All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - March 13, 2026 - 202603.1.0

General Availability

Bulk Sending of AI Governance Assessments Based on User Type Attribute

Bulk send assessments based on user type attributes to help streamline AI Governance manager workflows. This enhancement relies on user type attributes, system and custom, to assign respondents and approvers to specific assessments instead of having to assign individual users.

For more information, see Launching Assessments for AI Governance.

New Task Management APIs

The following APIs are now available for use to create new review or remediation tasks tied to AI entities with full details, retrieve complete histories of tasks, and update an existing task’s status, assignee, priority, or collaborator list. These APIs give users a programmatic view of task progress and automation for their organization.

Note:

These APIs will become available as customer tenants are migrated to enhanced AI Governance Services. For more information and rollout schedules, see AI Governance Services Upgrade Notice.

New Attribute Management APIs 

The following APIs are now available for use to set attribute activation statuses, add custom attributes to schemas, and add custom options to attributes. These APIs allow users to easily manage AI Governance attributes in bulk for use in their inventories.

Note:

These APIs will become available as customer tenants are migrated to enhanced AI Governance Services. For more information and rollout schedules, see AI Governance Services Upgrade Notice.

New Relationship Management APIs

The following APIs are now available for use to create and remove relationship records between entities, as well as return relationship record metadata and details. These APIs enable users to map and manage lineages between entities in AI Governance.

Note:

These APIs will become available as customer tenants are migrated to enhanced AI Governance Services. For more information and rollout schedules, see AI Governance Services Upgrade Notice.

New Entity Type Management APIs

The following APIs are now available for use to retrieve details and metadata of a single entity type or a complete list of active entities in AI Governance inventories.

Note:

These APIs will become available as customer tenants are migrated to enhanced AI Governance Services. For more information and rollout schedules, see AI Governance Services Upgrade Notice.

New Entity Management APIs

The following APIs are now available for use to create and delete entities, as well as retrieve and update their metadata and details. These APIs enable users to conduct full management of their entities in AI Governance.

Note:

These APIs will become available as customer tenants are migrated to enhanced AI Governance Services. For more information and rollout schedules, see AI Governance Services Upgrade Notice.

New Entity Workflow Management API

Added the Update Entity Workflow Stage API to update the workflow stage of an entity. This API allows users to advance the workflow of an entity to a specific workflow stage with optional rule-execution flags.

Note:

This API will become available as customer tenants are migrated to enhanced AI Governance Services. For more information and rollout schedules, see AI Governance Services Upgrade Notice.

Fixed

  • Resolved an issue that prevented AI System inventories from appearing in a parent organization when a child organization was deleted.

  • Resolved an issue that prevented the file export of AI Governance inventories.

  • Resolved an issue that caused attachments to be uploaded multiple times to Project, AI system, Model, and Dataset tasks that were either previously opened or actively open in the Tasks pane within AI Governance.

Existing Public Preview Features

AI Governance Inventory Global/Local Functionality

|Available with Solution Packaging Only

Establish standardized global records for AI systems, models, and datasets while maintaining contextual, local records across business units, use cases, and lifecycle stages. This capability lets teams track AI asset evolution through a clear audit trail, enforce standardized attributes at the global level, and manage jurisdiction-specific or use case-specific requirements at the local level.

For more information, see AI Governance Global/Local Feature Guide. This feature is related to the following ideas: AI-I-31, PDGI-I-1416

Amazon Bedrock AI Model & Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Amazon Bedrock accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Databricks Unity Catalog AI Models, Agents, and Datasets Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models, agents, and datasets in your Databricks accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

GCP Vertex AI Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Google Cloud accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

SageMaker AI Model Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models in your SageMaker accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Azure Foundry Model and Agent Detection

|Available with Solution Packaging Only

Automatically scan cloud environments, APIs, pipelines, and applications to detect active AI models and agents in your Azure Foundry accounts. This feature captures metadata including model type, owners, input/output behavior, and associated datasets, providing a real-time, searchable inventory that serves as the foundation for governance policies, risk assessments, and audit trails.

For more information, see AI Automation Feature Guide.

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Permissions

Standard / Control Framework Changes

New Colorado AI Act Framework Added

The Colorado Artificial Intelligence Act is the first comprehensive U.S. state law focused on consumer protections and accountability in the use of AI systems, with its core obligations centered on high-risk AI systems used in consequential decision-making. Effective June 30, 2026, it introduces requirements relating to reasonable care, risk management, impact assessments, transparency, consumer notices, and appeal rights, while also including broader disclosure obligations for certain AI systems that interact with consumer.

We’ve streamlined Colorado AI Act compliance by offering the full framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned with the law’s requirements for developers, deployers, and qualifying small deployers. The framework is designed to help organizations operationalize governance for AI systems and support defensible compliance with the Act’s accountability and transparency requirements.

Important:

The Colorado AI Act Framework will be available on the OneTrust Platform effective March 20, 2026.

For more information, see Supported Control Frameworks.

Things to Know

OneTrust is planning to upgrade all environments to the new AI Governance Services, which provide improved permission granularity, expanded inventory support, foundations for agent governance, and a more unified management experience through the Inventory Manager. For more information and rollout schedules, seeAI Governance Services Upgrade Notice.

OneTrust is planning to unify the export output of AI Governance inventories to standardize values forSystem usersattributes. This change will replace the user's display name (e.g. John Smith) in favor of their email address (e.g. john.smith@onetrust.com) across all inventory types. Currently the platform has mixed behavior across the available inventory times, leading to import failures where the schema expects email address for these user fields.

Tenants will be automatically updated with this enhancement in the OneTrust 202604.2.0 release.

Added related entity support in AI Governance column reports to report on Risks and Controls.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Consent & Preferences

Cookie Consent - March 13, 2026 - 202603.1.0

General Availability

Activity Log for Compliance Assistant Changes

|Available with Solution Packaging Only

Review changes to your Compliance Assistant configurations by clicking the View activity button on the Compliance settings screen. This enhancement enables you to review changes that were made to your configurations along with the user who made them.

For more information, see Leveraging CMP Compliance Assistant.

Add SRI Hash to Scripts

Publish scripts with an additional subresource integrity (SRI) hash when the Use distinct script source URL setting is enabled on the Publish pane. This enhancement improves your ability to enforce security without causing interruptions to production.

For more information, see Publishing and Implementing Cookie Consent Scripts.

Fixed

  • Resolved an issue that produced console errors for Content Security Policies (CSPs) when loading otBannerSdk.js.

  • Resolved an issue that prevented the CMP from displaying in the correct regional variant when browser language detection was enabled.

  • Resolved an issue that allowed users to add sources to the Auto-Block tab associated with Strictly Necessary and Unknown purposes.

  • Resolved an issue that prevented the scanner from completing website scans successfully if the sitemap provided in the scan configuration was not based in XML.

  • Resolved an issue that caused templates configured in Slovenian (sl) to display in Slovakian (sk).

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

  • Delaware

  • Iowa

  • Nebraska

  • New Hampshire

  • New Jersey

  • Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

  • Identify known vendor services when scanning your websites.

  • Categorize the vendor services active on your websites.

  • Link tracking technologies to identified vendor services.

  • Allow end users to configure consent for vendor services on the Preference Center.

  • Capture records of consent at the vendor service level.

  • Configure IAB templates to capture and disclose vendor service information.

  • View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

  • Screen readers now successfully announce Global Privacy Control (GPC) confirmation messages to indicate opt-out signals have been honored (WCAG-A 4.1.2: Name, Role, Value).

Things to Know

Subdomain Management is now compatible with locally hosted scripts.

For more information, see Scanning a Website and Publishing and Implementing Cookie Consent Scripts.

Legacy dashboards have been fully deprecated. You can now leverage the Insights Dashboard for reporting and analytics related to your CMP.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Mobile & OTT/CTV Consent - March 13, 2026 - 202603.1.0

Fixed Admin

  • Resolved an issue that prevented some text styling configurations on mobile app templates from matching their web version.

Fixed Android

  • Resolved an issue that prevented the startSDK call from correctly initializing and authenticating the user profile, and consent log requests made after the startSDK call were not sent as expected.

  • Resolved an issue that prevented users from customizing the Close button in the preference center using JSON theme configuration.

  • Resolved an issue that caused apps to quit unexpectedly if the preference center description was configured as empty.

Fixed iOS

  • Deprecated NSCoding functionalities have been fully removed from the SDK.

  • Resolved an issue that caused the scanner to recategorize SDKs to their default category.

  • Resolved an issue that prevented SDK descriptions from displaying in the preference center.

Fixed APIs

  • Resolved an issue that caused Always Active categories to display as rejected in the IABUSPrivacy_String parameter within the storageKeys object of the response if users set the interactionType request parameter to BANNER_REJECT_ALL when leveraging the Log Consent API.

Fixed HTML5

  • The SDK has been updated to remove localStorage.clear() and prevent the erasure of other variables.

New Public Preview Features

Enhancements to Consent Management Platform APIs

The following enhancements have been made to the Consent Management Platform (CMP) APIs:

  • The Log Consent API now supports authentication when the Require authentication for known users setting is enabled in geolocation rules. This enhancement allows you to secure API calls when logging consent.

  • Updated the Log Consent API to return error codes and more detailed error messages when the body JSON is left empty.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

  • iOS

  • Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

  • iOS

  • Android

  • Apple TV

  • Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

  • Android

  • Android TV

  • Apple TV

  • HTML5

  • iOS

  • Roku

  • Unity

  • Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Accessibility Conformance

  • Screen readers now correctly announce checkbox list elements in the SDK and Vendor lists within the Preference Center as "checked" or "unchecked" on LG TV devices (WCAG-A 1.3.1: Info and Relationships).

Things to Know

HTML tags for line breaks within CMP templates are now supported for the Roku SDK.

Scan results for scans launched prior to 202602.1.0 will now display with the legacyScan resultsinterface.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Universal Consent & Preference Management - March 13, 2026 - 202603.1.0

General Availability

Bulk Add Purposes

Add purposes to data subjects in bulk using the new DATA_SUBJECTS_BULK_ADD_PURPOSE export type when leveraging the Create Bulk Export API. The following parameters were also added in the params object of the request to support this new export type:

  • The sourcePurposeGuid parameter was added to allow users to specify the GUID of the new purpose to be added and to which the status will be copied.

  • The targetPurposeGuid parameter was added to allow users to specify the target purpose GUID to which to copy status.

  • The defaultStatus parameter was added to allow users to specify the target purpose status when the source purpose is not found.

  • The collectionPointJWT was added to allow users to specify the collection point JWT to use for the import.

Fixed

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

Full names of purposes now display on the Trust Center when accessed from mobile browsers. Any purpose names longer than two lines are truncated and can be expanded using aShow morelink.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Data Use Governance

Data Catalog - March 13, 2026 - 202603.1.0

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16. For more information, see the following:

Data Governance Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Governance Insights Dashboard to analyze data captured across Data Catalog. This dashboard can be used to view essential information about your data assets, manage your data and associated metadata in response, and enact policies and procedures necessary for proper data governance.

For more information, see Insights Data Governance Dashboard.

Access Intelligence Insights Dashboard

Now enabled for every Data Catalog customer, data governance managers can now utilize highly customizable reporting and analytic capabilities using the Access Intelligence Insights Dashboard that collects data captured by Data Catalog and Data Discovery. This dashboard can be used to understand what sensitive data you have and how it is shared across the company so admins can quickly identify data-related risks present in your data ecosystem.

For more information, see Insights Access Intelligence Dashboard.

Note:

This dashboard is available by default only for Data Catalog customers.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Data Discovery - March 13, 2026 - 202603.1.0

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Data Discovery Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Discovery Insights Dashboard to analyze data captured across the module. This dashboard can be used to view information about job insights, scan metrics, worker node progress, and more related to your discovery business outcomes.

For more information, see Insights Data Discovery Dashboard.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Platform Capabilities

Dashboards & Reporting - March 13, 2026 - 202603.1.0

Fixed

  • Resolved an issue that caused HTML markup to be included in Excel exports for custom PIA & DPIA Automation reports.

  • Resolved an issue that caused the Last sync date on the Reports list screen to be outdated or inconsistent.

  • Resolved an issue that prevented Insights Dashboards from loading as expected when custom attributes with special characters were configured.

  • Resolved an issue that prevented Insights Dashboards from exporting to PDF when the dashboard name contained special characters.

  • Resolved an issue that caused report exports to fail and remain in the Open status.

Existing Public Preview Features

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

  • AI Governance inventories:

    • AI systems

    • Datasets

    • Models

    • Projects

  • Assessments

  • Contracts

  • Controls / Control implementations

  • Engagements

  • Inventories:

    • Assets

    • Entities

    • Processing activities

    • Vendors

  • Privacy requests and subtasks

  • Risks

For more information, see Using Conversational Analytics Insights Chatbot.

Insights Dashboards

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following seeded dashboards are available under Public Preview:

Expanded Custom Attributes for Privacy & GRC Insights Dashboards

Track additional metrics by adding up to 10 custom attributes to each tab on custom Insights Dashboards created using the Privacy and Governance, Risk, Compliance data sources. This enhancement provides more flexibility in customizing your Insights Dashboards, allowing you to visualize unique data points relevant to your organization’s business context.

For more information, see Using Object-Based Attribute Tables for Custom Insights Dashboards.

Insights Dashboard Updates

  • The Assessment open age and Assessment open age range columns have been added to the Measures and Attributes folders in the following data tables:

    • Assessment

    • Assessment Related Control Implementation

    • Risk Related Assessment

  • The Assessment Profile Score data table has been added to Insights Dashboards to report on score profile data at the assessment level. The data table has been added for Insights Dashboards created using the following data sources:

    • Data Mapping Automation, Risk

    • Governance, Risk, Compliance

    • IT & Security Risk Management

    • PIA & DPIA Automation, Risk

    • Privacy

    • Third-Party Risk Management

    Note:

    The ability to report on score profile data at the question level is not yet supported.

  • The Inventory Personal Data Association Attributes Configuration and Inventory Personal Data Association Attribute Value for Graphics & Slicers to enable more flexible reporting and filtering of personal data. The data table has been added for Insights Dashboards created using the following data sources:

    • Data Mapping Automation, Risk

    • Governance, Risk, Compliance

    • IT & Security Risk Management

    • Privacy

    • Third-Party Risk Management

Things to Know

The newConversational analyticssetting inGlobal Settingsmust be enabled to allow Copilot to generate data visualizations when answering conversational analytics questions, using tenant records, usage data, and trends aligned with your existing roles and permissions. This is related to the existingConversational Analytics Insights Chatbotpreview feature.

Insights dashboards are not supported in Sandbox accounts.

Insights as Default for Net New Customer Accounts

Starting in the OneTrust 202410.1.0 release, Insights Dashboards will be the default dashboard experience for all new OneTrust accounts. Users within new OneTrust accounts created after the respective environment is upgraded to 202410.1.0 will now see Insights Seeded Dashboards when available for a given module. Legacy dashboards will only appear for modules that do not currently have an Insights Seeded Dashboard. Existing accounts that already have access to Legacy Dashboards will not be affected by this change.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Settings & Administration - March 13, 2026 - 202603.1.0

General Availability

Flag New Permissions - Improvements

Improvements have been made to the Flag New Permissions in the System feature to improve clarity on actions taken when managing recently added permissions. The following enhancements are now available on the Recently added permissions tab of the Roles screen within Global Settings:

  • The Applied and Dismissed statuses have been replaced by the new Reviewed status. All permissions that were previously marked as either Applied or Dismissed have been automatically updated with the Reviewed status.

  • The Dismiss button has been replaced with the new Mark as Reviewed button, and the Dismiss permissions modal has been removed. When a permission is marked as reviewed, the status will be updated to Reviewed and the user's name will appear in the Last reviewed by column.

  • The Roles tab on the Details pane has been renamed to the Updated roles tab. The Source column has also been added to this tab to indicate whether the roles updated with the permission are system or custom roles.

These enhancements provide a more streamlined and auditable workflow for reviewing newly added permissions, making it easier to understand actions taken and the roles impacted.

For more information, see Managing Recently Added Permissions.

Fixed

  • Added support for manager.value on the Modify User API when updating the manager for a user via the SCIM PATCH API method.

  • Resolved an issue that prevented Site admins within the root organization from creating a new root organization if they were granted the Site admin role through a user group assignment.

  • Resolved an issue that prevented certain child organizations from being deleted.

  • Resolved an issue that prevented Site admins from deleting a sandbox account and withdrawing pending deletion of a sandbox account if they were granted the Site admin role through a user group assignment.

  • Resolved an issue that caused errors with the SCIM Get List of Users API and prevented the User information tab from loading in the platform when an invalid manager was listed for the user.

  • Resolved an issue that caused more than the last seven days of email activity to appear on the Email activity tab of the Email settings screen. Only the past seven days of email activity is saved on this tab as expected.

  • Resolved an issue that prevented email links from navigating invited users to the expected screen in the platform when the Turn on OTP verification for invited users setting was enabled.

  • Resolved an issue that allowed users to advance the stage of a cloned workflow even when there were required tasks that had not been completed.

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

  • Task Add Attachment

  • Task Add Comment

  • Task Created

  • Task Deleted

  • Task Remove Attachment

  • Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Permissions

Things to Know

The routing of @Mentions functionality when a comment is left on a third-party profile withinThird-Party Due Diligencehas been updated. If the mentioned user has access toThird-Party Due Diligence, the user will now be routed to the source record withinThird-Party Due Diligenceinstead ofThird-Party Risk Management.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Privacy Automation

DataGuidance - March 13, 2026 - 202603.1.0

General Availability

Responsive Table Rendering in Copilot

View clear, side-by-side regulatory comparisons in Copilot in desktop and mobile device experiences. This enhancement to how tables appear in Copilot makes it easier for you to read, scan, and compare across jurisdictions and eliminates the need for horizontal scrolling in a narrow view.

Data Mapping Automation - March 13, 2026 - 202603.1.0

General Availability

Table Enhancements for Data Mapping Automation

Tables and table functionalities within Data Mapping Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

  • Assets list screen

  • Entities list screen

  • Third parties list screen

  • Processing activities list screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

  • Resolved an issue that prevented some users with custom roles from viewing comments.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Inventory Similarity Scan

|Available with Solution Packaging Only

Detect similar records in your data map for new records that have been added through various sources. Different than our duplicate asset functionality, the scan displays information about similar records within the new records to ensure users can easily find a record that is similar to the new entry.

For more information, see Inventory Similarity Scan.

Table Enhancements for Data Mapping Automation

Tables and table functionalities within Data Mapping Automation have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

  • Assessments tab of the Inventory details screen

  • Contracts tab of the Inventory details screen

  • Personal data tab of the Inventory details screen

  • Related tab of the Inventory details screen

  • Data lineage screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Permissions

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Incident Management - March 13, 2026 - 202603.1.0

Fixed

  • Resolved an issue that prevented incident workflow stages from advancing when an assessment was submitted via the Assessments tab of the Incident details screen.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

PIA & DPIA Automation - March 13, 2026 - 202603.1.0

Fixed

  • Resolved an issue that caused a delay in the processing of data appearing in reports and dashboards.

  • Resolved an issue that prevented some users from creating a benchmarking assessment in Program Benchmarking.

  • Resolved an issue that prevented some users from successfully submitting copied assessments with Allow other project answers.

  • Resolved an issue that prevented some assessment templates from successfully exporting to an Excel spreadsheet from the Templates screen.

  • Resolved an issue that caused selected questions to become unselected when applying a filter in the Score profile modal.

Existing Public Preview Features

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Rights Automation - March 13, 2026 - 202603.1.0

Fixed

  • Updated the order of filter processing to resolve an issue that prevented the Get List of Subtasks API from returning any data when the openrequests parameter was set to true.

  • Resolved an issue that prevented data subjects from viewing comments if the request was missing a first name, last name, or both.

  • Resolved an issue that caused system subtasks to duplicate if the subtask was re-triggered when in progress.

  • Resolved an issue that prevented accurate results from displaying on the Requests list screen when filters were applied using the Deadline is operator.

Existing Public Preview Features

Stage Rules for Workflows

Configure rules on workflows to conditionally change workflows or their stages. This feature streamlines your workflows by automating changes based on your specific criteria. 

This feature is related to the following idea: OT-I-3727.

For more information, see Adding Rules to Workflow Stages.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Tech Risk and Compliance

Compliance Automation - March 13, 2026 - 202603.1.0

General Availability

New Add Document Attachments API

Added the new Add Document Attachments API to add attachments to policies, standards, procedures, and privacy notices. This API allows you to add supporting files, URLs, or related resources to policy and privacy notice management objects to streamline document management workflows.

Fixed

  • Resolved an issue that prevented the Control library export from displaying seeded standard/framework data after removing and re-importing the framework.

  • Resolved an issue that caused the Issues tab of the Inventory details screen to redirect users to the Initiative screen instead of loading the Issues tab.

  • Resolved an issue that prevented users from previewing evidence attachments when the attachment name ended in .docx or .xlsx.

Existing Public Preview Features

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Permissions

Standard / Control Framework Changes

New ISO/IEC 27701

ISO/IEC 27701:2025 is an international standard that defines requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It is intended for organizations that process personally identifiable information (PII) in the role of PII controller and/or PII processor, helping formalize privacy governance, accountability, and privacy risk management across the PII lifecycle.

The 2025 edition modernizes the standard and positions ISO/IEC 27701 as a standalone, certifiable privacy management system standard, making it suitable for organizations that want an auditable privacy program whether or not they already operate an ISO/IEC 27001-based information security management system.

We’ve made implementing ISO/IEC 27701:2025 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of ISO/IEC 27701:2025.

Important:

The ISO/IEC 27701:2025 framework will be available on the OneTrust Platform effective March 23, 2026.

For more information, see Supported Control Frameworks.

New Colorado AI Act Framework Added

The Colorado Artificial Intelligence Act is the first comprehensive U.S. state law focused on consumer protections and accountability in the use of AI systems, with its core obligations centered on high-risk AI systems used in consequential decision-making. Effective June 30, 2026, it introduces requirements relating to reasonable care, risk management, impact assessments, transparency, consumer notices, and appeal rights, while also including broader disclosure obligations for certain AI systems that interact with consumer.

We’ve streamlined Colorado AI Act compliance by offering the full framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned with the law’s requirements for developers, deployers, and qualifying small deployers. The framework is designed to help organizations operationalize governance for AI systems and support defensible compliance with the Act’s accountability and transparency requirements.

Important:

The Colorado AI Act Framework will be available on the OneTrust Platform effective March 20, 2026.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Enterprise Policy Management - March 13, 2026 - 202603.1.0

Existing Public Preview Features

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

  • Controls

  • Risks

  • Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Issues Management - March 13, 2026 - 202603.1.0

Fixed

  • Resolved an issue that caused issue date attributes to display one day earlier than the entered value.

  • Resolved an issue that prevented users from saving issue attributes using the Text area response type.

  • Resolved an issue that caused attachments to be uploaded multiple times to issue tasks that were either previously opened or actively open in the Tasks pane within Issues Management.

New Public Preview Features

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Existing Public Preview Features

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

IT & Security Risk Management - March 13, 2026 - 202603.1.0

Fixed

  • Resolved an issue that prevented objects related to a risk from being assigned to the correct organization.

  • Resolved an issue that allowed risks in Draft status to be imported into the Risk library.

  • Resolved an issue that caused framework imports to fail when required risk attributes were present.

  • Resolved an issue that prevented risk template creation when an imported framework referenced an archived risk category.

  • Resolved an issue that prevented the Risk register from displaying when using the browser’s back button.

  • Resolved an issue that caused issue attributes to display backend GUID values when used in formulas for custom risk attributes.

  • Resolved an issue that caused the Controls list screen to scroll to the top each time a control was selected.

  • Resolved an issue that prevented users from linking multiple assets to a control when using the Create control implementation relationships import template in Global Settings.

  • Resolved an issue that caused attachments to be uploaded multiple times to issue tasks that were either previously opened or actively open in the Tasks pane within IT Risk Management.

Existing Public Preview Features

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Permissions

Standard / Control Framework Changes

New ISO/IEC 27701

ISO/IEC 27701:2025 is an international standard that defines requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It is intended for organizations that process personally identifiable information (PII) in the role of PII controller and/or PII processor, helping formalize privacy governance, accountability, and privacy risk management across the PII lifecycle.

The 2025 edition modernizes the standard and positions ISO/IEC 27701 as a standalone, certifiable privacy management system standard, making it suitable for organizations that want an auditable privacy program whether or not they already operate an ISO/IEC 27001-based information security management system.

We’ve made implementing ISO/IEC 27701:2025 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of ISO/IEC 27701:2025.

Important:

The ISO/IEC 27701:2025 framework will be available on the OneTrust Platform effective March 23, 2026.

For more information, see Supported Control Frameworks.

New Colorado AI Act Framework Added

The Colorado Artificial Intelligence Act is the first comprehensive U.S. state law focused on consumer protections and accountability in the use of AI systems, with its core obligations centered on high-risk AI systems used in consequential decision-making. Effective June 30, 2026, it introduces requirements relating to reasonable care, risk management, impact assessments, transparency, consumer notices, and appeal rights, while also including broader disclosure obligations for certain AI systems that interact with consumer.

We’ve streamlined Colorado AI Act compliance by offering the full framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned with the law’s requirements for developers, deployers, and qualifying small deployers. The framework is designed to help organizations operationalize governance for AI systems and support defensible compliance with the Act’s accountability and transparency requirements.

Important:

The Colorado AI Act Framework will be available on the OneTrust Platform effective March 20, 2026.

For more information, see Supported Control Frameworks.

Things to Know

TheIssuesandControlsmenus now appear in the side navigation by default for all users.

Newly created risk workflows now support assigning tasks toUser typeandSystem userattributes when using workflow stage rules to create tasks.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Third-Party Management

Third-Party Due Diligence - March 13, 2026 - 202603.1.0

Things to Know

The routing of @Mentions functionality when a comment is left on a third-party profile withinThird-Party Due Diligencehas been updated. If the mentioned user has access toThird-Party Due Diligence, the user will now be routed to the source record withinThird-Party Due Diligenceinstead ofThird-Party Risk Management.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Third-Party Risk Management - March 13, 2026 - 202603.1.0

New Public Preview Features

Separated Files Export for DORA ROI Report

Generate the register of information (ROI) report as a compressed file containing separate .csv files for each tab of the report. This enhancement allows you to submit unique files to specific regulators instead of sending the single, multi-tabbed export.

For more information, see Step 3: Generate and Export the DORA Report.

Fixed

  • Resolved an issue where values for the Type of Contractual Arrangement attribute, regardless of language choice, were not populated on the Contracts list screen and not included in the export despite being present in the Contract details.

  • Resolved an issue that caused PDF reports with large layouts to fail when they were triggered from workflows.

  • Resolved an issue that prevented expected results from appearing when applying the Engagement Aggregate Inherent and Aggregate Risk Level filters on the Engagements list screen.

Standard / Control Framework Changes

New ISO/IEC 27701

ISO/IEC 27701:2025 is an international standard that defines requirements and provides guidance for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS). It is intended for organizations that process personally identifiable information (PII) in the role of PII controller and/or PII processor, helping formalize privacy governance, accountability, and privacy risk management across the PII lifecycle.

The 2025 edition modernizes the standard and positions ISO/IEC 27701 as a standalone, certifiable privacy management system standard, making it suitable for organizations that want an auditable privacy program whether or not they already operate an ISO/IEC 27001-based information security management system.

We’ve made implementing ISO/IEC 27701:2025 easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring all relevant policies, controls, control implementation guidance and evidence tasks (including guidance), among others to assist in meeting the requirements of ISO/IEC 27701:2025.

Important:

The ISO/IEC 27701:2025 framework will be available on the OneTrust Platform effective March 23, 2026.

For more information, see Supported Control Frameworks.

New Colorado AI Act Framework Added

The Colorado Artificial Intelligence Act is the first comprehensive U.S. state law focused on consumer protections and accountability in the use of AI systems, with its core obligations centered on high-risk AI systems used in consequential decision-making. Effective June 30, 2026, it introduces requirements relating to reasonable care, risk management, impact assessments, transparency, consumer notices, and appeal rights, while also including broader disclosure obligations for certain AI systems that interact with consumer.

We’ve streamlined Colorado AI Act compliance by offering the full framework on our platform—featuring controls, implementation guidance, evidence tasks, policies, and risks aligned with the law’s requirements for developers, deployers, and qualifying small deployers. The framework is designed to help organizations operationalize governance for AI systems and support defensible compliance with the Act’s accountability and transparency requirements.

Important:

The Colorado AI Act Framework will be available on the OneTrust Platform effective March 20, 2026.

For more information, see Supported Control Frameworks.

Permissions

Things to Know

The DORA tab 07.01 now includes all engagements related to a critical or important function entity, regardless of the material or full value on the engagement's reliance attribute.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.