All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - June 5, 2026 - 202606.1.0

General Availability

Last Completed Automation Rule for AI Governance Inventories

Configure automation rules to take actions using the new Last Assessment Complete Date - All Templates and Last Assessment Completion Date - By Template conditions. This enhancement enables governance teams to maintain up-to-date inventories and reassess them as needed by triggering automation based on the last assessment completed date for any completed assessment across all templates or a specific template.

For more information, see Configuring Automation Rules for AI Governance. This feature is related to the following idea: AI-I-81.

Fixed

Resolved an issue that attached file extensions (e.g., .ptt, .doc) to the name of documents added to Project inventories and prevented them being opened locally as expected.

New Public Preview Features

AI Guard SDK and Classification

Protect critical AI systems by introducing AI Guard SDK by OneTrust, a comprehensive classification and inspection layer that helps ensure AI interactions are safe, secure, and compliant during development and runtime. This enhancement helps identify PII risks early through advanced data classification, enabling teams to test AI agents and quantify PII risk before moving to production. Integrate easily using the SDK-based approach designed for Python runtime environments, ideal for build-phase validation rather than high-volume, externally facing AI use cases.

For more information, see OneTrust AI Guard SDK Guide.

Observability for Amazon Bedrock

Extend continuous AI monitoring for Amazon Bedrock to gain visibility into AI agent and model activity. This enhancement ongoing governance by capturing agent and model metadata, usage information, evaluation metrics and more directly from Amazon Bedrock powered AI systems as they operate in production.

Additionally, you can detect and measure PII leakage for Amazon Bedrock using the AI Log Analyzer by scanning AI logs stored in Amazon S3, identifying sensitive prompts and responses, and surfacing PII counts in OneTrust for the associated AI assets to reduce risk from non-deterministic AI behavior.

For more information, see the following:

Observability for Microsoft Foundry

Enable continuous monitoring for AI agents and models built on Microsoft Foundry by surfacing Evaluation Metrics for Agents and Models shifting from AI systems. This enhancement helps shift from one-time assessments to ongoing evaluation using live telemetry from Foundry-based AI systems.

For more information, see the following:

Existing Public Preview Features

AI Policy Manager & Seeded AI Policies

Automatically detect AI policy violations across platforms to provide AI governance teams with actionable steps to ensure governance and compliance throughout an AI Agent lifecycle. This policy orchestration experience allows users to create custom policies for unique scenarios and support guardrail enforcement and detection.

To compliment AI policy management, seeded AI policies are also available to flag and provide enforceable steps on guardrails. This reduces the time to value for customers getting started with AI Policies and provides a template for them to use when defining their own custom AI Policies in OneTrust.

For more information, see AI Policies Feature Guide.

Guardrail Detection & Enforcement

Automatically enforce responsible AI policies on violating agents and models across AI development platforms. This enhancement to AI policies provides consistent guardrail visibility and enforcement measures in the OneTrust Platform.

For more information, see AI Policy Enforcement Guide.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt-out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Consent & Preferences

Cookie Consent - June 5, 2026 - 202606.1.0

General Availability

Clearer Opt-Out Signal Notification when GPC is Not Honored

Provide an improved notification on the Persistent cookie settings hover button to notify end users' Global Privacy Control (GPC) signal was detected but is not being honored when using California Consumer Privacy Act (as amended by CPRA) templates. This enhancement improves regulatory compliance by more transparently indicating when detected GPC signals are not honored.

For more information, see Leveraging the Global Privacy Control Signal.

Fixed

Resolved an issue that prevented some previously configured consent preferences from accurately reflecting user configurations when leveraging Cross-Domain and Cross-Device Consent for users in Italy.
Resolved an issue that prevented consent receipts for banner interactions from logging successfully when the Refresh page upon interaction setting was enabled for the banner script.
Resolved an issue that displayed the Strictly Necessary category as selectable when the preference center was configured with checkboxes instead of toggles.
Resolved an issue that caused loading and performance issues on some webpages when cookies were manually deleted from browser storage after users interacted with the preference center.
Resolved an issue that prevented the scanner from successfully detecting all relevant cookies on domains due to banner timeouts.
Resolved an issue that prevented updates to translations from being logged as a change on a template's Version history pane.
Resolved an issue that prevented users from enabling the Show reject all button setting when modifying existing IAB TCF templates.
Resolved an issue that prevented some text on the CMP from successfully translating to Albanian (SQ).
Resolved an issue that added new vendors as active even when the Add New Vendors as Inactive setting was enabled for a vendor list.
Resolved an issue that displayed invalid scan statuses for in-progress scans. Scans now display a status of Scanning when performing a scan.

Existing Public Preview Features

Enhanced Tracking Technologies Interface

Leverage the new Tracking technologies interface to log and categorize tracking technologies on your websites or SDKs. This feature improves the existing Tracking technologies interface and enhances insight into your websites' or apps' tracking technologies by linking them to known vendors and hosts.

For more information, see Managing Tracking Technologies. This feature is related to the following ideas: CONTENT-I-81, PDGI-I-1592, CSC-I-9, PDGI-I-1739, OT-I-14035.

Note:

This feature was previously available as Vendor Identification, Categorization, and Consent.

CMP Governance through Ownership

Automatically define default owners for your websites and applications when configuring scans. This enhancement enables you to configure users within OneTrust who are notified of updates to the CMP configuration on specific websites and are responsible for managing these changes.

For more information, see Scanning a Website. This feature is related to the following ideas: CONTENT-I-320, OT-I-6353, PDGI-I-899, PDGI-I-1505, CSC-I-125.

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Website Scan Observability

Access the new scanner Job queue to review scan statuses and start times for each of your scanned domains. This feature provides a higher degree of insight into each of your scans, enabling you to more easily monitor scan progress and diagnose failures.

For more information, see Scanning a Website. This feature is related to the following ideas: OT-I-514, OT-I-4946, OT-I-12712, OT-I-15978, PDGI-I-595.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

Content across the banner and preference center now displays correctly when the screen zoom level is set to 400% (WCAG-AA 1.4.10: Reflow).
When users apply filters on the preference center, each filter criterion and its associated checkbox now receives focus and is announced as a single selectable item instead of two distinct fields (WCAG-A 4.1.2: Name, Role, Value).
The OneTrust CMP has been enhanced to allow screen readers to announce the entirety of descriptive content when focus lands on the banner. This enhancement preserves the correct reading order and provides a complete, meaningful announcement (WCAG-A 1.3.1: Info and Relationships).

Things to Know

: The Google Tag Manager (GTM) integration with the OneTrust CMP now supports the authenticated consent script URL required for authenticated consent deployments when leveraging cross-domain consent.
: Resolved an issue where deleted or “Manage Not Found” cookies would continue to appear in the Unpublished count after publishing. Auto-Block now removes those outdated source records correctly so Unpublished counts and filters stay accurate after delete and publish actions.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Mobile & OTT/CTV App Consent - June 5, 2026 - 202606.1.0

Fixed iOS

Resolved an issue that cleared and inconsistently rewrote IAB TCF consent strings during SDK initialization.

Fixed Apple TV

Resolved an issue that prevented focus from consistently applying to elements on the CMP when configured in a right-to-left language or layout.

New Public Preview Features

Enhancements to Consent Management Platform APIs

The following enhancements have been made to the Consent Management Platform (CMP) APIs:

Updated the Log Consent API to include the OT-Explicit-Consent header parameter to allow sending only explicit consent choices rather than consent to all purposes tied to the CMP collection point. When OT-Explicit-Consent: true, consent will be logged only for the purpose for which consent was updated. When OT-Explicit-Consent: false, consent will be logged for all purposes.

Note:
This parameter is currently supported only for the UC_PREFERENCE_CENTER_CONFIRM interaction type.
Updated the Get Universal Consent Purposes API to include the lastConsentedDate response parameter. The lastConsentedDate will be returned for each purpose for which consent was given.
Updated the Get Universal Consent Purposes API to include the following parameters within the storageKeys object of the response:
- OT_GroupConsents
- OT_GroupLIConsents
- OT_SdkConsents
- OT_GeneralVendorsConsents
- OT_LastConsentedDate
Updated the Get Banner Data, Log Consent, and Get Preference Center Data APIs to include the OT_UCPConsents parameter within the storageKeys object of the response.
Updated the consent transaction types sent when logging Universal Consent preferences using the Log Consent API.
- For first-time consent:
  - If consent is given for a purpose with or without options selected, the transaction type will be CONFIRMED.
  - If consent is not given for a purpose, the transaction type will be OPT_OUT.
- If consent was previously given for a purpose and is given again, the transaction type will be CONFIRMED.
- If consent was previously given for a purpose but is later removed, the transaction type will be WITHDRAWN.
- If consent was previously given for a purpose and the user modifies topics or custom fields, the transaction type will be CHANGE_PREFERENCES.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

iOS
Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

This feature is available for the following platforms:

iOS
Android
Apple TV
Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

Android
Android TV
Apple TV
HTML5
iOS
Roku
Unity
Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Notice Management - June 4, 2026 - 202606.1.0

Fixed

Resolved an issue that prevented the Activity tab and Workflow and approval tab from loading and displaying successfully on the Privacy notice details screen.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Universal Consent & Preference Management - June 5, 2026 - 202606.1.0

General Availability

Search for Data Subjects by Data Element

The following new APIs are now available for use when searching for data subjects using a specific data element:

The Create Custom Index API and Get Index Creation Status API are now available to manage the creation of custom search indexes for data elements. These APIs allow you to trigger the creation of a custom index to optimize search performance using the indexed data element value.
The new Search Data Subjects by Data Element API is now available to search for data subjects based on a specific data element name and value. This API allows you to quickly locate and manage data subjects based on their stored data element attributes.

This enhancement delivers faster, more scalable consent retrieval to return the consent status for a family account and its associated child identifiers, reducing front-end complexity and improving performance.

Fixed

Resolved an issue that recorded some data subject profiles as expired due to a delay in profile creation after importing consent receipts in bulk.
Resolved an issue that caused the Get List of Receipts API to display a 400 error when a receipt lookup was performed for a data subject identifier that did not exist. The API now returns "content": [] for non-existent identifiers.
Resolved an issue that prevented rules on hosted web form collection points from performing successfully if multiple conditions were applied to the same object.

Existing Public Preview Features

Unsubscribe/Subscribe Sections for the Trust Center

Add an Unsubscribe / pause section and Subscribe section to Trust Center pages that contain Consent preferences sections to allow end users to easily disable or enable purposes and preferences. You can also provide a survey to allow users to document their reasons for unsubscribing and a Pause button so users can disable notifications without unsubscribing.

For more information, see Adding Consent Preferences and Data Element Sections to the Trust Center. This feature is related to the following ideas: CSC-I-160, OT-I-1667, UCPMXP-I-14.

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Use Governance

Data Catalog - June 5, 2026 - 202606.1.0

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Discovery - June 5, 2026 - 202606.1.0

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Things to Know

Improved the performance of the following classifiers to help reduce false positives with decimal numbers:

Full Name
Postal Code
Latitude
Credit Card

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Platform Capabilities

Dashboards & Reporting - June 5, 2026 - 202606.1.0

Fixed

Resolved an issue that prevented users from copying the Compliance Automation default dashboard when accessed via the Dashboards menu in Dashboards & Reporting.
Resolved an issue that prevented issue workflow stage filters from returning correct results in Issue column reports.
Resolved an issue that caused missing cells and incorrect risk values to appear in Heatmap widgets when viewing dashboards in lower organizations.
Resolved an issue that allowed users without edit permissions to export Insights dashboards.
Resolved an issue that prevented large Insights column and PDF report exports from completing successfully.

Existing Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

AI Governance inventories:
- AI systems
- Datasets
- Models
- Projects
Assessments
CMP time series
Consent time series
Contracts
Controls / Control implementations
Engagements
Incidents
Inventories:
- Assets
- Entities
- Processing activities
- Vendors
Issues
Privacy requests and subtasks
Risks

Note:

This feature does not currently support consent data subject details.

For more information, see Using Conversational Analytics Insights Chatbot.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Global Data Manager - June 5, 2026 - 202606.1.0

Things to Know

Following the OneTrust Spring '26 Release, OneTrust is conducting a data migration to populate the new Purpose of Processing attribute with customer's historical (Legacy) data across the platform. Customers should contact OneTrust to opt into the migration. For more information, see our myOneTrust Community post.

Integrations - June 5, 2026 - 202606.1.0

Existing Public Preview Features

AI-Powered Individual Log Error Analysis

|Available with Solution Packaging Only

Identify failed actions with AI-powered error summaries, root cause explanations, and actionable recommendations inside the log. This allows you to see exactly which workflow step failed, the type of error, and suggested next steps, which enables you to resolve issues faster and more confidently.

For more information, see Using Integration Logs.

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the new Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Settings & Administration - June 5, 2026 - 202606.1.0

Fixed

Resolved an issue that prevented all expected records from appearing on the Permissions section of the Roles screen when applying a filter on the Action value.

Existing Public Preview Features

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

Leverage our Third-Party Risk Agent in Copilot to conduct deep research to automate and accelerate the onboarding of new vendors and launch inherent risk assessments. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Assessment Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

Task Add Attachment
Task Add Comment
Task Created
Task Deleted
Task Remove Attachment
Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

Platform Organization Menu Enhancements: OneTrust has updated the Organization menu in the Global Header to improve navigation and visual clarity. The redesigned menu introduces a nested list layout for viewing organizational hierarchies while also providing the option to switch to a flat list view.

Note:
After switching organizations, reopening the Organization menu may not display the full organizational hierarchy. This issue will be resolved in an upcoming release.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Automation

DataGuidance - June 5, 2026 - 202606.1.0

General Availability

Privacy Index Comparison Download

Export custom views of comparisons in the Privacy Index to either an excel or an image for external sharing and reporting. This enhancement allows you to export a subset of comparison data from the Privacy Index without exporting the entire table.

For more information, see DataGuidance Privacy Index.

Fixed

Resolved an issue that prevented links in the excel export of Comparison view from opening to the expected anchor heading in Guidance Notes.

Data Mapping Automation - June 5, 2026 - 202606.1.0

Fixed

Resolved an issue that prevented some third parties added via bulk import from progressing from a Pending status to an Active status, if there was already an existing record with a similar name.
Resolved an issue that prevented some users in a sibling organization from viewing Global records belonging to its root organization.
Resolved an issue that redirected some users to the Employee Portal when selecting View all for related vendors from the Details tab of the Processing activity screen.

Existing Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Table Enhancements for Data Mapping Automation

Tables and table functionalities within Data Mapping Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

Data lineage screen
Assessments tab of the Inventory details screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Bulk updating of inventory records now requires an<EMPTY>placeholder to intentionally clear an optional field. Blank values will no longer overwrite existing data.

For more information, see Bulk Updating Inventory Records.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Incident Management - June 5, 2026 - 202606.1.0

General Availability

Enhancements to Incidents APIs

The following enhancements have been made to the Incidents APIs:

Updated the Get Incident API and Update Incident API to include the attributeName parameter within the attributeValues object of the response. This enhancement enables clearer identification and mapping of returned attributes.
Updated the behavior of the Update Incident API. Previously, if existing attribute values were not included in the request, they would be overwritten by empty values. With this enhancement, existing attribute values will no longer be overwritten and will now be retained even if those attribute values are not included in the request.

Fixed

Resolved an issue that prevented Incident register custom saved views from preserving the sorting and filtering configured by users.
Resolved an issue that prevented users from searching the Incident register by custom text fields.
Resolved an issue where guidance content for China and Saudi Arabia were not updating correctly.

Existing Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Dynamic Incident Notification Assessment (DINA) Updates

DINA 1.2.1 introduced the following changes to key questions under the General Incident Details section:
- Updated the "Did the incident result in real or potential harm to individuals?" question.
- Updated the "Did the incident result in a breach of security?" question.
- Updated answer options and rule configurations across multiple jurisdictions to improve guidance accuracy.
DINA 1.2.1 added the following jurisdiction-specific questions:
- "Does the incident result in harm to personal data?" (Saudi Arabia PDPL)
- "Did the incident result in harm to a legal entity?" (cybersecurity guidance under NIS2 Implementing Laws and the India IT Act)
- "Did the incident result in an offense or contravention of law?" (India IT Act)

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Assessment Automation - June 5, 2026 - 202606.1.0

Fixed

Resolved an issue that prevented users from adding additional respondents to an assessment when the original respondent remained assigned.
Resolved an issue that prevented the Edit section assignment link in the Edit details popover from working when accessed via the Context menu on the Assessments screen.
Resolved an issue that prevented the Discard draft button from displaying when viewing an assessment template in Draft status, due to a spelling error in the permission name.
Resolved an issue that caused a message to incorrectly display claiming OneTrust Copilot could not find related assessments to generate an answer, even when uploaded documents and existing answers were available.
Resolved an issue that caused the AI auto-responses for assessments feature to suggest responses to Object attribute questions, even though this question type is not supported.

Existing Public Preview Features

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Privacy Risk Agent

|Available with Solution Packaging Only

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Template Updates

OneVendor Full v6.4 Change Log

The Oklahoma Consumer Personal Data Privacy Act establishes a comprehensive framework governing the processing of personal data of Oklahoma residents, setting clear requirements for transparency, purpose limitation, and accountability. It imposes core controller obligations such as transparency (privacy notices), data minimization, security safeguards, and consent for processing sensitive data. Processor duties, contractual requirements, and data protection assessments are also required, broadly aligning with other U.S. state privacy frameworks. The law also grants consumers enforceable rights over their personal data. Customers interested in compliance with this framework are impacted by this release.

The following is the change log for this release:

The Welcome Text was updated to account for the Oklahoma Consumer Data Privacy Act.
Added a new answer option to question 3.1 to account for the newly introduced framework.
Added a new answer option to question 3.3.
Created a new Vendor Contract (US) rule.
Updated conditional logics throughout the template to account for the newly introduced framework.

OneVendor Lite v6.4 Change Log

The following is the change log for this release:

The Welcome Text was updated to account for the Oklahoma Consumer Data Privacy Act.
Added a new answer option to question 2.3 to account for the newly introduced framework.
Updated conditional logics throughout the template to account for the newly introduced framework.

OnePIA (Full) - 7.5 Change Log

Also, this release brings the existing Connecticut content in this questionnaire in line with bill SB1295, which enters into force in July 2026 and amends the CTDPA. Customers interested in compliance with this framework are impacted by this release. The following is the change log for this release:

The Welcome Text was updated to account for the Oklahoma Consumer Data Privacy Act.
Updated conditional logics throughout the template to account for the addition of the jurisdiction listed above.
Updated question 3.1 on applicable laws.
Updated conditional logics of question 4.37.
Updated conditional logics of question 5.14.
Updated conditional logics of question 6.16.
Fixed conditional logics of question 6.6.
Updated friendly title, conditional logics, and description text of question 6.12.
Updated description text of question 7.9.
Updated conditional logics of questions 8.2 to 8.6.
Created new question 6.11 - Rights Related to Profiling.
Created new question 8.10 - Reasonable Expectations of the Consumer(s) (US).
Created new question 8.11 - Relationship With the Consumer(s) (US).
Created new question 8.12 - De-identified Data Processing (US).
Created new ‘Data protection assessment content requirements (US)’ rule.
Updated ‘High Risk (US)’ rule.
Updated ‘Privacy Rights’ rule.

OnePIA (Lite) - 7.5 Change Log

The Welcome Text was updated to account for the Oklahoma Consumer Data Privacy Act.
Updated question 1.2 on applicable laws.
Added new answer options to question 4.2 on privacy rights.
Created new conditional logics in question 1.5 on high-risk activities.
Updated ‘Privacy Rights’ rule.
Updated ‘High Risk (US)’ rule.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Rights Automation - June 5, 2026 - 202606.1.0

Fixed

Resolved an issue that caused a confirmation message to display instead of an email verification prompt after a data subject submitted a web form that had been imported.
Resolved an issue that prevented custom messages from displaying when web form submission was disabled by a submit button visibility rule.

Things to Know

Support CCPA opt-out requirements by configuring your web forms to allow opt-out requests to be submitted and processed without identity verification. For more information, see:Configuring Opt-Out Requests for CCPA.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Tech Risk and Compliance

Compliance Automation - June 5, 2026 - 202606.1.0

Fixed

Resolved an issue that prevented Evidence library exports from displaying associated control GUIDs.

Existing Public Preview Features

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Standard / Control Framework Changes

Virginia Consumer Data Protection Act (VCDPA) Framework Updated

Framework content updated to align with the latest amendment to the Virginia Consumer Data Protection Act (VCDPA), signed into law on April 13, 2026, which introduces new restrictions on the sale of precise geolocation data. The updated Virginia Consumer Data Protection Act (VCDPA) framework is now available on Compliance Automation, ITRM, and TPRM products.

For more information, see Supported Control Frameworks.

Utah Consumer Privacy Act (UCPA) Framework Updated

Framework content updated to align with the latest amendment to the Utah Consumer Privacy Act (UCPA), enacted through HB 418 (2025), which introduces a new consumer right to request correction of inaccurate personal data. The updated Utah Consumer Privacy Act (UCPA) framework will be available on Compliance Automation, ITRM, and TPRM products on June 4, 2026.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Enterprise Policy Management - June 5, 2026 - 202606.1.0

Fixed

Resolved an issue that caused workflow stages to change unexpectedly when no rules were configured in exception workflows.
Resolved an issue that prevented policy and standard exports from displaying the Visible to all users in document library field responses.

Existing Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

Controls
Risks
Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Issues Management - June 5, 2026 - 202606.1.0

Existing Public Preview Features

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Issues Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

IT & Security Risk Management - June 5, 2026 - 202606.1.0

Fixed

Resolved an issue that caused the Update library evidence tasks bulk import template to fail with a generic import error.
Resolved an issue that caused exported Issue register views to include unfiltered data instead of the selected saved view results.
Resolved an issue that caused control source values to display inconsistently as either the Risk name or Risk ID.
Resolved an issue that prevented users from adding control approvers to control implementations.
Resolved an issue that prevented documents uploaded to issue records from retaining the original file type.
Resolved an issue that caused mismatched values for control effectiveness attributes between the user interface and exported column reports.
Resolved an issue that prevented users from adding or opening control implementations on a legal entity record.
Resolved an issue that prevented users from saving updates to formulas for existing custom attributes.
Resolved an issue that caused incorrect risk score names to appear when hovering over risk score attributes.
Resolved an issue that prevented associated controls from appearing on the Controls tab of an asset when risks were flagged using risk templates.

Existing Public Preview Features

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow List Screen

column sorting, search, activation, archival

Routing Rules

workflow assignment upon object creation

Workflow rules

Advance stage renamed to change stage

Available default stage actions:

Create task
Send notification
Update attribute
Generate PDF report
Launch assessment

Stage Settings:

Required attributes and comments upon stage change
Stage approval requirements

For more information, see Managing Risk Workflows.

Mark Risk Workflow Stage as Closed

Leverage the new Close stage setting in Risk workflows to set a specific stage at which the record will be closed. This enhancement allows you to close risks as part of your workflow transitions at a desired point in the workflow rather than advancing to completed. By default, the record will be closed in the last workflow stage.

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Standard / Control Framework Changes

Virginia Consumer Data Protection Act (VCDPA) Framework Updated

For more information, see Supported Control Frameworks.

Utah Consumer Privacy Act (UCPA) Framework Updated

For more information, see Supported Control Frameworks.

Things to Know

: Category-based score evaluations for engagement and inventory attributes are now supported in formula-based risk score calculations. The aggregated risk score and category scores will be displayed on theRiskstab of the correspondingInventory detailsscreen.
: TheReason for closureattribute can now be selected as a condition to trigger risk automation rules.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Management

Third-Party Risk Management - June 5, 2026 - 202606.1.0

Fixed

Additional checks have been added to eliminate duplication of the Launch assessment workflow stage rule action.

Existing Public Preview Features

Third-Party Risk Agent in Copilot

|Available with Solution Packaging Only

For more information, see OneTrust Third-Party Risk Agent Feature Guide.

Custom Notifications for Assessment Templates

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

For more information, see Leveraging AI Auto-responses for Assessments.

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Standard / Control Framework Changes

Virginia Consumer Data Protection Act (VCDPA) Framework Updated

For more information, see Supported Control Frameworks.

Utah Consumer Privacy Act (UCPA) Framework Updated

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.