All Solutions Release Notes

Read the release notes for all solutions in this release.

AI Governance

AI Governance - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that caused single-select AI system attributes to be created as invalid multi-select attributes during bulk import when the Option Type was set to None.
Resolved an issue that caused AI Governance attribute values to be cleared, resulting in blank values in assessments when hidden data was set to be deleted.

New Public Preview Features

Performance and Operational Dashboard

Use the Performance Summary tab in the AI Governance Insights Dashboard to monitor AI agent and model usage, risk, PII exposure, and token consumption across your organization. This enhancement helps you identify the models and agents with the highest token consumption and the areas with the highest AI usage, so you can prioritize them for governance.

For more information, see Insights AI Governance Dashboard.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across AI Governance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for AI Governance.

Microsoft Copilot Studio Agent Detection

Automatically scan Microsoft Copilot Studio environments to detect agents and capture key metadata such as ownership, environment, model bindings, connected channels, and authentication settings. This creates a searchable inventory of Copilot Studio agents and their configurations in OneTrust, helping teams support governance, risk assessment, and audit readiness.

For more information, see AI Automation Feature Guide.

GenAI Component Intelligence for AI Models

Create and enrich AI model records by using the Model library with information from commonly used third-party AI models. This gives teams a continuously updated technical context to understand model behavior, assess suitability and risk, and start governance workflows without manual research.

For more information, see Creating and Managing AI Models.

AI Policy - Automation Actions

Configure automated actions for AI policies to automatically flag risks and send email notifications when AI models and agents violate policies. This enhancement helps governance teams reduce manual monitoring, streamline governance workflows, and respond more quickly to issues by triggering actions based on policy compliance outcomes.

For more information, see AI Policy Enforcement Guide.

Things to Know

Legacy Sharing vs ABAC Sharing

OneTrust is planning to transition customers from the legacy sharing experience to Attribute-Based Access Control (ABAC) sharing for Inventory objects. ABAC provides a more consistent and scalable access model, supports Assets, Processing Activities, Entities, Vendors, and Projects, and offers more advanced access-control options.

If your tenant currently uses Legacy Share, your existing sharing configuration will continue to work until you are ready to transition. The migration is not automatic, and Legacy Share continues to take precedence for Inventory objects where both sharing models are available. Review your current sharing setup and discuss readiness with your stakeholders; when you are ready, contact your Customer Success Manager or support representative to coordinate the migration.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Consent & Preferences

Cookie Consent - September 25, 2026 - 202609.2.0

General Availability

TCF 2.4 Template

Configure your CMP with the IAB TCF 2.4 template. This updated template features revised IAB requirements, updated disclosures, consent-scope messaging, framework-driven purpose content, and support for multi-device and cross-domain consent scenarios across web, mobile, and CTV implementations. These updates are designed to improve your compliance with the latest version of IAB TCF requirements.

For more information, see Implementing TCF on your Website.

Fixed

Resolved an issue that caused the full Global IAB Vendor List to display instead of the filtered vendor list after changing the banner language.
Resolved an issue that prevented Google Tag Manager (GTM) consent states from reflecting users' Global Privacy Control (GPC) status upon the initial page load.
Resolved an issue that prevented templates from being saved correctly after modifying App Tracking Transparency (ATT) Purpose or bundle group configurations.
Resolved an issue that prevented some cookies from displaying with the correct custom description on the preference center.
Resolved an issue that produced 401 Unauthorized errors when users forwarded authenticated, known-user consent receipts.
Resolved an issue that prevented purposes from displaying in Norwegian Bokmål (NB) on the Purposes screen.
Resolved an issue that caused past dates to display as the next scheduled scan date on the Websites screen and in website exports.
Resolved an issue that caused a persistent overlay to block user interaction on websites with a Content Security Policy (CSP).

addendum: This release note was added on October 2, 2026.
Resolved an issue that incorrectly recorded the transaction type as "Not Given" when a user provided consent on the banner after closing the preference center.

addendum: This release note was added on October 16, 2026.

Existing Public Preview Features

New CMP Experience

Enable the New CMP Experience setting to leverage the redesigned Cookie Consent interface. This new interface streamlines multiple interfaces within Cookie Consent to create a unified experience that improves navigation and makes it easier to deploy and manage your CMP.

Note:

You can enable this preview feature using an in-app setting within Global Settings

For more information, see Enabling the New CMP Experience.

Global Opt-Out Flow

|Available with Solution Packaging Only

Enable end users to opt out of a purpose across all of their linked devices, services, and accounts at once using the Global opt-out settings in your preference center template. This feature enables your end users to opt out of a purpose associated with their account and automatically submits a DSR request to process their opt-out from the specified purpose or purpose group. This enhancement is designed to improve your compliance with California privacy law.

For more information, see Customizing the Preference Center Template. This feature is related to the following ideas: OT-I-9627.

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.4 Templates

Enable the Global Privacy Platform setting on TCF 2.4 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

Screen readers now correctly announce search result quantities in the published banner language when searching the vendor list (WCAG‑A 1.3.1: Info and Relationships).

Things to Know

Section 6 of the Global Privacy Platform (GPP) is now populated in the US privacy string for web-based CMPs.

TheIAB Tech Lab - Global Privacy Protocol (GPP)andGenerate state specific stringsettings are now available to enhance GPP compliance when configuring geolocation rules for the following US states:

Indiana
Kentucky
Maryland
Minnesota
Rhode Island

ThePublishpane on theScriptsscreen now includes theShow CCPA out-out iconsetting, which allows you to display a CCPA-specific opt-out icon when deploying scripts with the following templates in addition to CCPA and CPRA templates:

Colorado Privacy Act (CPA)
Connecticut Privacy Act (CTDPA)
Maryland Online Data Privacy Act (MODPA)
Oregon Consumer Privacy Act (OCPA)
US Multi-State - 2.0
US National
Utah Consumer Privacy Act (UCPA)
Virginia Consumer Data Protection Act (CDPA)

Cookie hosts now display on theCookieselection menu of theBlock source URLmodal to improve clarity when linking cookies to source URLs during Auto-Blocking configuration.

Tracking technology exports now display the website name in the export's file name when a single domain filter is applied before exporting.

addendum: This release note was added on October 2, 2026.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Mobile & OTT/CTV App Consent - September 25, 2026 - 202609.2.0

Fixed iOS

Resolved an issue that removed appTrackingTransparency from the OT-Consent-String after a user logged out and transitioned to an anonymous context.

Fixed Android

Resolved an issue that prevented bundle group purposes from correctly reflecting the consent status of their parent purpose when Age Gate was enabled for the parent purpose.

Fixed LG TV

Resolved an issue that prevented users from scrolling back to the top of the preference center after applying focus to the consent preferences buttons.

Fixed Samsung TV

Resolved an issue that prevented users from scrolling back to the top of the preference center after applying focus to the consent preferences buttons.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are available for retrieving the interface attributes needed to display the banner and preference center, retrieving active IAB and Google vendor information, logging consent interactions, and submitting global opt-out data subject access requests. These APIs enable developers to retrieve the data required for banner and preference center experiences, disclose vendor information to end users, capture consent preferences, and support Global Opt-Out workflows across devices and services.

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

iOS
Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

|Available with Solution Packaging Only

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

This feature is available for the following platforms:

iOS
Android
Apple TV
Android TV

Enable Global Privacy Protocol on TCF 2.4 Templates

Enable the Global Privacy Protocol setting on TCF 2.4 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

Android
Android TV
Apple TV
HTML5
iOS
Roku
Unity
Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Accessibility Conformance

Screen readers now announce the email input field label when the field receives focus on Roku TV (WCAG‑A 1.3.1: Info and Relationships).

addendum: This release note was added on October 2, 2026.

Things to Know

: Age Gate-restricted purposes now display on the preference center alongside a static, disabled purpose-level consent toggle and text explaining the purpose cannot be enabled. Additionally,toggleDisableHintsis now available in the general section ofageGatein application data to provide clear messaging when a consent purpose is disabled due to age range restrictions, along with its aria label keydisabledToggleAriaLabel.
: Aria labels are now present for close button in theGlobal opt-outmodal for iOS and tvOS implementations.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Notice Management - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that prevented some privacy notices from correctly loading when accessed via shared links.

addendum: This release note was added on October 2, 2026.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Universal Consent & Preference Management - September 25, 2026 - 202609.2.0

General Availability

Enhancements to Consent Receipts APIs: Updated the Create Consent Receipts API, Create Identified Consent Receipts API, and Create Consent Receipts in Bulk API to support the InteractionDate request parameter under the purposes object. This enhancement enables purpose-level consent interactions to be recorded independently, providing more granular consent tracking, auditing, and reporting. This enhancement also streamlines bulk importing for consent receipts by reducing the number of receipts required.

Fixed

Resolved an issue that prevented data subject profile updates and withdrawals from processing when custom data element names contained invisible characters, such as zero-width spaces.
Resolved an issue that caused the Double Opt-In (DOI) retry scheduler to send confirmation emails beyond the configured maximum retry limit.
Resolved an issue that caused the Update Data Subject Group V4 API to return an error when allowed primary identifier types contained spaces.
Resolved an issue that overwrote the primary identifier type on a data subject profile with the secondary identifier type when submitting consent via a Dynamic Collection Point.

addendum: This release note was added on October 2, 2026.

Existing Public Preview Features

CMP Consent Context: Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Use Governance

Data Catalog - September 25, 2026 - 202609.2.0

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Data Discovery - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that caused exported Terms reports to include terms and data sources from all organizations instead of only the selected organization.

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease the attack surface, and improve your security posture, with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Platform Capabilities

Dashboards & Reporting - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that caused PDF reports for processing activities to remain in an open status.
Resolved an issue that caused Risk register exports to appear empty in Excel when filters were applied to the screen.
Resolved an issue that prevented the Advance filter modal from loading correctly on the Reports list screen.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing ABAC-enabled reporting as part of Attribute-Based Access Control (ABAC) Phase 1: Foundations. ABAC-enabled reporting extends record-level access controls into supported reporting experiences by using assignments through sharing, attributes, or workflows to determine which report data users can access. This feature introduces assignment-aware reporting for supported objects, helping organizations align report visibility with operational access controls, support least-privileged access, improve governance, and provide more consistent reporting experiences.

For more information on ABAC, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC-enabled reporting is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects and reporting experiences.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Reporting Considerations for Attribute-Based Access Control (ABAC).

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

AI Governance inventories:
- AI systems
- Datasets
- Models
- Projects
Assessments
CMP time series
Consent time series
Contracts
Controls / Control implementations
Engagements
Incidents
Inventories:
- Assets
- Entities
- Processing activities
- Vendors
Issues
Privacy requests and subtasks
Risks

Note:

This feature does not currently support consent data subject details.

For more information, see Using Conversational Analytics Insights Chatbot.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Global Data Manager - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that prevented assessment response exports from completing when transfer mechanism attributes were included.
Resolved an issue that caused an incorrect event trigger count to display on Workflow details screens for Projects.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Integrations - September 25, 2026 - 202609.2.0

Existing Public Preview Features

Key Pair Rotation

Refresh expiring Snowflake key pairs directly from the credentials flow instead of replacing them manually outside of OneTrust. Expiration reminder emails help teams rotate keys on time and maintain authentication continuity during the transition to the new key pair.

For more information, see Rotating Key Pairs for Integrations Credentials.

AI-Powered Individual Log Error Analysis

|Available with Solution Packaging Only

Identify failed actions with AI-powered error summaries, root cause explanations, and actionable recommendations inside the log. This allows you to see exactly which workflow step failed, the type of error, and suggested next steps, which enables you to resolve issues faster and more confidently.

For more information, see Using Integration Logs.

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the new Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Settings & Administration - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that prevented failed emails from being reprocessed when using the Retry All Failed Emails option for events with database-stored notification content.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

ABAC Phase 1: Foundations is available for supported objects across AI Governance, Privacy Automation, Tech Risk & Compliance, and Third-Party Management, and introduces the following core capabilities to manage record-level access and collaboration:

Basic Role: : Use the new minimal-access Basic role available on theRolesscreen to configure users with access only to the OneTrust Platform homepage, supporting least-privileged access from the start.
Assignments: : Leverage out-of-the-box or custom assignments, which are sets of permissions that define what users can do on a record. Assignments can be applied through record sharing or inherited through user attributes and workflow stages to automatically grant record-level permissions for owners, approvers, reviewers, and other users involved in the record lifecycle.
Sharing, Requesting & Managing Access: : Share records directly with users, request access to records, review who currently has access, and modify or revoke access as needed.
Record-Level Auditing: : Review audit history for record access and assignment configuration changes to understand what changed, who made the change, and when the change occurred.

ABAC helps organizations manage access more precisely by aligning permissions to records and assignments rather than relying on increasingly complex role structures. This enables granular record-level access control, improves governance, and simplifies collaboration across teams and workflows. With this enhancement, administrators can reduce access-management complexity while strengthening security and accountability across the OneTrust Platform.

For more information, see Attribute-Based Access Control (ABAC) User Guide. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0, with support initially available for a subset of objects and functionality. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

OneTrust Activity Log

Gain a unified, real-time view of user and system audit events across the OneTrust Platform with the Activity logs screen to increase visibility and control, investigate issues faster, and meet compliance requirements with a complete, traceable audit trail. Through a centralized audit experience, teams can quickly search and filter audit records, monitor activity across solutions from a single location, and export audit data for broader reporting and analysis.

For more information, see OneTrust Activity Log.

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

Task Add Attachment
Task Add Comment
Task Created
Task Deleted
Task Remove Attachment
Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Permissions

Users who receive permission to export a document through an assignment can now download the exported file from the related in-app notification, even when they do not have the File read permission. This ensures that users can access documents they are authorized to export.

Things to Know

Legacy Sharing vs ABAC Sharing

Platform Navigation Enhancements

OneTrust has updated the navigation menu throughout the platform to align with recent branding updates and provide a more streamlined user experience. You can now collapse product menus to make it easier to focus on your currently selected product.

Note:

This is a visual enhancement only and does not impact platform functionality.

TheActivity Logscreen for Global Activity now displays all activities from the last 30 days by default.

TheActivitytab for Organizations now includes an event type filter. This allows you to filter the activity stream by specific action types like organization created, deleted, moved, or deleted.

TheUser activityscreen for Users now includes an event type filter. This allows you to filter the activity history by specific event types such as User created, Role added, User deactivated and more.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Automation

Data Mapping Automation - September 25, 2026 - 202609.2.0

General Availability

Table Enhancements for Data Mapping Automation

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

Assessments tab of the Inventory details screen
Risks tab of the Inventory details screen
Policies tab of the Inventory details screen
Local version tab of the Inventory details screen
Contracts tab of the Inventory details screen
Recycle bin accessed via the Inventory list screen
Attributes list on the Asset attributes tile of the Inventory manager screen
Attributes list on the Process attributes tile of the Inventory manager screen
Attributes list on the Entity attributes tile of the Inventory manager screen
Attributes list on the Vendor attributes tile of the Inventory manager screen
The Options tab of any single- or multi-select custom attribute in the Attributes list of the Inventory manager screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that prevented Data Transfer fields from populating in reports when relationships had a processing activity as the context process.
Resolved an issue that prevented related inventories from populating correctly in column reports when multiple relationships existed between the same entities.
Resolved an issue that allowed the bulk import of attributes containing unsupported response types, which prevented the attributes from being updated.
Resolved an issue that prevented a deleted inventory item from being restored when the item had the same external ID as an existing inventory item.
Resolved an issue that prevented the Data dictionary tab from displaying on the Inventory details screen.
Resolved an issue that prevented Attribute-Based Access Control (ABAC) assignments linked to the IT Owner attribute from persisting after saving.
Resolved an issue that prevented data elements displayed in an assessment response from displaying as selected in the Manage data elements modal due to case-sensitive name matching.
Resolved an issue that caused custom personal data attribute names to display as customField#### rather than their defined names in the Insights dashboards.
Resolved an issue that caused a Page not found error to display when selecting project inventory records from Global Search results.

addendum: This release note was added on October 2, 2026.
Resolved an issue that prevented customized column selections and widths on the Assessments tab of the Vendor details screen from being retained after refreshing the screen.

addendum: This release note was added on October 2, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Privacy Automation.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Legacy Sharing vs ABAC Sharing

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Incident Management - September 25, 2026 - 202609.2.0

New Public Preview Features

Table Enhancements for Incident Management

Related tab of the Incident details screen
Summary tab of the Incident details screen
Jurisdictions tab of the Incident details screen
Incident types screen

Note:

Select tables across Incident Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Assessment Automation - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that incorrectly displayed the Add rule button on data risk assessment templates when the template was not in Draft status.
Resolved an issue that prevented Yes/No question responses from translating correctly when templates were imported with capitalized response values.
Resolved an issue that caused a network error message to display, preventing users from accessing control assessments.
Resolved an issue that caused responses to attribute questions to lose formatting and merge into a single paragraph when exported to a PDF report.
Resolved an issue that prevented the View issue popover from displaying with correct alignment and scrolling support.
Resolved an issue that prevented the template service from starting in On-Premises environments.
Resolved an issue that prevented the Send button from displaying for users with custom roles when trying to send an information request within an assessment.
Resolved an issue that prevented users from updating incident assessments when copying and pasting content from external sources into the text editor.
Resolved an issue that caused the Assessment creator to be incorrectly assigned as the Record admin when launching assessments from the Self-Service Portal in Attribute-Based Access Control (ABAC)-enabled tenants.

addendum: This release note was added on October 2, 2026.
Resolved an issue that caused the Revert back to AI answer button to be incorrectly enabled for attribute-type questions and return an error when clicked.
Resolved an issue that prevented AI-suggested responses from populating for attribute-type questions when accepted on an assessment.
Resolved an issue that prevented assessments created via template action rules from correctly updating to the latest template version.
Resolved an issue that allowed manual assessment reminders to be sent without a selected approver scope, which prevented intended approvers from receiving the reminder.
Resolved an issue that prevented changes to the Disable notification toggle from being saved when customizing email notifications via Global Settings.

addendum: This release note was added on October 2, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Privacy Risk Agent

|Available with Solution Packaging Only

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Template Updates

AI Intake Assessment Lite v1.1 Change Log

Added a new answer option to question 1.8 ('Generation of non-consensual sexual and intimate content or child sexual abuse material').

Things to Know

Assessment submissions and approval actions now validate for date consistency and HTML safety. The platform now returns specific error codes and highlights affected questions and sections in theAssessmentsscreen when validation fails.

Names and tags containing special or unified characters now display correctly on list screens.

Legacy Sharing vs ABAC Sharing

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Privacy Rights Automation - September 25, 2026 - 202609.2.0

Fixed

The request schema for the Add Targeted Data Discovery Results Summary to Request API has been updated to correctly reflect supported functionality. The isRedact request parameter has been removed from the API documentation because attachment redaction is supported only by the Add Data Points to Targeted Data Discovery Results Summary API.
Resolved an issue that prevented the Delete Request and Opt-out Platform (DROP) requests intake process from starting immediately after saving API key and sync frequency settings.
Resolved an issue that prevented scheduled DROP intakes from triggering correctly when configured for intervals longer than 31 days.
Resolved an issue that prevented redacted files from displaying as Reviewed even after all pages had been reviewed, and prevented the page counter from accurately reporting the number of pages reviewed.

addendum: This release note was added on October 2, 2026.

Existing Public Preview Features

Table Enhancements for Results Summary

Attachments tab
Review file segments modal
Structured data tab
Suggested Redactions tab

Note:

Select tables across Privacy Rights Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Manage DROP Requests with OneTrust

Leverage OneTrust's DROP support to automate DROP request intake and status reporting. This enhancement enables California-registered data brokers to automatically download hashed requests on a defined schedule and posts status updates back to DROP.

For more information, see Managing Delete Request and Opt-Out Platform (DROP) Requests and Creating a Workflow for Managing DROP Requests.

New DROP Management APIs

Added the Create Data Subject Request for DROP Record API, Update DROP Record API, and Get List of DROP Records API to create, update, and retrieve Delete Request and Opt-out Platform (DROP) requests, respectively. These APIs support California-registered data brokers in managing DROP requests for deleting or opting out data subjects permanently.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Tech Risk and Compliance

Compliance Automation - September 25, 2026 - 202609.2.0

General Availability

Table Enhancements for Compliance Automation

Assessments tab
Contracts tab
Local version tab
Policies tab
Recycle bin accessed via the Inventory list screen
Risks tab

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that prevented Observation start date and Observation end date values from displaying on insights dashboards.

addendum: This release note was added on October 2, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Restore Deleted Inventory Records

For more information, see Restoring Deleted Inventory Records.

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Standard / Control Framework Changes

Connecticut Data Privacy Act (CTDPA) Framework Updated: Framework content has been updated to incorporate amendments to the Connecticut Data Privacy Act. Updates include expanded deletion rights for certain publicly available information and related inferences, restrictions on the sale of precise geolocation data, expanded purpose limitation requirements, and new requirements governing certain uses of facial recognition technology.

Things to Know

: Evidence task comments are now visible consistently regardless of the collection date or the screen used to open the task.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Enterprise Policy Management - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that caused blank spaces to display between custom attributes on the My exceptions screen of the Employee Portal.
Resolved an issue that prevented the ID hyperlink in custom exception column reports from routing to the exception record.

addendum: This release note was added on October 2, 2026.
Resolved an issue that prevented users from viewing or updating task collaborators after an exception task was created.

addendum: This release note was added on October 2, 2026.
Resolved an issue that prevented some documents from correctly loading when accessed via shared links.

addendum: This release note was added on October 2, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

Controls
Risks
Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Issues Management - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that caused an error to appear when clicking the View Source link for tasks created from an issue by correctly navigating users to the Risk product.

addendum: This release note was added on October 2, 2026.
Resolved an issue that prevented users from filtering by status on the Issue register screen.

addendum: This release note was added on October 2, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Issues Management. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

IT Risk Management - October 1, 2026 - 202609.2.2

Patch Updates

Resolved an issue that prevented users from relating risks to controls or issues when using the Risks tab of the Control details screen or the Related tab of the Issue details screen.

Third-Party Management

Third-Party Due Diligence - September 25, 2026 - 202609.2.0

Fixed

Resolved an issue that caused seeded Dow Jones results pending review views to display a third party with one pending review after all screening results had been reviewed.

Permissions

Permission changes have been implemented to improve platform usability and administrative efficiency.

For more information, see Permissions Release Notes: Third-Party Due Diligence. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

Third-Party Risk Management - September 25, 2026 - 202609.2.0

General Availability

Table Enhancements for Third-Party Risk Management: Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:
Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

Resolved an issue that prevented HackNotice news-feed items from displaying their full text in an empty source URL.
Resolved an issue that prevented the Search Contracts API from returning configured contract attribute values in the attributeValues object of the response.
Resolved an issue where the Delete vendor workflows permission displayed a dash (-) in the License column even though assigning it consumed a Third-Party Management/Admin User license. The licensing requirement is now clearly displayed.
Resolved an issue preventing users from saving or canceling edits to existing assessment routing rules in Third-Party Risk Management.

addendum: This release note was added on October 2, 2026.
Resolved an issue where the Assessment tab on the Vendor details screen would display a blank page or Page Not Found error when accessed from global search.

addendum: This release note was added on October 2, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Note:

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Third-Party Management.

Standard / Control Framework Changes

Connecticut Data Privacy Act (CTDPA) Framework Updated: Framework content has been updated to incorporate amendments to the Connecticut Data Privacy Act. Updates include expanded deletion rights for certain publicly available information and related inferences, restrictions on the sale of precise geolocation data, expanded purpose limitation requirements, and new requirements governing certain uses of facial recognition technology.

Things to Know

: TheEngagementstab within theVendor detailspage has now been updated to the new table format.
: TheDocumentstab within theInventory detailsof a third party now includes a document-source selector with two options:Supporting documentsandEngagement attachments.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.