All Solutions Release Notes

General Availability

Purpose Data Usage

Drill into specific purposes across the platform and inspect their usage details. This Global Data Manager resource provides privacy managers a central location for monitoring where a given purpose is used to better manage those records.

For more information, see Unified Purpose Feature Guide.

Existing Public Preview Features

Automated AI Discovery

Continuously scan, detect, and catalog AI models and agents across your AWS-native ecosystem. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Amazon SageMaker Integration for AI Governance Models

Automated AI Discovery

Discover and catalog AI models, notebooks, and experiments across Google Cloud while maintaining centralized governance controls. This seamless integration experience enables real-time visibility into your organization's AI landscape, mapping relationships between models, training data, and business processes to strengthen risk management and compliance. By eliminating manual tracking, teams can focus on innovation while maintaining comprehensive oversight of their AI systems through automated discovery and continuous monitoring.

For more information, see Automated AI Discovery: Google Vertex Integration for AI Governance Models.

Metadata for Datasets

|Available with Solution Packaging Only

Improve data use governance functions by automating dataset evaluation and surfacing metadata that clarifies data quality, sensitivity, and readiness. This accelerates access request reviews, ensures responsible data usage, and helps teams build AI models on compliant, trustworthy datasets, which enhances both accuracy and oversight.

Risk Aggregation for Related Records

Enable systemic risk visibility across linked inventory objects in AI Governance. When enabled, parent objects (such as AI Systems or Projects) inherit risks from related child entities (such as Models or Datasets), allowing organizations to automate comprehensive risk views.

For more information, see Risk Aggregation for Related AI Records.

Export Inventory Records to Column Report

Create a report of all records of a specific inventory and the columns eligible for bulk import, or the current saved view of an inventory screen including applied filters. This provides you with two flexible reporting methods to gather comprehensive insights into inventory records.

For more information, see Exporting AI Inventory Records.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Table Enhancements for Websites

Tables on the Websites screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Cookie Consent Intergration with Microsoft Clarity

Assign categories to Microsoft Clarity purposes when configuring Microsoft Consent Mode within Geolocation rules. This enhancement adds additional purposes to the existing MCM configuration, which allows users to consent to Microsoft Clarity.

For more information, see Cookie Consent Integration with Microsoft's Universal Event Tracking.

Fixed

• Resolved an issue that prevented the scanner from scanning all applicable webpages if the webpage URL ended in a trailing slash (/).

• Resolved an issue that caused some illustration descriptions to display as duplicates after closing and reopening the Preference Center on IAB-configured CMPs.

• Resolved an issue that prevented some IAB-configured banners from correctly responding to user interactions at screen resolutions of 425x and higher if a logo was added to the banner template before publication.

• Resolved an issue that caused the banner text to display in Finnish when configured in Filipino.

• Resolved an issue that prevented focus from remaining correctly within some banners leveraging custom CSS when users changed the banner language.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

• Create Bulk Export API

• Get List of Bulk Exports API

• Get Bulk Export Status API

• Cancel Bulk Export API

• Get Bulk Export Download Details API

• Get Bulk Export Credit Details API

• Get List of Bulk Export Download Details API

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

• Identify known vendor services when scanning your websites.

• Categorize the vendor services active on your websites.

• Link tracking technologies to identified vendor services.

• Allow end users to configure consent for vendor services on the Preference Center.

• Capture records of consent at the vendor service level.

• Configure IAB templates to capture and disclose vendor service information.

• View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Things to Know

Updated theGet Scan Results APIto remove theIsNewFoundflag. This change removes a redundant flag from the API.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed Admin

• Resolved an issue that prevented some mobile application scans from progressing past the In Progress stage when scanning Android apps.

• Resolved an issue that prevented consent and Identifier for Advertisers (IDFA) data from correctly logging and returning when App Tracking Transparency (ATT) was configured with no linked categories.

Fixed Android

• Resolved an issue that prevented some SDK descriptions from displaying in full on the preference center.

Fixed iOS

• Resolved an issue that caused the Powered By OneTrust logo to display when accessing the preference center from the banner even if the logo was disabled in the admin UI.

• Resolved an issue that returned incorrect consent values for Always Active categories when users rejected all purposes on the CMP.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are now available for use with retrieving interface attributes needed to display the Banner and Preference Center, retrieving a list of active IAB and Google Vendors to display on the Preference Center, and logging consent when an end user interacts with a Banner or Preference Center. These APIs enable you to easily access data for Banner and Preference Center implementations, disclose vendor information to end users, and capture end user consent.

• Get Banner Data API

• Get Preference Center Data API

• Get IAB and Google Vendors API

• Log Consent API

• Get Universal Consent Purposes API

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

• iOS

• Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

• iOS

• Android

• Apple TV

• Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

• Android

• Android TV

• Apple TV

• HTML5

• iOS

• Roku

• Unity

• Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Accessibility Conformance

• Resolved an issue that prevented focus from applying correctly to buttons when navigating the preference center on tvOS devices (WCAG-A 2.4.3: Focus Order).

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Privacy Notice Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the new Privacy Notice Insights Dashboard to analyze data captured across Privacy Notice Management. This dashboard can be used to view key metrics related to privacy notices, workflows, and notice expiration details.

For more information, see Insights Privacy Notice Management Dashboard.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

New V4 Consent Management APIs

Leverage the following v4 API endpoints when using Universal Consent and Preference Management:

Create Data Subject Group

Added the Create Data Subject Group API to enable users to create groups of data subjects.

Update Data Subject Group

Added the Update Data Subject Group API to enable users to add or remove data subjects from a group and change the primary identifier for a group.

Get List of Data Subject Groups

Added the Get List of Data Subject Groups API to enable users to retrieve a list of all data subject groups.

Delete Data Subject

Added the Delete Data Subject API to enable users to delete data subjects and their data subject profiles.

Delete Purposes from Data Subject

Added the Delete Purposes from Data Subject API to enable users to delete specific purposes from a data subject.

Get Optimized List of All Purpose Details for All Data Subjects

Added the Get Optimized List of All Purpose Details for All Data Subjects API to enable users to retrieve a list of purpose details that were last updated within your specified date range for all data subjects.

Get Optimized List of Data Subjects

Added the Get Optimized List of Data Subjects API to enable users to retrieve a list of data subjects that were last updated within your specified date range.

Get List of Deletion Certificates

Added the Get List of Deletion Certificates API to enable users to retrieve a list of deletion certificates for deleted data subjects and receipts.

Table Enhancements for Data Elements

Tables on the Data elements screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. 

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Purpose Data Usage

Drill into specific purposes across the platform and inspect their usage details. This central reporting screen provides privacy managers a central location for monitoring where a given purpose is used to better manage those records.

For more information, see Unified Purpose Feature Guide.

Fixed

• Resolved an issue that prevented some notices from populating correctly on merged data subjects.

• Resolved an issue that prevented purposes preferences from displaying in their configured order on the preference center.

• Resolved an issue that generated new tokens on every consent change.

• Resolved an issue that caused some integration workflows to send duplicate events for a single receipt when data subject profiles were merged.

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Accessibility Conformance

• Error messages on the Trust Center's login screen have been improved to offer more specific guidance (WCAG-AA 3.3.3: Error Suggestion).

• Screen headers on the Purposes screen now contain the appropriate heading tags (WCAG-A 1.3.1: Info and Relationships).

• Screen readers now correctly announce the Create data subject button as a button instead of a link (WCAG-A 4.1.2: Name, Role, Value).

• Accurate aria labels are now present for buttons on the Data elements and Reason templates screens (WCAG-A 4.1.2: Name, Role, Value).

Things to Know

• When new users without existing profiles in OneTrust enter phone numbers into the Trust Center or preference center and their profile gets created, special characters are now removed from their phone number identifier for improved format standardization.

Existing Public Preview Features

Data Governance Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Governance Insights Dashboard to analyze data captured across Data Catalog. This dashboard can be used to view essential information about your data assets, manage your data and associated metadata in response, and enact policies and procedures necessary for proper data governance.

For more information, see Insights Data Governance Dashboard.

Access Intelligence Insights Dashboard

Now enabled for every Data Catalog customer, data governance managers can now utilize highly customizable reporting and analytic capabilities using the Access Intelligence Insights Dashboard that collects data captured by Data Catalog and Data Discovery. This dashboard can be used to understand what sensitive data you have and how it is shared across the company so admins can quickly identify data-related risks present in your data ecosystem.

For more information, see Insights Access Intelligence Dashboard.

Note:

This dashboard is available by default only for Data Catalog customers.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Note:

Originally introduced under General Availability in OneTrust 202504.1.0. This has been changed to Public Preview in OneTrust 202505.1.0.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease attack surface, and improve security posture with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Data Discovery Insights Dashboard

Utilize highly customizable reporting and analytic capabilities using the Data Discovery Insights Dashboard to analyze data captured across the module. This dashboard can be used to view information about job insights, scan metrics, worker node progress, and more related to your discovery business outcomes.

For more information, see Insights Data Discovery Dashboard.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused timestamps for the Date submitted and Date created fields to have a one-hour difference between the Requests screen in Privacy Rights Automation and column reports.

• Resolved an issue that caused A/B Tests longer than seven days to fail when exported from the Test details screen in Cookie Consent.

• Resolved an issue that caused Insights Dashboards to display incorrect totals in the summary footer for calculated columns.

• Resolved an issue that prevented website data from appearing on the Hourly Cookie Consent default Insights Dashboard.

• The date and time attributes in the platform now match the format used in exported PDFs.

Existing Public Preview Features

Insights Dashboards

Utilize highly customizable reporting and analytic capabilities using Insights Dashboards that are built through Power BI by Microsoft and embedded in the OneTrust Platform to analyze data captured across various products throughout the platform. The following seeded dashboards are available under Public Preview:

• Data Governance Dashboard

• Data Discovery Dashboard

• Access Intelligence Dashboard

• Privacy Notice Management Dashboard

Expanded Custom Attributes for Privacy & GRC Insights Dashboards

Track additional metrics by adding up to 10 custom attributes to each tab on custom Insights Dashboards created using the Privacy and Governance, Risk, Compliance data sources. This enhancement provides more flexibility in customizing your Insights Dashboards, allowing you to visualize unique data points relevant to your organization’s business context.

For more information, see Using Object-Based Attribute Tables for Custom Insights Dashboards.

Things to Know

Insights as Default for Net New Customers/Accounts

Starting in the OneTrust 202410.1.0 release, Insights Dashboards will be the default dashboard experience for all new OneTrust accounts/tenants. Users within new OneTrust accounts created after the respective environment is upgraded to 202410.1.0 will now see Insights Seeded Dashboards when available for a given module. Legacy dashboards will only appear for modules that do not currently have an Insights Seeded Dashboard. Existing accounts that already have access to Legacy Dashboards will not be affected by this change.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Purpose Data Usage

Drill into specific purposes across the platform and inspect their usage details. This central reporting screen provides privacy managers a central location for monitoring where a given purpose is used to better manage those records.

For more information, see Unified Purpose Feature Guide.

Things to Know

• The Object Manager product has been renamed to Global Data Manager. The navigation menu in the application, in addition to myOneTrust and related documentation, will be updated.

Fixed

• Resolved an issue where expandable sections in the Tree View of logs were failing to expand.

• Resolved an issue where integration actions could not be added inside a Conditional Logic step that followed an Apply to Each action.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused date discrepancies between task deadlines on custom reports and task deadlines on assessment tasks.

• Resolved an issue that caused the translation key for default tasks to appear on the platform homepage.

• The Give Feedback and Get Help options no longer appear on the main navigation menu for users without the corresponding permissions.

Existing Public Preview Features

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

• Task Add Attachment

• Task Add Comment

• Task Created

• Task Deleted

• Task Remove Attachment

• Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

SSO for Sandbox Improvements

Improvements were made in OneTrust 202510.1.0 to streamline the single sign-on (SSO) user login flow for sandbox accounts. To accompany this change, the user flows listed below will apply when logging into sandbox accounts in the following scenarios:

• If SSO is set up in the parent account that is using a custom subdomain or FQDN, users that exist in both the parent account and sandbox account will log into the sandbox account using the SSO setup configured in the parent account. 

• If SSO is set up in the parent account that is using a shared domain, users that exist in both the parent account and sandbox account will log into the sandbox account using the SSO setup configured in the parent account.

• If SSO is set up separately in the sandbox account, users that only exist in the sandbox account will log into the sandbox account using the SSO setup configured in the sandbox account.

• If SSO is not set up separately in the sandbox account, users that only exist in the sandbox account will log into the sandbox account using a username and password.

For more information, see Accessing Sandbox Accounts.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Purpose Data Usage

Drill into specific purposes across the platform and inspect their usage details. This Global Data Manager resource provides privacy managers a central location for monitoring where a given purpose is used to better manage those records.

For more information, see Unified Purpose Feature Guide.

Fixed

• Resolved an issue that caused risks to display multiple times on PDF reports.

Existing Public Preview Features

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Important:

This feature was originally reported under General Availability for 202510.2.0. It has been rescheduled for General Availability in 202602.1.0 and will remain in Public Preview until that release.

Inventory Similarity Scan

|Available with Solution Packaging Only

Detect similar records in your data map for new records that have been added through various sources. Different than our duplicate asset functionality, the scan displays information about similar records within the new records to ensure users can easily find a record that is similar to the new entry.

For more information, see Inventory Similarity Scan.

Important:

This feature was originally reported under General Availability for 202510.2.0. It has been rescheduled for General Availability in 202602.1.0 and will remain in Public Preview until that release.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented list page exports from correctly retaining filters applied on list pages.

Existing Public Preview Features

Incident Platform Workflow Enhancements

The Incident Workflows screen has been enhanced with search and sorting capabilities to help better organize and manage incident workflows. You can now search the Workflow screen by Workflow name, and sort the Workflow screen by the following columns:

• Workflow Name

• Default

• Status

• Date Modified

• Date Created

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented attribute options within conditional logic from populating with correct values on Excel template exports.

• Resolved an issue that delivered assessment reminder notifications to respondents when an assessment was in the Under Review stage.

• Resolved an issue that prevented templates from exporting successfully as Excel files when questions exceeded the character limit for individual Excel cells. Characters are now truncated in Excel to match the character limit.

• Resolved an issue that prevented files of different sizes or types but with the same name from displaying the “File name already exists” error upon upload when attaching evidence to controls assessments.

• Resolved an issue that prevented questions configured with skip/show logic from being hidden correctly if the question's show logic was triggered when the respondent selected Select All on a previous question response.

• Further improvements have been made to prevent incorrectly recorded user activity in the Assessment activity modal from displaying when assessment names were automatically updated to correspond to changed template names. The modal now displays "OneTrust User" as the user responsible for these changes.

• Resolved an issue that caused the information icon to display multiple times on some read-only questions.

• Resolved an issue that prevented bar chart widgets from separating some metrics by their distinct criteria on the PIA & DPIA Automation legacy dashboard.

• Resolved an issue that prevented users from correctly completing the AI Intake Assessment - 3.1 template.

Existing Public Preview Features

AI Inventory Record Analysis

|Available with Solution Packaging Only

Pre-populate questions on newly created assessments with AI-generated responses using the new AI Inventory Record Analysis feature.

These responses are based on data from previous, directly related assessments and inventories. This feature streamlines DPIA completion by reducing the time respondents spend on completing assessments and transferring previously entered information from PIAs.

For more information, see Leveraging AI Inventory Record Analysis and AI Document Scanning to Complete Assessments.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Accessibility Conformance

• Screen readers now correctly announce assessment names when checkboxes on the Assessments list screen receive focus (WCAG-A: 1.3.1 Info and Relationships).

Things to Know

Dynamic variables in email notifications for assessment stage names are now translated to the application language.

Project Type attribute values now display and are configurable when applying filters to reports.

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused the date format on the Privacy Portal to display as MM/MM/YYYY when configured in Finnish (suomi).

• Resolved an issue that caused requests imported using the Bulk Import Historic Data Subject Requests functionality to populate at the incorrect organization level.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused incorrect values to appear in Findings reports.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Evidence Task Review Workflow

Enable a default workflow for evidence task intervals when a reviewer is assigned. This enhancement introduces a structured set of stages to track the lifecycle of evidence, while also supporting notifications and task creation to keep teams informed and on track.

Note:

The Evidence Task Approval Bypass permission is required to allow evidence task assignees to bypass approval stages and send an evidence task interval to be collected.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Standard / Framework Changes

Connecticut Data Privacy Act (CTDPA) Framework Updated

Framework content updated to align with amendments from Senate Bill 1295 which lowered the threshold for applicability from businesses processing data of 100,000 consumers to 35,000 and expanding the scope to include the sale of consumer data without limitation. The updated Connecticut Data Privacy Act (CTDPA) framework is now available on the OneTrust platform.

For more information, see Supported Control Frameworks.

Fixed

• Resolved an issue that prevented users from accessing an issue created from a Control in Third-Party Risk Management.

Existing Public Preview Features

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization's risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused risk workflow stages to advance after one approver completed the review, even when the Set approval requirements setting was configured to require all approvers.

• Resolved an issue that prevented users from creating risks from the Risk library.

• Resolved an issue that caused the Bypass other approvers setting to appear on the Review modal when only one approver was assigned.

• The following fields are now correctly translated to Portuguese for Insights Dashboards:

  • Current stage approvers

  • Last updated by

  • Last update date

  • Related

  • Related object GUID

  • Related object name

  • Related object type

• Resolved an issue that prevented the Add controls to inventory screen from loading when adding controls to a vendor record.

• Resolved an issue that prevented fields updated on the Risk details screen from appearing in exported reports.

• Resolved an issue that caused the View library control details link to appear twice on a single assessment question.

• Resolved an issue that caused control formulas to calculate incorrectly when two formula attributes were configured, and one attribute referenced the other.

• Resolved an issue that prevented custom control implementations from being added to inventories based on new control profile rules.

• The Get List of Control Implementations by Entity API responses now include option names for numerical single select attributes when retrieving a list of control implementations for processing activities.

Existing Public Preview Features

AI Evidence Analysis

|Available with Solution Packaging Only

Run AI-powered analysis for files uploaded on the evidence collection pane of the Evidence tasks screen when the Record recommendations setting is enabled in Global Settings. This feature allows you to evaluate how well files submitted during evidence collection align with defined controls and evidence requirements. The analysis will provide guidance that highlights validated content and flag gaps or incomplete information.

Important:

This feature is currently available for customers in the following environments: APP, APP-FR, APP-EU, APP-DE. AI Evidence Analysis will be available for all environments in a future release.

For more information, see Using AI for Evidence Analysis.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Export Risks and Business Objectives to PDF

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Creating and Managing Risks and Creating and Managing Business Objectives.

Shared Control Implementations on Risks

Create shared control implementations with multiple risks or a single control implementation for each risk from the Control Library and Inventory Details screens. You can also merge multiple implementations of the same library control into a single control or split a single implementation into several controls. This feature allows you to reduce the sprawl of control implementations created within your organization by removing redundant controls.

Key capabilities include:

Inventory Flexibility

Choose which inventories align to risk controls to provide greater flexibility when creating and updating risks.

Relationship Management

Add risks to existing control implementations or associate additional controls directly to risks.

Merge & Split Controls

Merge multiple implementations of the same library control sourced from a risk or split a shared control into single implementations for each risk.

For more information, see Managing Control Implementations and Managing Risks in the Risk Register.

Risk to Issues Conversion

Convert risks to issues on the Risk Register by assigning the risk to an issues workflow and mapping existing risk attributes to the new record. This feature allows you to easily convert risks to issues when they fall outside your organization’s risk criteria to help declutter your Risk Register and manage risks more effectively. You can revert conversions by restoring issues to risks on the new Converted risks screen.

For more information, see Converting Risks to Issues.

Standard / Framework Changes

Connecticut Data Privacy Act (CTDPA) Framework Updated

Framework content updated to align with amendments from Senate Bill 1295 which lowered the threshold for applicability from businesses processing data of 100,000 consumers to 35,000 and expanding the scope to include the sale of consumer data without limitation. The updated Connecticut Data Privacy Act (CTDPA) framework is now available on the OneTrust platform.

For more information, see Supported Control Frameworks.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Permissions

• The QRA & Vendor Portal Attribute Manager permission has been split into the Create Request Attributes, Create Customer Attributes, Edit Request Attributes, Edit Customer Attributes, View Request Attributes, and View Customer Attributes permissions.

• The Attribute manager read permission has been split into the View Request Details, View Customer Details, View Request Attributes, and View Customer Attributes permissions.

General Availability

Purpose Data Usage

Drill into specific purposes across the platform and inspect their usage details. This Global Data Manager resource provides privacy managers a central location for monitoring where a given purpose is used to better manage those records.

For more information, see Unified Purpose Feature Guide.

Fixed

• Resolved an issue that prevented restoring assessments after they were deleted.

• Resolved an issue that prevented DORA reports from exporting with the correct value for the Total annual expense or estimated cost of the ICT third-party service provider vendor attribute.

Things to Know

About Known Defects

 

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.