All Solutions Release Notes

General Availability

Performance and Operational Dashboard

Use the ​Performance Summary​​ tab in the AI Governance Insights Dashboard to monitor AI agent and model usage, risk, PII exposure, and token consumption across your organization. This enhancement helps you identify the models and agents with the highest token consumption and the areas with the highest AI usage, so you can prioritize them for governance.

For more information, see Insights AI Governance Dashboard.

Enhanced Lineage Visualization

Use the enhanced data graph to explore relationships among AI Governance entities. This enhancement helps you rearrange tiles, zoom the graph, identify related entity types and names, and view an entity's details by selecting its tile.

For more information, see Viewing Inventory Data Graphs.

Table Enhancements for AI Governance

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Assessments tab of the Projects > Inventory details screen

• Options tab of the Attribute details screen for the following inventory attribute types:

  • AI agents

  • AI systems

  • Datasets

  • Models

  • Projects

  • Vendors

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Enable/Disable Status of Stage Rules and Workflow Rules

Users with permission to update rules can now enable or disable stage rules and workflow rules without deleting them. Disabled stage rules won't run when a workflow enters the stage, and disabled workflow rules won't run when their configured trigger occurs.

These enhancements will be available for the following AI Governance workflows:

• AI Agents

• AI Systems

• Models

• Projects

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following AI Governance objects:

• AI Agents

• AI Systems

• Datasets

• Models

• Projects

Fixed

• Resolved an issue that prevented users from accessing AI system details from the Inventories tab of the Controls screen using the Leveraged by relationship.

• Resolved an issue that prevented automation rules from triggering follow-up assessments for projects when using the Last updated date attribute.

• Resolved an issue that caused saved view exports to include all records instead of only the records in the saved view and omit the Created by, Last modified by, and Last updated fields.

Existing Public Preview Features

Things to Know

• The Attachments tab on Inventory details screens is now consistently named Documents across all AI Governance inventory types, regardless of assigned permissions.

• About Known Defects

  Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Fixed

• Resolved an issue that caused an incorrect vendor count to display on IAB Transparency and Consent Framework EU preference centers when grouping IAB purposes.

• Resolved an issue that caused consent toggles to display with incorrect alignment in the preference center when using an IAB Transparency and Consent Framework EU template configured with a Tab layout.

• Resolved an issue that caused excessive white space to display on preference centers configured with a Center or Panel layout after end users zoomed out in their browser window.

• Resolved an issue that prevented bulk imported cookies from populating on the Tracking technologies screen if the cookies were already present for another domain.

• Resolved an issue that caused intermittent errors when initiating website scans for websites with URLs ending with a trailing slash (/).

New Public Preview Features

Telemetry.js for Real-World Tracker Detection |Available with Solution Packaging Only

Integrate Telemetry.js with the OneTrust CMP to enable continuous runtime monitoring to help identify tracking technologies that execute during real user sessions. Telemetry.js enhances web scanning by observing tracking technologies as they run on your site. This helps provide a more complete view of technologies that may not appear during a scheduled scan, such as technologies triggered after page load, during navigation, or after a user interaction.

For more information, see Third-Party Risk Management - October 16, 2026 - 202610.1.0.

Existing Public Preview Features

New CMP Experience

Enable the New CMP Experience setting to leverage the redesigned Cookie Consent interface. This new interface streamlines multiple interfaces within Cookie Consent to create a unified experience that improves navigation and makes it easier to deploy and manage your CMP.

Note:

You can enable this preview feature using an in-app setting within Global Settings

For more information, see Enabling the New CMP Experience.

Global Opt-Out Flow |Available with Solution Packaging Only

Enable end users to opt out of a purpose across all of their linked devices, services, and accounts at once using the Global opt-out settings in your preference center template. This feature enables your end users to opt out of a purpose associated with their account and automatically submits a DSR request to process their opt-out from the specified purpose or purpose group. This enhancement is designed to improve your compliance with California privacy law.

For more information, see Customizing the Preference Center Template. This feature is related to the following ideas: OT-I-9627.

Email Completion Notifications for Compliance Assistant |Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.4 Templates

Enable the Global Privacy Platform setting on TCF 2.4 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Permissions

• You can now bulk update purpose assignments and override inherited global settings for multiple tracking technologies at once, reducing manual maintenance for large inventories while maintaining governance via the Edit tracking technologies permission.

Accessibility Conformance

• Screen readers no longer announce the Notice Description multiple times when its value matches the Cookie banner screen reader value (dialog) (WCAG‑A 4.1.2: Name, Role, Value).

• External link icons now display immediately on all applicable links when the cookie banner loads (WCAG-A 1.4.1: Use of Color).

Things to Know

• Consent receipts now always include the source, consent model, and interaction type for all known and unknown users, regardless of Advanced Analytics settings.

• A Select all checkbox is now available on the Instances tab of the Global settings pane when deleting multiple instances of tracking technologies.

• Users can now edit and reassign existing tracking technology instances to one or more websites directly from the Global settings pane on the Technology details screen.

• The Host field for tracking technologies is now a free-text field that allows users to assign technologies to first-party or custom hosts.

• You can now bulk update purpose assignments and override inherited global settings for multiple tracking technologies simultaneously.

• The Default description column is now available on the Tracking technologies screen, allowing you to review global descriptions for cookies and SDKs directly from the list view.

• A deprecation warning now displays in the application when the Choices banner or No banner layouts are selected for a template.

• About Known Defects

  Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Fixed Admin

• Resolved an issue that prevented some mobile app scans from correctly reporting application and SDK versions for iOS applications.

• The mobile app scanner now displays a question mark (?) placeholder in the SDK version column of the Scan results tab when the SDK version is unknown instead of defaulting to the latest version.

• The mobile app scanner now correctly parses and displays the application version from the Info.plist file for iOS scans.

Fixed iOS

• Resolved an issue that prevented category consent statuses from logging correctly after end users selected the Confirm Choices button on the preference center.

• Resolved an issue that prevented consent values from being logged consistently for Age Gate-mapped categories and strings after Age Gate errors were triggered by invalid lower and upper age range values.

• Resolved an issue that caused Age Gate consent configurations to incorrectly populate on the preference center in regions where Age Gate was not enabled.

• Age gate restrictions are no longer applied on iOS applications if the consent logging request fails. This ensures that age-based restrictions are only enforced when the user's age range is successfully recorded.

Fixed Android

• Resolved an issue that caused the SDK to quit unexpectedly on devices using API levels 21-25 during network calls.

• The Global opt-out modal now displays on the preference center when a user disables consent for an SDK that affects a parent purpose.

Fixed MAUI

• Resolved an issue that prevented the Purpose details screen from displaying when end users selected the Expand accordion next to a purpose in the preference center.

• Age gate restrictions are no longer applied on MAUI applications if the consent logging request fails. This ensures that age-based restrictions are only enforced when the user's age range is successfully recorded.

Fixed HTML5

• The Global opt-out modal now displays on the preference center when a user disables consent for an SDK that affects a parent purpose.

• Consent toggles on HTML5 preference centers now display consistent on and off state behavior when configured as checkboxes to achieve behavior parity with all other SDK platforms.

Fixed Unity

Age gate restrictions are no longer applied on Unity applications if the consent logging request fails. This ensures that age-based restrictions are only enforced when the user's age range is successfully recorded.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are available for retrieving the interface attributes needed to display the banner and preference center, retrieving active IAB and Google vendor information, logging consent interactions, and submitting global opt-out data subject access requests. These APIs enable developers to retrieve the data required for banner and preference center experiences, disclose vendor information to end users, capture consent preferences, and support Global Opt-Out workflows across devices and services.

• Get Banner Data API

• Get Preference Center Data API

• Get IAB and Google Vendors API

• Log Consent API

• Get Universal Consent Purposes API

• Submit Global Opt-Out Request API

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

• iOS

• Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts |Available with Solution Packaging Only

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

• iOS

• Android

• Apple TV

• Android TV

Enable Global Privacy Protocol on TCF 2.4 Templates

Enable the Global Privacy Protocol setting on TCF 2.4 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

• Android

• Android TV

• Apple TV

• HTML5

• iOS

• Roku

• Unity

• Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

• Text within toggleDisableHints in the general section of ageGate in application data has been updated with a more generic message that applies to both purposes and SDKs. This improved text displays on your Age Gate-configured preference center.

• Aria labels are now present for the close button in the Global opt-out modal for Android implementations.

• All SDKs now include the header OT-Is-Anonymous-User: true in CMP API requests to distinguish between anonymous and identified users and prevent unintended profile creation when an anonymous user identifier has been auto-generated.

• Consent receipts for all SDKs now always include core consent proof fields, including the consent model and interaction type, regardless of Advanced Analytics settings.

• About Known Defects

  Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Fixed

• Resolved an issue that caused users without the required permissions to appear in organizational search responses.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Enhancements to Bulk Export APIs

• Updated the Create Bulk Export API with the following enhancements:

  • Added support for the DATA_ELEMENT_BULK_ACTIONS export type to enable bulk management of data element values. This enhancement allows organizations to delete data elements from matching data subjects, delete data elements from all associated data subjects, and rename or remove multi-select option values through a bulk export workflow.

  • Added support for the REMOVE_PURPOSE action in the DATA_SUBJECTS_BULK_ACTIONS export type. This enhancement enables organizations to remove purposes from data subjects through bulk export operations.

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following Universal Consent & Preference Management objects:

• Purposes

• Collection Points

Fixed

• Resolved an issue that caused a 400 Bad Request error to display when saving new or edited consent rules.

• Resolved an issue that incorrectly published a new minor version of a purpose when users closed the Publish purpose confirmation modal using the close (x) button.

• Resolved an issue that prevented created dates from displaying consistently across parent and child identifiers on the Data subject details screen.

• Resolved an issue where the Get Data Subject Details V4 API returned outdated custom preference option names after an option was renamed.

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

• The Filters and parameters section of the Create new bulk export screen now includes a Collection point type section to allow users to generate consent receipt exports that are filtered for a specific collection point type.
• Logic for page and section visibility rules in multi-identity preference centers has been enhanced to more accurately evaluate conditions across all linked identities and prevent incorrect redirects.
• Updated the Get Data Subject's Preferences V2 API to return the ETag and Last-Modified response headers. These headers enable applications to determine whether preference data has changed since it was last retrieved, supporting more efficient caching and synchronization workflows.

• About Known Defects

  Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks | Available with Solution Packaging Only​

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

• ​Masking Policies for Databricks​

• Masking Policies for Snowflake

• Row Filtering Policies for Databricks​

• Row Filtering Policies for Snowflake​

This feature is related to the following ideas: ​INT-I-34​​, ​GOVIDEA-I-24​​, ​DPOL-I-3​​, ​GOVIDEA-I-16​​.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

Fixed

• Resolved an issue that prevented Data Subject Access Request (DSAR) record retrieval from completing for Databricks tables that were not located in the default catalog.

• Resolved an issue that caused credentials to display incorrect worker nodes when viewed from a parent organization or when switching between sub-organizations.

Existing Public Preview Features

Things to know

Fixed

• Resolved an issue that prevented users with custom roles from downloading assessment PDF reports.

• Resolved an issue that prevented assessment PDF exports from completing when rich text contained invalid HTML.

• Resolved an issue that caused the X-axis intervals on legacy dashboards to display irregular numbering sequences instead of logical scale values.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing ABAC-enabled reporting as part of Attribute-Based Access Control (ABAC) Phase 1: Foundations. ABAC-enabled reporting extends record-level access controls into supported reporting experiences by using assignments through sharing, attributes, or workflows to determine which report data users can access. This feature introduces assignment-aware reporting for supported objects, helping organizations align report visibility with operational access controls, support least-privileged access, improve governance, and provide more consistent reporting experiences.

For more information on ABAC, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC-enabled reporting is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects and reporting experiences.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Reporting Considerations for Attribute-Based Access Control (ABAC).

Conversational Analytics Insights Chatbot |Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

• AI Governance inventories:

  • AI systems

  • Datasets

  • Models

  • Projects

• Assessments

• CMP time series

• Consent time series

• Contracts

• Controls / Control implementations

• Engagements

• Incidents

• Inventories:

  • Assets

  • Entities

  • Processing activities

  • Vendors

• Issues

• Privacy requests and subtasks

• Risks

Note:

This feature does not currently support consent data subject details.

For more information, see Using Conversational Analytics Insights Chatbot.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

AI-Powered Individual Log Error Analysis | Available with Solution Packaging Only

Identify failed actions with AI-powered error summaries, root cause explanations, and actionable recommendations inside the log. This allows you to see exactly which workflow step failed, the type of error, and suggested next steps, which enables you to resolve issues faster and more confidently.

For more information, see Using Integration Logs.

Existing Public Preview Features

Key Pair Rotation

Refresh expiring Snowflake key pairs directly from the credentials flow instead of replacing them manually outside of OneTrust. Expiration reminder emails help teams rotate keys on time and maintain authentication continuity during the transition to the new key pair.

For more information, see Rotating Key Pairs for Integration Credentials.

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the new Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Global Table Enhancements

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Add role screen when assigning permissions based on permission groups in Global Settings.

• Approvers in current stage modal on Workflow & Approval tab of all object types.

• Notifications screen in the Alert Center.

Enable/Disable Status of Stage Rules and Workflow Rules

Users with permission to update rules can now enable or disable stage rules and workflow rules without deleting them. Disabled stage rules won't run when a workflow enters the stage, and disabled workflow rules won't run when their configured trigger occurs.

This enhancement will be available for the following products, refer to their release notes for impacted workflows:

• AI Governance

• Audit Management

• Enterprise Policy Management

• Incident Management

• IT Risk Management

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following products, refer to their release notes for impacted workflows:

• AI Governance

• Audit Management

• Enterprise Policy Management

• Incident Management

• Issues Management

• IT Risk Management

• Third-Party Risk Management

• Universal Consent & Preference Management

Enhancements to Access Management APIs

Updated the Access Management APIs to support granular OAuth scopes for organization, user group, and user management operations. These enhancements enable more precise access control by allowing integrations to request only the permissions required for specific read, write, and delete operations.

• Added the ORGANIZATION_READ, ORGANIZATION_WRITE, and ORGANIZATION_DELETE OAuth scopes for the Organizations APIs.

• Added the USER_GROUP_READ, USER_GROUP_WRITE, and USER_GROUP_DELETE OAuth scopes for the User Groups and User Groups V2 APIs.

• Added the USER_READ, USER_WRITE, and USER_DELETE OAuth scopes for the Users V2 APIs.

Enhancements to Document APIs

Updated the Upload File API to support the ATTACHMENT_WRITE OAuth scope in addition to the existing ATTACHMENT scope. This enhancement provides a more granular permission option for attachment upload operations.

Fixed

• Resolved API documentation issues to correct schema definitions, field requirements, response codes, and OAuth scope requirements across various SCIM APIs to align with actual SCIM API behavior.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

ABAC Phase 1: Foundations is available for supported objects across AI Governance, Privacy Automation, Tech Risk & Compliance, and Third-Party Management, and introduces the following core capabilities to manage record-level access and collaboration:

Basic Role

Use the new minimal-access Basic role available on theRolesscreen to configure users with access only to the OneTrust Platform homepage, supporting least-privileged access from the start.

Assignments

Leverage out-of-the-box or custom assignments, which are sets of permissions that define what users can do on a record. Assignments can be applied through record sharing or inherited through user attributes and workflow stages to automatically grant record-level permissions for owners, approvers, reviewers, and other users involved in the record lifecycle.

Sharing, Requesting & Managing Access

Share records directly with users, request access to records, review who currently has access, and modify or revoke access as needed.

Record-Level Auditing

Review audit history for record access and assignment configuration changes to understand what changed, who made the change, and when the change occurred.

ABAC helps organizations manage access more precisely by aligning permissions to records and assignments rather than relying on increasingly complex role structures. This enables granular record-level access control, improves governance, and simplifies collaboration across teams and workflows. With this enhancement, administrators can reduce access-management complexity while strengthening security and accountability across the OneTrust Platform.

For more information, see Attribute-Based Access Control (ABAC) User Guide. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0, with support initially available for a subset of objects and functionality. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

OneTrust Activity Log

Gain a unified, real-time view of user and system audit events across the OneTrust Platform with the Activity logs screen to increase visibility and control, investigate issues faster, and meet compliance requirements with a complete, traceable audit trail. Through a centralized audit experience, teams can quickly search and filter audit records, monitor activity across solutions from a single location, and export audit data for broader reporting and analysis.

For more information, see OneTrust Activity Log.

Privacy Risk Agent |Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

• Task Add Attachment

• Task Add Comment

• Task Created

• Task Deleted

• Task Remove Attachment

• Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

Legacy Sharing vs ABAC Sharing

OneTrust is planning to transition customers from the legacy sharing experience to Attribute-Based Access Control (ABAC) sharing for Inventory objects. ABAC provides a more consistent and scalable access model, supports Assets, Processing Activities, Entities, Vendors, and Projects, and offers more advanced access-control options. 

If your tenant currently uses Legacy Share, your existing sharing configuration will continue to work until you are ready to transition. The migration is not automatic, and Legacy Share continues to take precedence for Inventory objects where both sharing models are available. Review your current sharing setup and discuss readiness with your stakeholders; when you are ready, contact your Customer Success Manager or support representative to coordinate the migration.

Copy Assignments to Sandbox

Assignments are now copied from the parent tenant to a sandbox during sandbox creation or refresh. The copy includes seeded and custom assignments, as well as user-attribute and workflow-stage approval assignment mappings. After the copy, you can create additional assignments directly in the sandbox, helping you test assignment-dependent workflows in an environment that more closely reflects the parent tenant. This enhancement applies to sandboxes created after the 202609.1.0 release. If your sandbox was created before that release, refresh it before creating assignments.

For more information, see Sandbox Management Overview.

Notification Screen Table Design

The Notifications screen has been updated with a new table design by default, providing a consistent experience for managing in-app notifications.

Custom Role Limits

The custom role limit of 150 is now enforced when using the Import role option on the Roles screen.

Email Reminders for Pending User Email Updates

Administrators now receive email reminders for pending user email updates initiated via bulk import. Reminders are sent after 24 and 72 hours, with requests automatically canceled after 7 days to prevent import blockages. To clear long-standing requests already in the system, including requests pending for 5–6 years, OneTrust will remove these requests in an upcoming release. Before the cleanup, administrators will receive two reminder emails with the deadline to resolve the requests.

ABAC Assignments are now grouped and sorted

When users edit a user in Manage Access, assignments are now split into System and Custom groups. System assignments are listed from least to most access: Viewer, Editor, then Internal Owner.

Clearer messages for access options

New messages explain to users when an assignment has no access options set and explain what happens when users change an assignment's access option.

Organizations Listed First

In the Add Role modal, users can now pick the Organization before the Roles, so the roles they see match the organization chosen.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

New Assessment Automation APIs

Added the following APIs to support assessment navigation, workflow actions, child question response submission, unanswered question retrieval, attachment management, assigned assessment retrieval, linked assessment retrieval, and assessment search capabilities:

• Get Assessment Question Section API

• Perform Assessment Workflow Action API

• Submit Child Question Responses API

• Get Next Assessment Question API

• Manage Assessment Question Attachments API

• Get List of Assigned Assessments API

• Get List of Linked Assessments by Entity ID API

• Search Assessments API

Enhancements to Assessment Automation APIs

Updated the Assessment Automation APIs with the following enhancements:

• Updated the Get Assessment API to support the include query parameter. This enhancement enables retrieval of additional assessment datasets, including information requests, notes, and stage history.

• Updated the Get Assessment API and Get Assessment Record API to return additional assessment insights and review information, including information request metrics and records, flagged question counts and identifiers, and the questionResponseReviewStatus response object for AI and human review statuses.

• Updated the Launch Assessment API to support the oneAgent query parameter for OneAgent-specific assessment launch scenarios.

• Updated the Set Primary Record API to support the following custom entity types: MODELS, AISYSTEMS, AIAGENTS, DATASETS, PROJECTS.

Table Enhancements for Assessment Automation

Tables and table functionalities on the Assessments tab of the screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that caused assessments to display on both the Active and Completed tabs of the homepage when a user was assigned as both the respondent and the approver.

• Resolved an issue that prevented assessments from being exported as a PDF when created from a multilingual template containing multichoice questions with duplicate answer options.

• Resolved an issue that caused duplicate integration events to be triggered from a single assessment submission, resulting in the creation of a duplicate assessment.

• Resolved an issue that prevented assessment deadline reminder emails from being triggered after a deadline was updated.

• Resolved an issue that caused an error message to intermittently display when opening a custom email notification template after sorting the list on the Assessment templates screen.

New Public Preview Features

Information Request Data in Reports

You can now access information request data directly through reports. This enhancement streamlines tracking and analysis of requests without manual effort, and improves visibility and response times across your compliance workflows.

For more information, see Data Glossary for PIA & DPIA Automation Reports.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1: Foundations

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Privacy Automation.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Privacy Risk Agent | Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Template Updates

Things to Know

• You can now create rules during assignment creation in ABAC-enabled tenants to automatically assign the record admin. Rules support configuration based on specific values such as template or region and will ensure assessments have the correct owner from the start, reducing manual reassignment requirements.

• Duplicate answer options can no longer be created for multiple-choice questions within assessment templates.

• About Known Defects

  Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

Table Enhancements for Data Mapping Automation

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Assessments tab of the Projects > Inventory details screen

• Assessments tab of the Relationship details screen

• The following screens within the Inventory manager:

  • Inventory attribute lists

  • Personal data configuration attribute lists

  • Data element details screen when viewing discovery metadata for Data element attributes

  • Options tab of the Inventory manager screen for inventory attributes

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that caused duplicate relationships to be created between Projects, Assets, and Vendors when an assessment was reopened and resubmitted.

• Resolved an issue that prevented users from finishing an assessment review, due to duplicate email addresses displaying in a user attribute question.

• Resolved an issue that caused numeric values to display in assessment PDF reports instead of the configured display labels for numeric selection attributes.

• Resolved an issue that caused users to be incorrectly redirected to Data Mapping Automation when launching an assessment from a global search result, instead of IT Risk Management.

• Resolved an issue that prevented system user type attributes, such as Internal Owner, from adhering to the email attribute display setting in the Vendor details screens.

• Resolved an issue that prevented the Allow others checkbox from displaying for existing single-select project attributes.

• Resolved an issue that caused the Vendors screen to fail to load and instead display a loading spinner when updating multiple records.

• Resolved an issue that prevented users from being able to resize the Managing organization column on the Processing activities screen.

• Resolved an issue that prevented users with read-only access from copying Processing activity records in attribute-based access control (ABAC)-enabled tenants.

• Resolved an issue that caused related records to display in a single cell rather than in separate rows in column reports.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Privacy Automation.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Legacy Sharing vs ABAC Sharing

OneTrust is planning to transition customers from the legacy sharing experience to Attribute-Based Access Control (ABAC) sharing for Inventory objects. ABAC provides a more consistent and scalable access model, supports Assets, Processing Activities, Entities, Vendors, and Projects, and offers more advanced access-control options. 

If your tenant currently uses Legacy Share, your existing sharing configuration will continue to work until you are ready to transition. The migration is not automatic, and Legacy Share continues to take precedence for Inventory objects where both sharing models are available. Review your current sharing setup and discuss readiness with your stakeholders; when you are ready, contact your Customer Success Manager or support representative to coordinate the migration.

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review | Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

• <EMPTY> Tag when Bulk Importing Inventory Relationships

  If you want to clear a field when updating inventory relationships via bulk import, you must now add an <EMPTY> tag to the field. Deleting an entry and leaving the field blank will not overwrite existing data.

  For more information, see Using Bulk Update Templates.

• The record-level Attachments tab has been consolidated and renamed to Documents across all inventory types.

• A new email template is now available via Email branding and templates. The Project rules custom notification template can be used to trigger email notifications for Projects.

• About Known Defects

  Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

Table Enhancements for Data Subject Request (DSR) Automation

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following tabs and modals within the Data subject request details screen:

• Attachments tab

• Review file segments modal

• Structured data tab

• Items matching retention policy screen accessed via the Test policy button on the Retention policies screen (this table enhancement was introduced with the 202609.2.0 release)

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that caused renamed documents to display with their original names in the History tab of the Request details screen.

• Resolved an issue with the format of the dropId parameter in the DROP Management APIs. The dropId parameter is now correctly documented as an alphanumeric string of up to 12 characters instead of an integer.

• Resolved an issue with the list of enums for the SubtaskStatus request parameter in the Get List of Subtasks by Criteria API. The Deleted enum value was removed to correctly reflect supported subtask statuses.

Existing Public Preview Features

Manage DROP Requests with OneTrust

Leverage OneTrust's DROP support to automate DROP request intake and status reporting. This enhancement enables California-registered data brokers to automatically download hashed requests on a defined schedule and posts status updates back to DROP.

For more information, see Managing Delete Request and Opt-Out Platform (DROP) Requests and Creating a Workflow for Managing DROP Requests.

New DROP Management APIs

Added the Create Data Subject Request for DROP Record API, Update DROP Record API, and Get List of DROP Records API to create, update, and retrieve Delete Request and Opt-out Platform (DROP) requests, respectively. These APIs support California-registered data brokers in managing DROP requests for deleting or opting out data subjects permanently.

Things to Know

• A new Interaction logs screen is now available to review DROP processing activity. You can filter logs by status and operation type (upload, download, or amend) to monitor manual and automated interactions.

• The Form styling section of the web form builder now includes options to customize the background, border, and text colors for disabled Submit buttons. This allows organizations to ensure disabled buttons meet specific accessibility requirements and brand standards.

• Web forms accessed via legacy HTML URLs now automatically redirect to the current web form URL. This change will take effect once a web form has been republished.

• About Known Defects

  Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

Enable/Disable Status of Stage Rules and Workflow Rules

Users with permission to update rules can now enable or disable stage rules and workflow rules without deleting them. Disabled stage rules won't run when a workflow enters the stage, and disabled workflow rules won't run when their configured trigger occurs.

These enhancements will be available for the following Incident Management workflows:

• Incidents

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following Incident Management objects:

• Incidents

Fixed

• Resolved an issue that caused filtered exports of the Incident register to include all incidents when a custom attribute filter was applied.

• Resolved an issue that caused users without the Manage incident public views permission to be able to create public views on the Incident register screen.

• Resolved an issue that prevented assessments from being submitted when the Allow other option was enabled for the DPO attribute.

New Public Preview Features

Enhancements to Incident Management Web Forms

Copy an existing web form within an environment, delete web forms that are no longer needed, and export or import complete web form configurations between environments or tenants. These enhancements reduce the time and effort required to manage Incident web forms. You can now reuse existing configurations instead of recreating similar forms, remove outdated forms to keep environments organized, and move web forms between environments with greater consistency.

For more information, see Copying an Incident Web Form, Deleting an Incident Web Form, and Exporting and Importing Incident Web Forms.

Table Enhancements for Incident Management

Tables and table functionalities within the Risks tab of the Incident details screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Existing Public Preview Features

Table Enhancements for Incident Management

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Related tab of the Incident details screen

• Summary tab of the Incident details screen

• Jurisdictions tab of the Incident details screen

• Incident types screen

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Dynamic Incident Notification Assessment (DINA) Updates

• DINA 1.4.1 expands breach notification coverage of US insurance data security laws by adding support for Indiana, Hawaii, Tennessee, Pennsylvania, and Wisconsin. It also updates UK support to reflect the UK DUAA amendments, adds support for Sweden's NIS2 requirements, and prepares for upcoming changes to Vermont's data broker security breach and data breach notification laws.

• DINA 1.4.1 also updated breach notification requirements for Pennsylvania, Arizona, Spain, Greece, Iceland, Ireland, Hungary, Germany, Finland, France, Estonia, the Czech Republic, Cyprus, Denmark, Croatia, Bulgaria, Belgium, and Austria.

• The DINA Trigger Rules spreadsheet is being enhanced to improve usability. The updated version will be available in a future release.

Things to Know

• User groups can now be configured to receive email notifications for incident workflow actions. This enhancement means user groups can now receive notifications when an incident moves to the In progress stage.

  For more information, see: Adding Incident Workflow Rules.

• The Assignee filter on the Incident register screen now supports filtering by user groups in addition to individual users.

• Organizations now load according to the parent-child hierarchy configured in a web form's settings.

• About Known Defects

  Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

Enable/Disable Status of Stage Rules and Workflow Rules

Users with permission to update rules can now enable or disable stage rules and workflow rules without deleting them. Disabled stage rules won't run when a workflow enters the stage, and disabled workflow rules won't run when their configured trigger occurs.

These enhancements will be available for the following Audit Management workflows:

• Audits

• Findings

• Workpapers

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following AI Governance objects:

• Audits

• Findings

• Workpapers

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Fixed

• Resolved an issue that caused Initiative exports to download in an unreadable format when the initiative name contained special characters.

• Resolved an issue that caused the Preview attachment modal to remain blank when viewing PDF files within an Evidence Task Interval.

• Resolved an issue that prevented the Change workflow button from appearing on an Evidence Task Interval when in the first stage of a workflow.

• Resolved an issue that overwrote optional fields with blank values when using the Update evidence task implementations bulk import template if the corresponding columns were left empty.

Existing Public Preview Features

Stage & Workflow Rules for Seeded Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Standard / Control Framework Changes

Things to Know

Previous framework updates are now automatically removed when a framework is re-imported with the latest data to prevent duplicate control errors.

The Frameworks library now maintains organization hierarchy by displaying a control count of zero for standards and frameworks imported from other organizations when the user lacks viewing permissions.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

Enable/Disable Status of Stage Rules and Workflow Rules

Users with permission to update rules can now enable or disable stage rules and workflow rules without deleting them. Disabled stage rules won't run when a workflow enters the stage, and disabled workflow rules won't run when their configured trigger occurs.

These enhancements will be available for the following Enterprise Policy Management Workflows:

• Exceptions

• Policies

• Procedures

• Privacy Notices

• Standards

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following Enterprise Policy Management objects:

• Exceptions

• Policies

• Privacy Notices

• Procedures

• Standards

Fixed

• Resolved an issue that prevented the published modal from retaining the configured Document library settings from the previous published version. For example, if a user adds a policy to the Document library with the Visible to all users setting enabled in V1, then V2 will retain the setting configuration.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

AI-Powered Document Analysis |Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

• Controls

• Risks

• Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following Issues Management objects:

• Issues

Fixed

• Resolved an issue that caused an error to appear when clicking the View Source link for tasks created from an issue by correctly navigating users to the Risk product.

• Resolved an issue that caused inaccurate open issue counts to appear across assessment views, the Issue register, and exported reports.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Issues Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Orphaned issues created from assessment question-level rules are now automatically deleted when the related questions become invalid due to template updates.

Added API-level validation to block updates to Issues workflows past the close stage when Disable details edits is enabled in workflow settings.

Users can now unlink or delete automatically created issues when the corresponding assessment response changes to prevent irrelevant issues from remaining on the assessment.

Issues generated from assessment template-level rules now support re-evaluation when answers change. Users can now retain, delete, or unlink issues to ensure records accurately reflect the current state of the assessment.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Fixed

• Resolved an issue that caused an error to appear when attempting to unlink child risks in hierarchy configurations with more than five levels.

• Resolved an issue that prevented Site Admins from viewing comments on Control records.

Existing Preview Features

Standard / Control Framework Changes

Things to Know

The Related risks tab is now consistent across all products, matching the content, behavior, and visibility found within IT Risk Management.

Saved views on the Risk register and hierarchy list screens are now displayed in alphabetical and numeric-aware order to improve navigation and view selection.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

General Availability

Table Enhancements for Third-Party Risk Management

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Contracts screen

• Attachments tab of the Contract details screen

• Related tab of the Contract details screen

• Engagements screen

• Engagements tab of the Inventory Details screen

• The following tabs on the Engagement overview screen:

  • Assessments

  • Contracts

  • Documents

  • Risks

  • Related

  • Personal

  • Issues

For more information, seeTable Enhancements Across the OneTrust PlatformandTable Enhancements User Guide.

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following Third-Party Risk Management objects:

• Contracts

• Engagements

Fixed

• Resolved an issue that caused vendor change events to be published and downstream workflow rules to be reevaluated when formula evaluations resulted in no persisted value changes.

• Resolved an issue that prevented the External contact name and External contact email attributes from displaying on the Engagements tab of the Vendor details screen.

• Resolved an issue that prevented users from relating controls to vendor records on the Vendor details screen.

• Resolved an issue where the Vendor filter appeared in advanced filters on a vendor's Engagement tab and returned incorrect results.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Third-Party Management.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Third-Party Management.

Standard / Control Framework Changes

New Alabama Personal Data Protection Act Framework Added

The Alabama Personal Data Protection Act (APDPA), effective May 1, 2027, establishes a comprehensive framework for data privacy, ensuring that the personal data of Alabama residents is managed with care and transparency. This legislation grants consumers substantial rights over their personal data while defining clear requirements for businesses relating to privacy notices, consumer rights requests, targeted advertising, the sale of personal data, profiling, sensitive data, data minimization, processor obligations, and data security. We've made implementing the APDPA easy by offering the framework on our platform and ensuring users can benefit from its overlap with other frameworks that exist on our platform. The platform contains survey questions to help you define scope that will bring in all relevant policies, controls, control implementation guidance, and evidence tasks, including guidance, among others, to assist in meeting the requirements of the APDPA.

For more information, see Supported Control Frameworks.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Third-Party Risk Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

• The record-level Attachments tab has been consolidated and renamed to Documents across all inventory types.

• Breadcrumb navigation on the Issue details screen now dynamically reflects the user's entry path from either the Vendor details or Engagement details screen.

• DORA attributes are now locked and non-editable when a vendor record is overridden in hierarchy settings to maintain data integrity at the local level.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.