK Guide.

Observability for Amazon Bedrock

Extend continuous AI monitoring for Amazon Bedrock to gain visibility into AI agent and model activity. This enhancement ongoing governance by capturing agent and model metadata, usage information, evaluation metrics and more directly from Amazon Bedrock powered AI systems as they operate in production.

Additionally, you can detect and measure PII leakage for Amazon Bedrock using the AI Log Analyzer by scanning AI logs stored in Amazon S3, identifying sensitive prompts and responses, and surfacing PII counts in OneTrust for the associated AI assets to reduce risk from non-deterministic AI behavior.

For more information, see the following:

• Observability Usage of AI Governance Agents & Models

• AI Governance Model Evaluation Metrics

• AI Policy Enforcement Guide

• OneTrust AI Log Analyzer

Observability for Microsoft Foundry

Enable continuous monitoring for AI agents and models built on Microsoft Foundry by surfacing Evaluation Metrics for Agents and Models shifting from AI systems. This enhancement helps shift from one-time assessments to ongoing evaluation using live telemetry from Foundry-based AI systems.

For more information, see the following:

• AI Governance Model Evaluation Metrics

• AI Policy Enforcement Guide

AI Policy Manager & Seeded AI Policies

Automatically detect AI policy violations across platforms to provide AI governance teams with actionable steps to ensure governance and compliance throughout an AI Agent lifecycle. This policy orchestration experience allows users to create custom policies for unique scenarios and support guardrail enforcement and detection.

To compliment AI policy management, seeded AI policies are also available to flag and provide enforceable steps on guardrails. This reduces the time to value for customers getting started with AI Policies and provides a template for them to use when defining their own custom AI Policies in OneTrust.

For more information, see AI Policies Feature Guide.

Guardrail Detection & Enforcement

Automatically enforce responsible AI policies on violating agents and models across AI development platforms. This enhancement to AI policies provides consistent guardrail visibility and enforcement measures in the OneTrust Platform.

Note:

Databricks is now supported for AI Policy-driven Guardrail Enforcement as of the OneTrust 202606.2.0 release.

For more information, see AI Policy Enforcement Guide.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Enhanced Active Users Dashboard and Export

Leverage the enhanced Active users dashboard for improved reporting and better clarity on your daily CMP impressions. This enhancement allows you to visualize specific periods of activity data, clarifies terminology, and displays how much bot traffic was removed from your metrics. You can also export data on your CMP impressions to leverage in your organization's reporting.

For more information, see Using the Active Users Dashboard for Cookie Consent. This feature is related to the following ideas: CD-I-36.

Fixed

• Resolved an issue that prevented text from displaying with correct formatting on the preference center when the preference center was configured with a Panel or Center layout.

• Resolved an issue that prevented Compliance Assistant from consistently scanning all relevant domains.

• Resolved an issue that prevented users from deleting unnamed cookies from the Tracking technologies screen.

• Resolved an issue that prevented users from selecting websites for A/B tests on the Create new test screen when the application was configured in a language other than English.

• Resolved an issue that prevented users from exporting cookie receipts from the Bulk Export screen.

• Resolved an issue that produced inconsistent metrics on the Interactions tab of the Cookie Consent Insights Dashboard.

Existing Public Preview Features

Enhanced Tracking Technologies Interface

Leverage the new Tracking technologies interface to log and categorize tracking technologies on your websites or SDKs. This feature improves the existing Tracking technologies interface and enhances insight into your websites' or apps' tracking technologies by linking them to known vendors and hosts.

For more information, see Managing Tracking Technologies. This feature is related to the following ideas: CONTENT-I-81, PDGI-I-1592, CSC-I-9, PDGI-I-1739, OT-I-14035.

Note:

This feature was previously available as Vendor Identification, Categorization, and Consent.

CMP Governance through Ownership

Automatically define default owners for your websites and applications when configuring scans. This enhancement enables you to configure users within OneTrust who are notified of updates to the CMP configuration on specific websites and are responsible for managing these changes.

For more information, see Scanning a Website. This feature is related to the following ideas: CONTENT-I-320, OT-I-6353, PDGI-I-899, PDGI-I-1505, CSC-I-125.

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Website Scan Observability

Access the new scanner Job queue to review scan statuses and start times for each of your scanned domains. This feature provides a higher degree of insight into each of your scans, enabling you to more easily monitor scan progress and diagnose failures.

For more information, see Scanning a Website. This feature is related to the following ideas: OT-I-514, OT-I-4946, OT-I-12712, OT-I-15978, PDGI-I-595.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed Android

• Resolved an issue that caused the Android SDK to quit unexpectedly upon app startup.

• Resolved an issue that prevented custom UI parameters from functioning correctly and prevented the Cookie settings button from displaying on the banner after users upgraded to OneTrust 202602.1.2 from an older version of the application.

• Resolved an issue that caused apps to quit unexpectedly if boolean values were passed for some fields instead of string values when rendering the banner.

Fixed iOS

• Resolved an issue that caused the banner to reappear on every app launch when iOS apps were launched on a desktop via Mac Catalyst.

• Resolved an issue that allowed Liquid Glass window controls on iOS 26 iPad apps to overlap with the preference center backwards navigation button, preventing successful navigation.

Fixed HTML5

• Resolved an issue that caused apps to quit unexpectedly when the shouldShowBanner() method returned a value of 2.

Fixed API

• Resolved an issue that caused default category consent toggles to turn off after users accepted the iOS App Tracking Transparency (ATT) prompt when no categories were linked to ATT.

Existing Public Preview Features

Link Age Ranges to Purposes

Link age ranges to categories and purposes for enhanced compliance with Age Gate requirements. This enhancement allows you to configure your SDK to hide specific categories or purposes to prevent users from consenting to those specified categories or purposes.

This feature is available for the following platforms:

• Android

• iOS

For more information, see Configuring Age Gate Prompts for Mobile Apps,

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

• Get Banner Data API

• Get Preference Center Data API

• Get IAB and Google Vendors API

• Log Consent API

• Get Universal Consent Purposes API

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

• iOS

• Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

• iOS

• Android

• Apple TV

• Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

• Android

• Android TV

• Apple TV

• HTML5

• iOS

• Roku

• Unity

• Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

The minimum supported version for iOS and tvOS SDKs is now iOS 15 and tvOS 15 for improved compatibility with XCode 26. SDK versions below this threshold are no longer supported.

TheclearOTSDKData()method is now available for use when leveraging the Cordova/Ionic framework.

For more information, see Cordova / Ionic.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Unsubscribe/Subscribe Sections for the Trust Center

Add an Unsubscribe / pause section and Subscribe section to Trust Center pages that contain Consent preferences sections to allow end users to easily disable or enable purposes and preferences. You can also provide a survey to allow users to document their reasons for unsubscribing and a Pause button so users can disable notifications without unsubscribing.

For more information, see Adding Consent Preferences and Data Element Sections to the Trust Center. This feature is related to the following ideas: CSC-I-160, OT-I-1667, UCPMXP-I-14.

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

• Masking Policies for Databricks

• Masking Policies for Snowflake

• Row Filtering Policies for Databricks

• Row Filtering Policies for Snowflake

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused the Create Scan Profile and Update Scan Profile APIs to fail due to incorrect systemName validation.

• Resolved an issue that caused a worker node deployment to fail with a KeyError: 'SubnetId' during subnet discovery if the existing VPC used implicit (main route table) associations for public subnets.

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented translated attribute names from appearing when configuring exception column reports in the Report builder.

Existing Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

• AI Governance inventories:

  • AI systems

  • Datasets

  • Models

  • Projects

• Assessments

• CMP time series

• Consent time series

• Contracts

• Controls / Control implementations

• Engagements

• Incidents

• Inventories:

  • Assets

  • Entities

  • Processing activities

  • Vendors

• Issues

• Privacy requests and subtasks

• Risks

Note:

This feature does not currently support consent data subject details.

For more information, see Using Conversational Analytics Insights Chatbot.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Things to Know

• As of the OneTrust 202607.1.0 Release, OneTrust has completed the data migration of the Purpose of Processing attribute with customer's legacy data across the platform. Please contact OneTrust Support if your data has not been migrated to your environment after updating to 202607.1.0 or by August 8, 2026.

General Availability

LiveRamp Integration for Data Subject Requests

Fulfill LiveRamp data deletion and opt-out privacy requests directly from OneTrust. These data deletion and opt-out flows let joint OneTrust and LiveRamp customers send requests directly from OneTrust to LiveRamp and manage both request types within the same privacy automation process.

For more information, see Fulfill Data Subject Requests with LiveRamp Integrations.

Existing Public Preview Features

AI-Powered Individual Log Error Analysis

|Available with Solution Packaging Only

Identify failed actions with AI-powered error summaries, root cause explanations, and actionable recommendations inside the log. This allows you to see exactly which workflow step failed, the type of error, and suggested next steps, which enables you to resolve issues faster and more confidently.

For more information, see Using Integration Logs.

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the new Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented the Organization menu from displaying the full organizational hierarchy after switching organizations.

Existing Public Preview Features

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

Leverage our Third-Party Risk Agent in Copilot to conduct deep research to automate and accelerate the onboarding of new vendors and launch inherent risk assessments. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Assessment Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

• Task Add Attachment

• Task Add Comment

• Task Created

• Task Deleted

• Task Remove Attachment

• Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

Enhanced tables now support aSelect alloption in filter menus, making it easier to quickly select all available filter values. This enhancement is being introduced gradually and may not yet be available in all products.

Enhanced tables now support tooltips for disabled row actions. When an action is unavailable, users can hover over it to understand why, which helps to reduce confusion and improve usability. This enhancement is being introduced gradually and may not yet be available in all products.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

New Help Documentation Center in DataGuidance

Users can now access DataGuidance product documentation directly in the new Help Documentation center on DataGuidance.com for improved self-service, discoverability, onboarding, and ongoing feature adoption. This new interface brings product documentation parity between myOneTrust and DataGuidance so DataGuidance-only users can access the documentation they need without running into myOneTrust authentication barriers.

For more information, visit DataGuidance Help Center.

Things to Know

DataGuidance Daily Retirement | Collections Transition

The DataGuidance Daily email is retiring on August 3, 2026 and will no longer be available after this date. Collection emails will support ongoing regulatory update monitoring in DataGuidance as it offers users a more personalized way to follow relevant developments and receive updates based on the scopes they choose.

For more information, see DataGuidance Collections.

General Availability

Table Enhancements for Data Mapping Automation

Tables and table functionalities on the Assessments tab of the Inventory details screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that prevented the Asset map screen from redirecting to a list of assets when users clicked on the number displayed on a country.

• Resolved an issue that caused users to be redirected to the Archived assessments screen after submitting an assessment, instead of the Assessments screen.

Existing Public Preview Features

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from selecting multiple reporters when filtering the Incident register screen.

Existing Public Preview Features

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Dynamic Incident Notification Assessment (DINA) Updates

• DINA 1.3 added support for Vietnam Personal Data Protection Law, Sri Lanka Data Protection Act, and AI-related incident support under the South Korea AI Basic Act.

• DINA 1.3 introduced updates to the South Korea Personal Information Protection Act and Spain Data Protection Act rules and guidance for legal accuracy.

Databreachpedia Updates

• The Sweden NIS2 Transposition Law (2025) was updated to include cybersecurity incident requirements under national law implementing the NIS2 Directive in Sweden.

• The Tennessee Insurance Data Security Law (2021) was added to Databreachpedia. It provides requirements for the Tennessee insurance data security law.

• The Indiana Insurance Data Security Act (2021) was added to Databreachpedia. It provides requirements for the Indiana insurance data security law.

• The Pennsylvania Insurance Data Security Law (2023) was added to Databreachpedia. It provides requirements for the Pennsylvania insurance data security law.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

New Assessment Comments APIs

Added the Create Assessment Comment API and Get Assessment Comments API to create a new comment on an assessment question and retrieve all comments for a given assessment, respectively. This enhancement provides support for comment creation and retrieval for assessments through public, API-driven workflows.

New Get Assessment Score Profiles API

Added the Get Assessment Score Profiles API to retrieve comprehensive score profile information for an assessment. This API provides a detailed question-level score breakdown, helping you understand how each question contributed to the overall profile score.

New Get Assessment Record API

Added the Get Assessment Record API to retrieve assessment details with more flexibility. By default, the showAllDetails query parameter is set to false which returns a lightweight record with only basic information, sections, questions, and responses. When showAllDetails: true, the full assessment export is returned. This API offers a lightweight assessment retrieval option for improved performance.

Fixed

• Resolved an issue that prevented users with the DM Automation Manager role from viewing and creating assessment comments.

• Resolved an issue that prevented exports from the Assessment screen from returning results when filtering by a single assessment deadline date.

• Resolved an issue that prevented invited users from submitting assessments when the matching domain setting was enabled.

• Resolved an issue that prevented users with custom roles from selecting approvers for workflow stages in assessments, due to a misconfigured permission.

• Resolved an issue that prevented saved filters from displaying correctly when applying a filter on an inventory question in an assessment.

• Resolved an issue that prevented results from displaying when filtering for automatically-approved assessments on the Assessment screen.

• Resolved an issue that caused the cursor position to jump while entering text responses in assessments.

• Resolved an issue that caused date filters in the Assessment screen to return inconsistent results compared to Data Mapping Automation when assessments were created on the last day of the selected date range.

• Resolved an issue that caused custom assessment notification emails to be sent without the branding and email settings configured for the organization.

New Public Preview Features

Question-Level Scoring in Column Reports

View a more detailed breakdown of assessment scores in column reports with question-level score details that show how each question contributed to the final profile score. This enhancement improves score transparency and auditing for newly-completed assessments.

This feature is under Public Preview. Please contact OneTrust Support to request early access. For more information about configuring column reports, see: Configuring a Column Report. This feature is related to the following ideas: OT-I-15164 and ADAN-I-61.

Existing Public Preview Features

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Assessment Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Things to Know

Assessment scores are now cleared when an assessment is moved back toIn Progress. Scores are recalculated when the assessment is submitted again, ensuring that any score shown reflects the latest assessment responses.

For more information, see Reviewing and Completing an Assessment.

Assessments now have an updated section details and section navigation experience. The section details page has refreshed footers and buttons, while section navigation now uses updated colors, typography, spacing, and padding to improve usability.

addendum: This release note was added on August 26, 2026.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

New Public Preview Features

Manage DROP Requests with OneTrust

Leverage OneTrust's DROP support to automate DROP request intake and status reporting. This enhancement enables California-registered data brokers to automatically download hashed requests on a defined schedule and posts status updates back to DROP.

For more information, see Managing Delete Request and Opt-Out Platform (DROP) Requests.

New DROP Management APIs

Added the Create Drop Request API and the Update Drop Status API to create and update the status of Delete Request and Opt-out Platform (DROP) requests, respectively. These APIs support California-registered data brokers in managing DROP requests for deleting or opting out data subjects permanently.

Things to Know

Support CCPA opt-out requirements by configuring your web forms to allow opt-out requests to be submitted and processed without identity verification.

For more information, see Configuring Opt-Out Requests for CCPA.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented users from accessing the Evidence collection tab of the Evidence tasks screen due to a loading state that caused the interface to remain unresponsive.

Existing Public Preview Features

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

New ISO 22301

ISO 22301:2019 is the international standard for Business Continuity Management Systems (BCMS). It provides organizations with a structured approach to establishing, implementing, maintaining, and continually improving business continuity capabilities to prepare for, respond to, and recover from disruptive incidents.

We’ve made implementing ISO 22301:2019 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant controls, control implementation guidance, and evidence tasks (including guidance) to help you establish, maintain, and improve a Business Continuity Management System aligned with ISO 22301 requirements.

Note:

The ISO 22301:2019 framework will be available on the OneTrust Platform on July 31, 2026. This framework requires a content license to view copyrighted content, which is separate from the license covering OneTrust's software. For more information, see About Licensed Frameworks.

For more information, see Supported Control Frameworks.

Things to Know

The following dynamic variables can now be added to the subject or body of emails sent using theSend notificationstage rule action within evidence interval workflows:

• Name

• Assignees

• Approvers

• Due date

TheUpdate evidence taskandUpdate library evidence tasksimport templates now accept the email address of all user type attributes instead of user GUIDs.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused duplicate categories to appear on the Library tab of the Documents screen in the Self Service Portal due to untrimmed trailing spaces.

Existing Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

• Controls

• Risks

• Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Enterprise Policy Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Issues Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Delete Risk Library Records

Permanently delete records from the Risk library screen using the Context menu for each record. This enhancement allows you to delete risk library records, including records that were previously used to create risks, to maintain an accurate and up-to-date risk library.

For more information, see Using the Risk Library. This feature is related to the following idea: OT-I-10764.

Enhancements to IT Risk Management APIs

The following enhancements have been made to the IT Risk Management APIs:

• Added the associatedAttributeValueInformation object to include attribute option information in the Create Multiple Vulnerabilities, Update Vulnerabilities, Create Multiple Threats, and Update Threats APIs.

• Updated the Get List of Evidence Task Implementations API with the following enhancements:

  • Added the approver object to the response for evidence approver tracking.

  • Added the collectionStartMonth response parameter for collection period tracking.

  • Added the aiEvidenceAnalysisResult object to the response to return AI evidence analysis results with scoring and indicators.

• Updated the Update Control API to include the viewOnly response parameter for read-only control tracking.

• Updated the Create Multiple Vulnerabilities, Update Vulnerabilities, Create Multiple Threats, and Update Threats APIs to include the optionSelectionValue parameter within the attributes object of the request.

• Updated the Update Vulnerabilities and Update Threats APIs to include the displayLabel parameter in both the request and response for display labeling.

• Updated the Search Control Implementation Attributes API with the following enhancements:

  • Added the optionsByDomain object to the response. This object contains attribute domain option override information for domain-specific option overrides.

  • Added the formulaByDomain object to the response. This object contains attribute formula details for domain-specific formulas.

  • Added the displayResponseType response parameter for interface display type specification.

  • Added the optionListUrl, optionType, permissions, and applicationUrl parameters to the optionMetadata object of the response.

• Updated the fileDescription parameter to optional instead of required for the Attach Files to Control Implementation API.

• The max length of the description parameter value in the Create Control, Update Control, and Update Control Implementation APIs has increased from 3000 to 4000.

Fixed

• Resolved an issue that prevented Risk Owners and Risk Approvers from adding controls to a risk record.

• Resolved an issue that caused selected control implementations to become unselected when navigating between pages on the implementation selection screens.

• Resolved an issue that caused control implementations to disappear when editing records on the Control profile screen.

• Resolved an issue that prevented the Cancel and Apply buttons on the Control library filter pane from displaying correctly based on the browser zoom level.

• Resolved an issue that caused an error message to appear when assigning a custom Risk result value on the Risk details screen.

• Resolved an issue that prevented workflow rules from triggering when the required conditions were met.

Existing Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

• Create task

• Send notification

• Update attribute

• Generate PDF report

• Launch assessment

Stage Settings:

• Required attributes and comments upon stage change

• Stage approval requirements

• Close stage

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: IT Risk Management (Summer '26 - Current). For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Standard / Control Framework Changes

New ISO 22301

ISO 22301:2019 is the international standard for Business Continuity Management Systems (BCMS). It provides organizations with a structured approach to establishing, implementing, maintaining, and continually improving business continuity capabilities to prepare for, respond to, and recover from disruptive incidents.

We’ve made implementing ISO 22301:2019 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant controls, control implementation guidance, and evidence tasks (including guidance) to help you establish, maintain, and improve a Business Continuity Management System aligned with ISO 22301 requirements.

Note:

The ISO 22301:2019 framework will be available on the OneTrust Platform on July 31, 2026. This framework requires a content license to view copyrighted content, which is separate from the license covering OneTrust's software. For more information, see About Licensed Frameworks.

For more information, see Supported Control Frameworks.

Things to Know

Net-new accounts now have a singleRegulatory/compliancerisk category available. The duplicateRegulatory / complianceoption is no longer available for selection.

Note:

Existing customers will still have access to both attributes.

Assess riskquestion types now support theClosure noteandReason for closureattributes when configuring questions in theTemplate builder.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented the engagement primary record ID from populating in assessment metadata and reports when launching assessments with engagement as the primary record.

• Resolved an issue that prevented special characters from displaying correctly in DORA RoI CSV exports, affecting entity names in downloaded report files.

Existing Public Preview Features

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

Leverage our Third-Party Risk Agent in Copilot to conduct deep research to automate and accelerate the onboarding of new vendors and launch inherent risk assessments. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

DORA export tab 5.02 now uses immediate parent values for Nth-party links instead ofNthPartyLinkattributes, improving source data accuracy in the report.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.