All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - June 26, 2026 - 202606.2.0

Existing Public Preview Features

AI Guard SDK & Classification

Protect critical AI systems by introducing AI Guard SDK by OneTrust, a comprehensive classification and inspection layer that helps ensure AI interactions are safe, secure, and compliant during development and runtime. This enhancement helps identify PII risks early through advanced data classification, enabling teams to test AI agents and quantify PII risk before moving to production. Integrate easily using the SDK-based approach designed for Python runtime environments, ideal for build-phase validation rather than high-volume, externally facing AI use cases.

For more information, see OneTrust AI Guard SDK Guide.

Observability for Amazon Bedrock

Extend continuous AI monitoring for Amazon Bedrock to gain visibility into AI agent and model activity. This enhancement ongoing governance by capturing agent and model metadata, usage information, evaluation metrics and more directly from Amazon Bedrock powered AI systems as they operate in production.

Additionally, you can detect and measure PII leakage for Amazon Bedrock using the AI Log Analyzer by scanning AI logs stored in Amazon S3, identifying sensitive prompts and responses, and surfacing PII counts in OneTrust for the associated AI assets to reduce risk from non-deterministic AI behavior.

For more information, see the following:

Observability for Microsoft Foundry

Enable continuous monitoring for AI agents and models built on Microsoft Foundry by surfacing Evaluation Metrics for Agents and Models shifting from AI systems. This enhancement helps shift from one-time assessments to ongoing evaluation using live telemetry from Foundry-based AI systems.

For more information, see the following:

AI Policy Manager & Seeded AI Policies

Automatically detect AI policy violations across platforms to provide AI governance teams with actionable steps to ensure governance and compliance throughout an AI Agent lifecycle. This policy orchestration experience allows users to create custom policies for unique scenarios and support guardrail enforcement and detection.

To compliment AI policy management, seeded AI policies are also available to flag and provide enforceable steps on guardrails. This reduces the time to value for customers getting started with AI Policies and provides a template for them to use when defining their own custom AI Policies in OneTrust.

For more information, see AI Policies Feature Guide.

Guardrail Detection & Enforcement

Automatically enforce responsible AI policies on violating agents and models across AI development platforms. This enhancement to AI policies provides consistent guardrail visibility and enforcement measures in the OneTrust Platform.

Note:

Databricks is now supported for AI Policy-driven Guardrail Enforcement as of the OneTrust 202606.2.0 release.

For more information, see AI Policy Enforcement Guide.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: AI Governance. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

TheFull Resource Nameattribute is now a discoverable attribute across models and agents in Amazon Bedrock and Azure Foundry. This is a unique resource identifier assigned by the AI platform used to reference, link, or retrieve the resource via APIs or platform consoles.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Consent & Preferences

Cookie Consent - June 26, 2026 - 202606.2.0

General Availability

Bulk Export CMP Receipts

|Available with Solution Packaging Only

Export consent management platform (CMP) receipts in bulk leveraging the new Bulk export tab on the Cookie Consent menu. This enhancement enables you to more easily create and download Excel reports with records of CMP receipts to improve record keeping and integration.

For more information, see Bulk Exporting CMP Receipts. This feature is related to the following ideas: CONSENT-I-58, OT-I-16208, CONSENT-I-49.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once.

India Digital Personal Data Protection Act (DPDPA) Template

Leverage the new India (DPDPA) template when configuring your CMP. This template enables you to configure your CMP for improved compliance with consent requirements in India

For more information, see Adding, Editing, and Managing Cookie Consent Templates.

Fixed

Resolved an issue that created multiple consent receipts upon user logout when Global Privacy Control (GPC) was enabled on a user's browser.
Resolved an issue that prevented the CMP from loading successfully when the banner template was configured with a Choices layout.
Resolved an issue that prevented webpages from successfully refreshing after users clicked the Confirm my choices button and the Refresh page upon interaction setting was enabled for a production script.
Resolved an issue that allowed some users with custom roles to add new website scans without the Cookiev2 add and delete website permission.
Resolved an issue that prevented users from creating a copy of the Daily Cookie Consent default insights dashboard.

Existing Public Preview Features

Enhanced Tracking Technologies Interface

Leverage the new Tracking technologies interface to log and categorize tracking technologies on your websites or SDKs. This feature improves the existing Tracking technologies interface and enhances insight into your websites' or apps' tracking technologies by linking them to known vendors and hosts.

For more information, see Managing Tracking Technologies. This feature is related to the following ideas: CONTENT-I-81, PDGI-I-1592, CSC-I-9, PDGI-I-1739, OT-I-14035.

Note:

This feature was previously available as Vendor Identification, Categorization, and Consent.

CMP Governance through Ownership

Automatically define default owners for your websites and applications when configuring scans. This enhancement enables you to configure users within OneTrust who are notified of updates to the CMP configuration on specific websites and are responsible for managing these changes.

For more information, see Scanning a Website. This feature is related to the following ideas: CONTENT-I-320, OT-I-6353, PDGI-I-899, PDGI-I-1505, CSC-I-125.

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Website Scan Observability

Access the new scanner Job queue to review scan statuses and start times for each of your scanned domains. This feature provides a higher degree of insight into each of your scans, enabling you to more easily monitor scan progress and diagnose failures.

For more information, see Scanning a Website. This feature is related to the following ideas: OT-I-514, OT-I-4946, OT-I-12712, OT-I-15978, PDGI-I-595.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

Closing the IAB Vendors list via the Close button or Esc key now correctly returns keyboard focus to the vendors list link (WCAG-A 2.4.3: Focus Order).

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Cookie Consent. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Mobile & OTT/CTV App Consent - June 26, 2026 - 202606.2.0

Fixed Android

Resolved an issue that sent blank consent receipts for purposes not configured by the end user. The SDK now only submits receipts for purposes the user changed.

Fixed iOS

The NSPrivacyAccessedAPITypeDeclaredAgeRange key has been removed from the SDK to prevent apps from being rejected from Apple's App Store.
Resolved an issue that caused some React Native SDK builds to fail after calling deprecated methods.
Resolved an issue that prevented the SDK from logging consent preferences made while the user's device was offline.

Fixed HTML5

Resolved an issue that displayed the Store and/or access consent purpose on the preference center after the purpose had been disabled in the admin interface.

New Public Preview Features

Link Age Ranges to Purposes

Link age ranges to categories and purposes for enhanced compliance with Age Gate requirements. This enhancement allows you to configure your SDK to hide specific categories or purposes to prevent users from consenting to those specified categories or purposes.

This feature is available for the following platforms:

Android
iOS

For more information, see Configuring Age Gate Prompts for Mobile Apps,

Enhancements to Consent Management Platform APIs

The following enhancements have been made to the Consent Management Platform (CMP) APIs:

Updated the errors object of CMP API responses to include ERROR_CODE_EMPTY_CONSENT as a response for the code parameter and At least one purpose consent is required as a response for the message parameter. This error is returned by the Log Consent API when logging Universal Consent preferences with OT-Explicit-Consent: true and an empty payload. This enhancement adds error handling to avoid generating empty receipts and ensure that at least one consent is captured.

Age Based Consent is now supported for the CMP APIs. The following enhancements allow you to capture and manage age range information as part of the consent flow, enabling age-based experiences within your applications.

Updated the Log Consent API to include AGEGATE_RANGE as a value for the interactionType request parameter and to include the new ageGate request parameter. When interactionType is set to AGEGATE_RANGE, the ageGate parameter is required to configure the necessary age range for age-based consent capture.
Updated the Get Banner Data API to include the linkedCategories parameter to return the list of consent categories linked to age groups within the ageGate parameter of the prompts object of the response.
Updated CMP API Responses to include the new OT_AgeGate parameter within the storageKeys object of the response.
Updated the errors object of CMP API responses to include ERROR_CODE_INVALID_AGE_RANGE as a response for the code parameter and The upper bound of the age range must be greater than lower bound as a response for the message parameter.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

iOS
Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

This feature is available for the following platforms:

iOS
Android
Apple TV
Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

Android
Android TV
Apple TV
HTML5
iOS
Roku
Unity
Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

You can now select a version of the iOS Privacy Manifest after correcting mismatches to amend your corrections and review historical versions of the privacy manifest on theScan resultstab of theMobile app detailsscreen. Additionally, you can export your selected version of the manifest file by selecting the Export icon.

For more information, see Viewing and Categorizing Mobile App Consent Scan Results.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Universal Consent & Preference Management - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that prevented magic link refresh schedulers and data retention policy schedulers from populating in the OneTrust application when a tenant was copied.
Resolved an issue that caused the Get List of Data Subjects V4 API to produce error messages when filtering by a consent date or withdrawal date older than the collection point's linked policy.
The list of supported values for the sort query parameter in the Get List of Data Subjects V4 API has been updated to correctly reflect supported sort criteria. The createdDate,asc and createdDate,desc values have been removed.
Resolved an issue that displayed duplicate files across multiple pages within the Download file modal when exporting consent receipts or data subjects from the Bulk export interface.

Existing Public Preview Features

Unsubscribe/Subscribe Sections for the Trust Center

Add an Unsubscribe / pause section and Subscribe section to Trust Center pages that contain Consent preferences sections to allow end users to easily disable or enable purposes and preferences. You can also provide a survey to allow users to document their reasons for unsubscribing and a Pause button so users can disable notifications without unsubscribing.

For more information, see Adding Consent Preferences and Data Element Sections to the Trust Center. This feature is related to the following ideas: CSC-I-160, OT-I-1667, UCPMXP-I-14.

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

A CAPTCHA field now displays to end users during the authentication process for multi-page preference centers when theEnable phone number verificationsetting is enabled.

Data subject merge logic has been enhanced to ensure custom preferences remain checked when linked to a purpose with an anActivestatus and are not not overridden by aNot givenstatus with an unchecked preference.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Use Governance

Data Catalog - June 26, 2026 - 202606.2.0

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Discovery - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that prevented data retrieval from BigQuery for privacy requests if any of the column values were empty.
Improved the following classifiers by removing geographic terms that could be confused for possible names to reduce false positives:
- First Name
- Last Name
- Full Name
Resolved an issue that caused scan jobs to fail when error messages from JDBC drivers contained NULL bytes.
Resolved an issue that prevented document classification during file processing when scanning with the O365 OneDrive connector.

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Platform Capabilities

Dashboards & Reporting - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that prevented users from creating a copy of the Daily Cookie Consent default insights dashboard.
Resolved an issue that prevented vendor activity details from appearing within custom insights dashboards.

Existing Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

AI Governance inventories:
- AI systems
- Datasets
- Models
- Projects
Assessments
CMP time series
Consent time series
Contracts
Controls / Control implementations
Engagements
Incidents
Inventories:
- Assets
- Entities
- Processing activities
- Vendors
Issues
Privacy requests and subtasks
Risks

Note:

This feature does not currently support consent data subject details.

For more information, see Using Conversational Analytics Insights Chatbot.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Integrations - June 26, 2026 - 202606.2.0

Existing Public Preview Features

AI-Powered Individual Log Error Analysis

|Available with Solution Packaging Only

Identify failed actions with AI-powered error summaries, root cause explanations, and actionable recommendations inside the log. This allows you to see exactly which workflow step failed, the type of error, and suggested next steps, which enables you to resolve issues faster and more confidently.

Note:

The AI Summary component has been updated in the OneTrust 202606.2.0 release with collapsed and expanded states for when the AI summary is being generated and when it is available to view.

For more information, see Using Integration Logs.

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the new Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Settings & Administration - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that prevented User Delete events from being recorded for single-tenant users in audit logs and downstream integrations such as Splunk.
Resolved an issue that prevented the complete list of roles assigned via user groups from displaying on the Users screen when the user's default organization was the same as the user group organization.

Existing Public Preview Features

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

Leverage our Third-Party Risk Agent in Copilot to conduct deep research to automate and accelerate the onboarding of new vendors and launch inherent risk assessments. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Assessment Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

Task Add Attachment
Task Add Comment
Task Created
Task Deleted
Task Remove Attachment
Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Settings & Administration. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Platform Icon Enhancements: OneTrust has updated icons to enhance consistency, usability, and visual clarity across the platform. This update standardizes icon sizing, spacing, and proportion and does not change product functionality.

Note:
While some screens already feature updated icons, not all enhancements are applied universally. These enhancements will continue to be updated throughout the platform across the next several releases.
Platform Organization Menu Enhancements: OneTrust has updated the Organization menu in the Global Header to improve navigation and visual clarity. The redesigned menu introduces a nested list layout for viewing organizational hierarchies while also providing the option to switch to a flat list view.

Note:
After switching organizations, reopening the Organization menu may not display the full organizational hierarchy. This issue will be resolved in an upcoming release.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Trust Center - June 26, 2026 - 202606.2.0

Fixed

Resolved the following issues that prevented the Trust Center from displaying correctly on mobile devices:
- Resolved an issue that prevented Consent preferences sections from consistently displaying purposes across two columns when the section was configured with two column layout.
- Resolved an issue that incorrectly truncated some button text on sections with checkboxes.
- Resolved an issue that displayed excessive white space around purposes when displayed on iPad Mini devices.

Privacy Automation

Data Mapping Automation - June 26, 2026 - 202606.2.0

General Availability

Table Enhancements for Data Mapping Automation

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

Assessments screen
Archived assessments screen
Recycle bin for assessments screen
Deleted records screen
Data lineage screen

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that created duplicate processing activities within the same organization during bulk import.
Resolved an issue that prevented users from merging data elements that contained large volumes of personal data associations.
Resolved an issue that caused selected records to be de-selected when users bulk selected all records on the Assets screen.
Resolved an issue that caused non-numeric values to be accepted in the Retention period field, instead of a numerical text attribute.
Resolved an issue that prevented users with the Project Owner role from submitting assessments.
Resolved an issue that caused an ErrorInFetchingServices error to intermittently display for some users when accessing the Inventory details screen.

Existing Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Table Enhancements for Data Mapping Automation

Tables and table functionalities on the Assessments tab of the Inventory details screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

The Projects item on the navigation menu will now be visible to Data Mapping Automation users by default regardless of whether they have permission to view that object. However, users will not be able to view information on the Projects screen without the necessary permissions.
Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Data element merge operations are now processed asynchronously, allowing requests to return immediately and avoid timeouts when merging high volumes of data. This enhancement significantly improves performance, with faster processing and progress tracking available through notifications.

For more information, see Merging Duplicate Data Elements.

The text on theDelete inventorymodal has been updated to more clearly describe what will be permanently deleted when a user deletes an inventory record.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Incident Management - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that caused closed incidents to incorrectly display as Past due.
Resolved an issue that prevented files on the Documents tab of the Incident details screen from being sorted by most recently added.

Existing Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Databreachpedia Updates

The Wisconsin's Insurance Data Security Law 2022 was added to Databreachpedia. It provides requirements for a licensee to notify cybersecurity events to the Wisconsin Insurance Commissioner.
The Vietnam Personal Data Protection Law (2025) was added to Databreachpedia. It provides breach notification requirements for controllers and third parties.
The Sri Lanka Personal Data Protection Act (2022) was added to Databreachpedia. It provides breach notification requirements for controllers.
The South Korea Personal Information Protection Act (PIPA) was updated to reflect the changes to breach notification obligations introduced by an amendment to the PIPA on March 10, 2026. The amendment expands breach notification to cover not only leaks, but also risks of forgery, alteration, destruction, and even potential breaches.
The Spain Organic Law of 5 December 2018 on the protection of personal data and to guarantee digital rights breach law was renamed to Spain Data Protection Act 2018.

Things to Know

: TheIncident NameandIncident Numberattributes are now mandatory fields on theIncident register. These fields cannot be removed or hidden from saved views.
: TheIncident VieworIncident - View Allpermissions are required to view incidents on theIncident registerscreen.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Assessment Automation - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that allowed users to create assessments via the Self-Service Portal using a direct template URL without proper permission checks.
Resolved an issue that prevented bulleted list formatting from displaying correctly in the Description field when saving and reopening the Question builder.
Resolved an issue that prevented changes to Show logic conditions from being saved in the Builder tab of the Template details screen.
Resolved an issue that caused incorrect users to be assigned as section approvers when a reassessment workflow was triggered.
Resolved an issue that prevented the GET /assessment/v2/assessments/{assessment_id}/metadata API from returning the templateVersion response parameter.
Resolved an issue that caused approvers to be removed from the Select section approvers field when they were assigned, preventing users from launching assessments.
Resolved an issue that prevented the Add section approvers upon creation option from displaying in the Actions selection menu after users had selected Organization as a Condition when configuring assessment rules.
Resolved an issue that caused a network error to display after uploading documents to the AI Doc Scanner.
Resolved an issue that prevented section approvers from being copied from previous assessments and assigned an incorrect section approver.
Resolved an issue that prevented all user groups from displaying when users selected the Add section approvers upon creation option in the Actions selection menu when configuring assessment rules.

Existing Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Privacy Risk Agent

|Available with Solution Packaging Only

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Things to Know

Improved data security by implementing stricter access controls on assessment metadata and workflow configurations accessible via theGET /assessment/v2/assessments/{assessment_id}/metadataAPI. Users with limited permissions, such as invited users, will now only see basic assessment details, while advanced metadata and internal workflow structures are restricted to authorized administrators.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Rights Automation - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that prevented result summaries from being shared successfully when multiple users from different organizations uploaded files within the same request.
Resolved an issue that caused request deadline extensions to be calculated incorrectly by including paused time in the maximum extension limit.
Resolved an issue that caused a second required field indicator to display on date fields in web forms when the date field was not configured.
The list of supported values for the verificationType request parameter in the Create Verification Method API has been updated to correctly reflect supported verification method types.
- Removed: AUTOMATED, EXTERNAL
- Added: DEFAULT, KNOWLEDGE, DOCUMENT, EMAIL, PHONE

Accessibility Conformance

Screen readers no longer announce a decorative horizontal separator when in browse mode (WCAG‑A 1.3.1: Info and Relationships).

Things to Know

OneTrust integration workflows are available to support the intake, validation, and fulfillment of Delete Request and Opt-out Platform (DROP) requests for data subjects in California.

For more information, see Delete Request and Opt-Out Platform (DROP) Integration.

Support CCPA opt-out requirements by configuring your web forms to allow opt-out requests to be submitted and processed without identity verification.

For more information, see Configuring Opt-Out Requests for CCPA.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Tech Risk and Compliance

Compliance Automation - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that prevented users from previewing PDF attachments after clicking the file link on the Evidence interval details pane.
Resolved an issue that prevented users from deleting evidence attachments on evidence tasks with a one-time interval.
Resolved an issue that prevented users from downloading evidence attachments on the Evidence interval details pane.
Resolved an issue that prevented the Source column on the Controls tab of the Initiative details screen from sorting correctly.

Existing Public Preview Features

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Standard / Control Framework Changes

New Oklahoma Consumer Data Privacy Act Framework Added

The Oklahoma Consumer Data Privacy Act (OKCDPA), effective January 1, 2027, establishes a comprehensive data privacy framework and mandates transparency and consumer rights regarding personal data collected by for-profit entities conducting business in Oklahoma.

We’ve made implementing the OKCDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant controls, control implementation guidance, and evidence tasks (including guidance) to help you in meeting the requirements of the OKCDPA.

For more information, see Supported Control Frameworks.

New NIS2 Germany Framework Added

Germany’s NIS2 Implementation Act, effective December 6, 2025, transposes the EU NIS2 Directive into German law and strengthens cybersecurity requirements for essential, important, and critical entities operating in Germany. The framework introduces obligations relating to cybersecurity risk management, incident reporting, governance oversight, registration with the Federal Office for Information Security (BSI), and supply chain security.

We’ve made implementing NIS2 Germany easier by offering the framework on our platform and ensuring users can benefit from its overlap with other cybersecurity and information security frameworks that exist on our platform. The platform contains survey questions to help define scope and bring in all relevant controls, control implementation guidance, and evidence tasks, including guidance, to support compliance with Germany’s NIS2 requirements.

Note:

The NIS2 Germany Framework will be available on the OneTrust platform on July 3rd, 2026.

For more information, see Supported Control Frameworks.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Compliance Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

: TheEvidence Approverfield has been added to theUpdate evidence task implementationsbulk import template, making it easier to assign approvers in bulk and improve workflow efficiency.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Enterprise Policy Management - June 26, 2026 - 202606.2.0

Existing Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

Controls
Risks
Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Enterprise Policy Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

: A newCommentslink is now available on theDocument builderscreen, which allows you to add comments to a document for improved collaboration and feedback.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Issues Management - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that cleared required field values on the Issue details screen, including the Name of the issue field when advancing workflow stages.

Existing Public Preview Features

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

IT & Security Risk Management - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that recorded incorrect user details on the Activity tab of the Risk details screen for deleted risk records.
Resolved an issue that prevented the Add control button from responding when adding controls within risks in Third-party risk management assessments.
Resolved an issue that prevented users from filtering controls using custom attributes on the Controls tab of the Inventory details screen.
Resolved an issue that prevented custom reports from displaying the correct control effectiveness data.
Resolved an issue that prevented users with the Data mapping automation manager role moving risk workflow stages in bulk.
Resolved an issue that prevented associated controls from appearing on the Controls tab of the Inventory details screen when risks were created using risk templates.

Existing Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

Create task
Send notification
Update attribute
Generate PDF report
Launch assessment

Stage Settings:

Required attributes and comments upon stage change
Stage approval requirements
Close stage

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Standard / Control Framework Changes

New Oklahoma Consumer Data Privacy Act Framework Added

For more information, see Supported Control Frameworks.

New NIS2 Germany Framework Added

Note:

The NIS2 Germany Framework will be available on the OneTrust platform on July 3rd, 2026.

For more information, see Supported Control Frameworks.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: IT Risk Management (Spring '26 - Current). For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

: When adding a new standard or framework, existing business objectives shared across the new framework and the tenant are updated to the latest name and description (if applicable) while preserving the original organization value.
: The character limit for numerical - single select options for risk attributes has been increased to 400 characters.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Management

Third-Party Risk Management - June 26, 2026 - 202606.2.0

Fixed

Resolved an issue that prevented users from saving added or reordered columns on the Engagement overview screen.
Resolved an issue that impacted users creating assessments via API integrations when using the inventoryTypeName parameter.

Existing Public Preview Features

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Standard / Control Framework Changes

New Oklahoma Consumer Data Privacy Act Framework Added

For more information, see Supported Control Frameworks.

New NIS2 Germany Framework Added

Note:

The NIS2 Germany Framework will be available on the OneTrust platform on July 3rd, 2026.

For more information, see Supported Control Frameworks.

Things to Know

: Hint popovers are now available when configuringEngagementsingle select and multi select attributes to assist with option value selection.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.