All Solutions Release Notes

General Availability

Preserve/Delete Hidden Data to AI Governance Objects

Control how hidden responses are handled in AI Governance inventory assessments with the Preserve/Delete Hidden Data setting, matching behavior available for other inventory-based assessments.

For more information, see Preserving or Deleting Hidden Data.

Workflow List Table Experience Updates

Workflow list tables have been enhanced to deliver a more consistent and intuitive table experience. This update includes:

• Visible ascending and descending sort arrows to make sort direction easier to recognize at a glance

• A column picker that gives users more control over which columns are displayed in the table

• A repositioned context menu on the left side of the table to support a more consistent and easier-to-find interaction pattern

These enhancements will be reflected on the workflow list tables for the following objects:

• AI agents

• AI systems

• Models

• Projects

Send Notifications to User Groups

Select a group in the Assignee field of a Send notification rule action. This helps route workflow notifications to all relevant team members across standard workflows.

This enhancement will be available for the following objects:

• AI agents

• AI systems

• Models

• Projects

Assign Tasks Using User-Type Attributes

Assign tasks with the Create task stage rule action to either system users or eligible single-select, user-type attributes. This workflow update allows you to dynamically route tasks to the right users while preserving existing task-assignment behavior.

This enhancement will be available for the following objects:

• AI agents

• AI systems

• Models

• Projects

New AI Governance Attribute Management APIs

Added APIs to retrieve AI Governance schema definitions, schema attributes, and attribute option values. These APIs enable developers to programmatically discover schema structures, access attribute metadata, and retrieve available attribute options for AI Governance workflows.

• Get List of Schemas API

• Get Attribute by ID API

• Get List of Schema Attributes API

• Get List of Schema Attribute Options API

Enhancements to the Create Task API

Updated the Create Task API to support the ai-governance value for the moduleSource request parameter. This enhancement enables tasks to be created and associated with AI Governance workflows.

Table Enhancements for AI Automations

Tables and table functionalities on the AI automations screen have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that redirected users to the Archived assessments screen after approving an assessment instead of returning them to the Assessments screen.

• Resolved an issue that automatically applied the Type = AI filter on the Projects screen despite the filter not being configured in the saved view.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across AI Governance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for AI Governance.

Microsoft Copilot Studio Agent Detection

Automatically scan Microsoft Copilot Studio environments to detect agents and capture key metadata such as ownership, environment, model bindings, connected channels, and authentication settings. This creates a searchable inventory of Copilot Studio agents and their configurations in OneTrust, helping teams support governance, risk assessment, and audit readiness.

For more information, see AI Automation Feature Guide.

GenAI Component Intelligence for AI Models

Create and enrich AI model records by using the Model library with information from commonly used third-party AI models. This gives teams a continuously updated technical context to understand model behavior, assess suitability and risk, and start governance workflows without manual research.

For more information, see Creating and Managing AI Models.

AI Policy - Automation Actions

Configure automated actions for AI policies to automatically flag risks and send email notifications when AI models and agents violate policies. This enhancement helps governance teams reduce manual monitoring, streamline governance workflows, and respond more quickly to issues by triggering actions based on policy compliance outcomes.

For more information, see AI Policy Enforcement Guide.

Things to Know

TheSet up automationbutton has been moved to the top of theAI automationsscreen for better visibility, and the info icon has been removed from theContext menubecause it is not supported in the new enhanced table.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Enhancements to the Publish Script to Website API

Updated the Publish Script to Website API to include the ccpaOptOutEnabled request parameter. This parameter controls whether the CCPA/CPRA opt-out icon is displayed alongside the Do Not Sell or Share button when presented to site visitors.

Fixed

• Resolved an issue that prevented the search functionality within the preference center from returning results when users searched for first-party cookies using the host name.

• Resolved an issue that caused the the focus indicator to display with inconsistent appearance when navigating the preference center with assistive technologies.

• Resolved an issue that caused the vendor count to display as 0 on IAB-configured preference centers if the Use audience logic setting was enabled in the geolocation rule.

• Resolved an issue that displayed text on the IAB TCF 2.3 template with an incorrect translation when configured in Finnish.

• Resolved an issue that prevented the Cookie banner screen reader value (dialog) field from retaining entered values when configuring templates.

• Resolved an issue that caused an incorrect "Cookie purpose name must be unique" error when reverting purpose names in the Amharic language.

• Resolved an issue that caused buttons on the preference center to display with excessive white space.

  addendum: This release note was added on September 11, 2026.
• addendum: The release note pertaining to saving template configurations with App Tracking Transparency (ATT) purpose links or bundle groups was removed on September 11, 2026.

Existing Public Preview Features

Global Opt-Out Flow

|Available with Solution Packaging Only

Enable end users to opt out of a purpose across all of their linked devices, services, and accounts at once using the Global opt-out settings in your preference center template. This feature enables your end users to opt out of a purpose associated with their account and automatically submits a DSR request to process their opt-out from the specified purpose or purpose group. This enhancement is designed to improve your compliance with California privacy law.

For more information, see Customizing the Preference Center Template. This feature is related to the following ideas: OT-I-9627.

New CMP Experience

Enable the New CMP Experience setting to leverage the redesigned Cookie Consent interface. This new interface streamlines multiple interfaces within Cookie Consent to create a unified experience that improves navigation and makes it easier to deploy and manage your CMP.

For more information, see Enabling the New CMP Experience.

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

• Focus now correctly returns to the correct triggering element after closing the preference center or vendor list using the Esc key (WCAG‑A 2.4.3: Focus Order).

• Screen readers now correctly announce banner descriptions when the banner displays (WCAG‑A 1.3.1: Info and Relationships).

Things to Know

TheServicestab has been removed from theTracking technologiesscreen and can now be accessed directly from theVendor servicestab on theCookie Consentmenu.

The following locale codes are now available when configuring custom translations for the CMP:

• SR-RS (Serbian – Serbia)

• KK-KZ (Kazakh – Kazakhstan)

• RU-KZ (Russian – Kazakhstan)

Consent synchronization for logged-out and authenticated users has been improved to ensure consent statuses are reported accurately and prevent the banner from reappearing unexpectedly after login.

addendum: This release note was added on September 11, 2026.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed API

• Resolved an issue where IAB TCF and GPP consent string values were not recomputed when an Age Gate was enabled after a user had already provided consent. Consent strings are now correctly recalculated when Age Gate or App Tracking Transparency (ATT) conditions change, ensuring generated consent signals accurately reflect the user's current consent eligibility and preferences.

• Resolved an issue that caused general vendor consent calculations linked to purposes to use consentToggleStatus instead of consentStatus. Vendor consent values are now calculated using the correct consent state.

• Resolved an issue that allowed AGEGATE_RANGE interactions to be created without a valid age range. CMP API responses now include ERROR_CODE_AGE_RANGE_REQUIRED for the code parameter and At least one age bound (lower or upper) must be provided for the message parameter. This change ensures age range interactions include at least one valid age bound.

Fixed Android

• Resolved an issue that prevented the consent status for General Vendors from changing when end users updated the consent status of a linked bundle group.

Fixed Roku

• Log messages in Info.OneTrust for the Roku SDK have been updated to indicate when Age Gate is not initialized. This more clearly communicates that Age Gate was not ready when an action was attempted and helps distinguish the condition from an error.

  addendum: This release note was added on September 11, 2026.

New Public Preview Features

Enhancements to Consent Management Platform (CMP) APIs 

The following enhancements have been made to the CMP APIs: 

• Added the closeButtonAriaLabel key to globalOptOutData, mapped from GlobalOptOutFormIntegration.GlobalOptOutCloseButtonAriaLabel. This provides accessibility support for the Global Opt-Out close button in the CMP APIs.

• addendum: The release note pertaining to web device type support for the Get Banner Data API was removed on September 25, 2026.
• addendum: The release note pertaining to optimized vendor filtering logic was removed on September 25, 2026.
• addendum: The release note pertaining to per-request caching for purpose data retrieval was removed on September 25, 2026.

Existing Public Preview Features

Consent Management Platform APIs

The following APIs are available for retrieving the interface attributes needed to display the banner and preference center, retrieving active IAB and Google vendor information, logging consent interactions, and submitting global opt-out data subject access requests. These APIs enable developers to retrieve the data required for banner and preference center experiences, disclose vendor information to end users, capture consent preferences, and support Global Opt-Out workflows across devices and services.

• Get Banner Data API

• Get Preference Center Data API

• Get IAB and Google Vendors API

• Log Consent API

• Get Universal Consent Purposes API

• Submit Global Opt-Out Request API

Roku Support for Unified Consent Profile for Known Users

Leverage the new Unified Consent Profile for Known Users functionality to connect data subjects' CMP preferences with Universal Consent & Preference Management profiles by enabling the Create data subject profiles for known users setting on the Geolocation Rules tab. You can also easily trigger integration workflows to send CMP preferences to downstream systems, and efficiently manage your preferences in a unique Preference Center, centralizing all of them in one single profile.

This enhancement provides a comprehensive view of data subjects empowering you with more control over the data captured across both modules, resulting in a more streamlined and tailored user experience.

For more information, see Connecting CMP preferences with Universal Consent & Preference Management Profiles.

Configure Button Layout for the Banner

Configure the positioning of buttons on your mobile and CTV banners within the Button Sets section of the Template Details screen. This enhancement allows you to specify the positioning of buttons on your banners for a more customized experience.

• iOS

• Android

For more information, see Customizing the Mobile App Consent Banner Template and Customizing the Mobile App Consent Preference Center Template.

Enhanced Branding Settings for Mobile and CTV SDKs

Configure detailed branding settings for your mobile SDKs on the Branding tab of the Mobile App Details and CTV App Details screen, respectively. This enhancement enables you to configure more specific branding settings for each of your mobile and CTV applications.

For more information, see Configuring Mobile and CTV App Branding.

Validation for Cross-Device Consent Receipts

Enable the Require Authentication for known users setting when leveraging Cross-Device Consent to require validation on your consent receipts. This enhancement allows you to more reliably collect consent from known users.

For more information, see Configuring Geolocation Rules.

Note:

This enhancement is only available to users with the Consent Rate Optimization (CRO) add-on package. Contact OneTrust Support or your account representative to enable this functionality.

To learn more, see Maximize Opt-Ins with Consent Rate Optimization.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

This feature is available for the following platforms:

• iOS

• Android

• Apple TV

• Android TV

Enable Global Privacy Protocol on TCF 2.2 Templates

Enable the Global Privacy Protocol setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Protocol (GPP) and populate the IAB TCF EU section of the GPP string.

This feature is available for the following platforms:

• Android

• Android TV

• Apple TV

• HTML5

• iOS

• Roku

• Unity

• Xamarin

For more information, see Configuring the Global Privacy Protocol Settings.

New Reject All Button Configuration

Enable the updated Reject All button configuration on the Preference Center template. This new configuration ensures that legitimate interest is not impacted for customers using Google Ads.

For more information, see Customizing the Mobile App Consent Preference Center Template.

Things to Know

ThesetOTOfflineData()method is now available for use with the React Native SDK on Android and iOS devices.

The Android SDK now supports more consistent network reconnection to improve connectivity resilience when encountering suboptimal network conditions or functioning offline.

addendum: This release note was added on September 11, 2026.

Banner QR codes now display with fixed width on tvOS devices to prevent text truncation and layout inconsistencies.

addendum: This release note was added on September 11, 2026.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Integration Event Trigger for Data Subject Profile Merge Completion

Leverage the new Data Subject Merge Completed event type when building integration workflows in Integrations. This event is triggered when a data subject profile merge has been completed.

For more information, see Consent Integration Events. This feature is related to the following ideas: CD-I-160.

addendum: This release note was added on September 11, 2026.

Enhancements to Bulk Export APIs

Updated the Bulk Export APIs with the following enhancements:

• Updated the Create Bulk Export API to support the ANONYMOUS_RECEIPTS export type, enabling bulk exports of anonymous consent interaction data. This enhancement introduces a dedicated export path for anonymous receipt records, separating anonymous traffic from identified receipt exports.

• Updated the Create Bulk Export API and Get Bulk Export Status API to support the collection point type filter option within the params object of the request. This filter enables receipt exports to be filtered by collection point type, such as WEB_FORM, MOBILE_APPLICATION, API, COOKIE, TRUST_CENTER, and more.

• Updated the Create Bulk Export API to separate identified and anonymous receipt data into the appropriate exports and improve the data available through the Anonymous Receipt bulk export. The API will now behave in the following manner:

  • COOKIE_RECEIPTS exports now return only identified cookie receipt data and no longer include anonymous receipt records.
  • ANONYMOUS_RECEIPTS exports now serve as the dedicated export type for anonymous receipt data and have been enhanced to return decrypted dataSubjectIdentifier, geolocation, and dsDataElements values, as well as the additional otJwtVersion, receiptJwt, and isAnonymous fields.
  • CONSENT_RECEIPTS exports now return all identified receipt data, including identified cookie receipts, when the collectionPointType filter is not specified.
  addendum: This release note was added on October 16, 2026.

Enhancements to Consent Receipts APIs

Updated the Create Consent Receipts API to include the ReactivationDate request parameter to specify when a withdrawn or opted-out consent purpose should be automatically reactivated. This parameter supports temporary consent withdrawal scenarios by allowing consent to be reactivated on a specified date and time.

Fixed

• Resolved an issue that prevented the Get Bulk Export Status API from returning the correct value for the recordCount parameter when filter criteria was applied using the params object.

• Resolved an issue that caused the Get List of Receipts V2 API to return isValid: true for the purposeNote object when a purpose note was not present.

• Resolved an issue that incorrectly included deleted data subject records in the tenant usage metrics count.

• Resolved an issue that prevented additional identifiers from populating as data elements within receipts.

• Resolved an issue that prevented magic link tokens from populating in data subject bulk exports when parent identifiers for a data subject group were created via consent receipt.

• Resolved an issue that prevented data subject merges from completing successfully when new consent receipts were submitted containing an additional identifier with an empty value.

• Resolved an issue that prevented consent receipts from being stored with the incorrect organization ID after collection points were synced.

• Resolved an issue that prevented a purpose's expiry date from clearing from the expiryDate object within the profiles object of the Get Data Subject Details V4 API after consent receipts were submitted with the ClearExpiration option enabled in the receiptOptions object.

• Resolved an issue that prevented text for Other unsubscribe reasons on the preference center from correctly translating to Chinese (ZH-TW).

• Resolved an issue that removed the Identifier type from data subject profiles created by collection points with the Double opt in setting enabled.

  addendum: This release note was added on September 11, 2026.

Existing Public Preview Features

CMP Consent Context

Added support to our existing data hierarchy to allow CMP consent users to provide consent for a purpose multiple times when using consent groups. When using consent groups with the unified profile feature, the CMP will use the same data subject for different consent groups, eliminating the need to create additional profiles.

Things to Know

TheReceipt summarypane on theData subject detailsscreen now displays associatedPrivacy noticesonly when the notice's linked purposes have received consent.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Existing Public Preview Features

Policy Enforcement for Snowflake and Databricks

|Available with Solution Packaging Only

Scan and classify data without relying on the limited classification capabilities provided by cloud platforms to enable automated and consistent application of policy actions across Snowflake and Databricks environments. This robust functionality supports the orchestration of masking and row filtering policies to configure access and visibility privileges to sensitive data tables in these systems.

For more information, see the following:

• Masking Policies for Databricks

• Masking Policies for Snowflake

• Row Filtering Policies for Databricks

• Row Filtering Policies for Snowflake

This feature is related to the following ideas: INT-I-34, GOVIDEA-I-24, DPOL-I-3, GOVIDEA-I-16.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented terms with statuses other than Pending review from appearing in Terms report exports.

• Resolved an issue that prevented Brazil CPF classifiers from correctly identifying 11-digit CPF numbers without delimiters.

Existing Public Preview Features

Script Management

Run common maintenance and troubleshooting scripts directly from the platform in the new Administration tab. This reduces the need for command line interface (CLI) access or coordination with support by providing an effective and easy way to execute critical scripts.

For more information, see Script Management for Worker Nodes.

Duplicate File Detection

Identify duplicate and redundant files with AI-driven analysis based on key risk attributes (classification, shared access) and make decisions on whether to retain or remove duplicates. This enhancement helps you reduce redundant data, decrease the attack surface, and improve your security posture, with savings on cloud storage costs.

For more information, see Reviewing Scanned Files.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented the download notification from being generated when exporting Assessment PDF reports for Third-Party Risk Management.

• Resolved an issue that caused widgets on custom Exception Insights Dashboards to display as blank when multiple widgets referenced custom attributes on the same tab.

• Resolved an issue that prevented Residual risk scores from being sorted based on the saved configuration when generating PDF reports.

• Resolved an issue that prevented assessments from being exported as PDF files when they contained corrupted image files in comments, notes, or question descriptions.

• Resolved an issue that prevented users from generating column reports when they contained a high volume of related objects.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing ABAC-enabled reporting as part of Attribute-Based Access Control (ABAC) Phase 1: Foundations. ABAC-enabled reporting extends record-level access controls into supported reporting experiences by using assignments through sharing, attributes, or workflows to determine which report data users can access. This feature introduces assignment-aware reporting for supported objects, helping organizations align report visibility with operational access controls, support least-privileged access, improve governance, and provide more consistent reporting experiences.

For more information on ABAC, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC-enabled reporting is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects and reporting experiences.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Reporting Considerations for Attribute-Based Access Control (ABAC).

Conversational Analytics Insights Chatbot

|Available with Solution Packaging Only

Ask natural-language questions about your Insights data using the Copilot chatbot in the OneTrust Platform when the Conversational analytics setting is enabled in Global Settings. This feature reduces the manual effort required to create reports and dashboards by generating summaries, tables, and visualizations using existing out-of-the-box reporting data. The Copilot chatbot supports analysis for the following objects:

• AI Governance inventories:

  • AI systems

  • Datasets

  • Models

  • Projects

• Assessments

• CMP time series

• Consent time series

• Contracts

• Controls / Control implementations

• Engagements

• Incidents

• Inventories:

  • Assets

  • Entities

  • Processing activities

  • Vendors

• Issues

• Privacy requests and subtasks

• Risks

Note:

This feature does not currently support consent data subject details.

For more information, see Using Conversational Analytics Insights Chatbot.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that incorrectly displayed the integration wizard trigger name after saving and activating the integration.

Existing Public Preview Features

Key Pair Rotation

Refresh expiring Snowflake key pairs directly from the credentials flow instead of replacing them manually outside of OneTrust. Expiration reminder emails help teams rotate keys on time and maintain authentication continuity during the transition to the new key pair.

For more information, see Rotating Key Pairs for Integrations Credentials.

AI-Powered Individual Log Error Analysis

|Available with Solution Packaging Only

Identify failed actions with AI-powered error summaries, root cause explanations, and actionable recommendations inside the log. This allows you to see exactly which workflow step failed, the type of error, and suggested next steps, which enables you to resolve issues faster and more confidently.

For more information, see Using Integration Logs.

New Integration Workflow Canvas Builder

Create, understand, and manage integrations with the new Canvas Builder, which introduces a modern, flowchart-style way to make automation more approachable for both technical teams and program managers. Instead of working through a primarily configuration-first experience like in the original Legacy Builder, users can now see their workflow come to life on a canvas with triggers, actions, and sequencing presented in a clear visual layout.

For more information, see Integration Canvas Builder Feature Guide. This feature is related to the following idea: PLTI-I-634.

Advance Authentication Methods for Snowflake Integrations

Configure key-value pair authentication for database credentials to Snowflake. Since Snowflake is deprecating support of select credentials, this enhancement improves upon the username/password flow for a more secure approach with a private key for programmatic access that supports critical, existing integrations.

For more information, see Key-Pair Authentication for Snowflake Integration Credentials. This feature is related to the following idea: INT-I-34.

Things to Know

TheContextmenu for rows on theValuesscreen has been repositioned from the right side to the the left side of the table in accordance with platform table adoption.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Workflow List Table Experience Updates

Workflow list tables have been enhanced across supported products to deliver a more consistent and intuitive table experience. This update includes:

• Visible ascending and descending sort arrows to make sort direction easier to recognize at a glance

• A column picker that gives users more control over which columns are displayed in the table

• A repositioned Context menu on the left side of the table to support a more consistent and easier-to-find interaction pattern

These enhancements will be available for the following products, refer to their release notes for impacted workflows:

• AI Governance

• Audit Management

• Enterprise Policy Management

• Incidents

• IT Risk Management

Send Notifications to User Groups

Select a group in the assignee field of a Send notification rule action. This helps route workflow notifications to all relevant team members across standard workflows.

This enhancement will be available for the following products, refer to their release notes for impacted workflows:

• AI Governance

• Audit Management

• Enterprise Policy Management

• Incidents

• IT Risk Management

Assign Tasks Using User-Type Attributes

Assign tasks with the Create task stage rule action to either system users or eligible single-select, user-type attributes. This workflow update allows you to dynamically route tasks to the right users while preserving existing task-assignment behavior.

This enhancement will be available for the following products, refer to their release notes for impacted workflows: 

• AI Governance

• Audit Management

• Enterprise Policy Management

• Incidents

• IT Risk Management

Table Enhancements for Global Settings

Tables and table functionalities within Global Settings have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

Note:

Select tables across Global Settings may support these enhancements while others may not. These updates will continue to roll out incrementally.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that caused a blank page to display during service provider-initiated, Single Sign-On (SSO) logins when using the POST option for Response and Request binding types.

• Resolved an issue that prevented user list exports from completing when initiated from child organizations.

• Resolved an issue that enabled notifications for email templates in the sandbox tenant when they were disabled in the parent tenant when performing a sandbox copy.

• Resolved an issue that prevented failed emails from resending on the Email account details screen.

  addendum: This release note was added on September 11, 2026.

• Resolved an issue that caused users to be redirected to the home screen when selecting the Bulk launch assessment button from the Controls screen after the Attribute-Based Access Control (ABAC) feature was enabled.

  addendum: This release note was added on September 11, 2026.

• Resolved an issue that prevented engagements from displaying on the Engagements list screen for users assigned via custom single-select attributes in Attribute-Based Access Control (ABAC) assignments.

  addendum: This release note was added on September 11, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

ABAC Phase 1: Foundations is available for supported objects across AI Governance, Privacy Automation, Tech Risk & Compliance, and Third-Party Management, and introduces the following core capabilities to manage record-level access and collaboration:

Basic Role

: Use the new minimal-access Basic role available on theRolesscreen to configure users with access only to the OneTrust Platform homepage, supporting least-privileged access from the start.

Assignments

: Leverage out-of-the-box or custom assignments, which are sets of permissions that define what users can do on a record. Assignments can be applied through record sharing or inherited through user attributes and workflow stages to automatically grant record-level permissions for owners, approvers, reviewers, and other users involved in the record lifecycle.

Sharing, Requesting & Managing Access

: Share records directly with users, request access to records, review who currently has access, and modify or revoke access as needed.

Record-Level Auditing

: Review audit history for record access and assignment configuration changes to understand what changed, who made the change, and when the change occurred.

ABAC helps organizations manage access more precisely by aligning permissions to records and assignments rather than relying on increasingly complex role structures. This enables granular record-level access control, improves governance, and simplifies collaboration across teams and workflows. With this enhancement, administrators can reduce access-management complexity while strengthening security and accountability across the OneTrust Platform.

For more information, see Attribute-Based Access Control (ABAC) User Guide. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0, with support initially available for a subset of objects and functionality. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

OneTrust Activity Log

Gain a unified, real-time view of user and system audit events across the OneTrust Platform with the Activity logs screen to increase visibility and control, investigate issues faster, and meet compliance requirements with a complete, traceable audit trail. Through a centralized audit experience, teams can quickly search and filter audit records, monitor activity across solutions from a single location, and export audit data for broader reporting and analysis.

For more information, see OneTrust Activity Log.

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

• Task Add Attachment

• Task Add Comment

• Task Created

• Task Deleted

• Task Remove Attachment

• Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

Platform Enhancements

OneTrust has updated the font used throughout the platform to improve readability, visual consistency, and the overall user experience. This is a visual enhancement only and does not affect platform functionality or workflows.

Note:

Additional visual enhancements will be introduced in upcoming releases as part of ongoing platform improvements.

Legacy Sharing vs ABAC Sharing

OneTrust is planning to transition customers from the legacy sharing experience to Attribute-Based Access Control (ABAC) sharing for Inventory objects. ABAC provides a more consistent and scalable access model, supports Assets, Processing Activities, Entities, Vendors, and Projects, and offers more advanced access-control options. 

If your tenant currently uses Legacy Share, your existing sharing configuration will continue to work until you are ready to transition. The migration is not automatic, and Legacy Share continues to take precedence for Inventory objects where both sharing models are available. Review your current sharing setup and discuss readiness with your stakeholders; when you are ready, contact your Customer Success Manager or support representative to coordinate the migration.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented end users from logging into the embedded Trust Center using shared JWT tokens.

General Availability

Table Enhancements for Data Mapping Automation

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

• Automations screen

• Location list screen in the Inventory manager

• Personal data configuration screen in the Inventory manager

• Personal data tab of the Inventory details screen

• Related tab of the Inventory details screen

• Risks tab of the Inventory details screen

Note:

Select tables across Data Mapping Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• The list of supported values for the inventoryType path parameter in the Get Inventory Links API has been updated to correctly reflect supported inventory types. The incorrectly documented data-elements value has been removed.

• Resolved an issue that prevented Risk Assessment vendor report exports from downloading when specific risk relationship filters or attributes were applied.

• Resolved an issue that caused controls to remain in the register after their primary inventory was deleted.

• Resolved an issue that prevented related processing activities from displaying in asset column reports.

• Resolved an issue that prevented users from exporting projects as PDFs from the Projects screen.

• Resolved an issue that prevented the Retention period advanced attribute from being retained when copying a processing activity.

• Resolved an issue that prevented relationship records from inheriting controls when risks were flagged using the Risk library during an assessment.

• addendum: The release note pertaining to Data Transfer fields in reports was removed on September 11, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Privacy Automation.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Enhanced Data Graph Visualizations

View relationships between projects, data sets, and models in the data graph in addition to inventory records. This enhancement provides a clear visualization of how objects relate to each other and to inventory records throughout your data map.

For more information, see Creating and Managing Contextual Relationships.

Inventory Review

|Available with Solution Packaging Only

Gain essential visibility into the flow of newly added and updated inventory records so you can better investigate risks, promote compliance, and enhance efficiency concerning your data map. This review experience allows you to manage pending inventory records that are created by several methods and review inventory records with new or updated data elements.

For more information, see Inventory Review & Automation Feature Guide.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Data Mapping Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

Legacy Sharing vs ABAC Sharing

OneTrust is planning to transition customers from the legacy sharing experience to Attribute-Based Access Control (ABAC) sharing for Inventory objects. ABAC provides a more consistent and scalable access model, supports Assets, Processing Activities, Entities, Vendors, and Projects, and offers more advanced access-control options. 

If your tenant currently uses Legacy Share, your existing sharing configuration will continue to work until you are ready to transition. The migration is not automatic, and Legacy Share continues to take precedence for Inventory objects where both sharing models are available. Review your current sharing setup and discuss readiness with your stakeholders; when you are ready, contact your Customer Success Manager or support representative to coordinate the migration.

TheDelete recordsbutton is now called theRecycle binbutton on theAssets,Processing activities,Entities, andVendorsscreens. This enhancement better reflects the increased functionality available via theRecycle binscreen.

TheSet up automationbutton has been moved to the top of theAutomationsscreen for better visibility, and the info icon has been removed from theContextmenu because it is not supported in the new enhanced table.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Workflow List Table Experience Updates

Incident workflow list tables have been enhanced to deliver a more consistent and intuitive table experience. This update includes:

• Visible ascending and descending sort arrows to make sort direction easier to recognize at a glance

• A column picker that gives users more control over which columns are displayed in the table

• A repositioned context menu on the left side of the table to support a more consistent and easier-to-find interaction pattern

Assign Tasks Using User-Type Attributes

Assign tasks with the Create Task stage rule action to either system users or eligible single-select, user-type attributes for Incident workflows. This workflow update allows you to dynamically route tasks to the right users while preserving existing task-assignment behavior.

Send Notifications to User Groups

Select a group in the Assignee field of a Send Notification rule action for Incident workflows. This helps route workflow notifications to all relevant team members across standard workflows.

Fixed

• Resolved an issue that prevented existing values for required attributes from pre-populating in the Next stage modal when advancing an incident to the next workflow stage.

• Resolved an issue that displayed date and time attributes on the Incident details screen in UTC format rather than the organization's localized date and time.

• Resolved an issue that prevented workflow stage rules from executing when a stage advanced automatically upon approval.

  addendum: This release note was added on September 11, 2026.

Dynamic Incident Notification Assessment (DINA) Updates

• DINA 1.3.1. introduced updates to the rules and guidance for §18-552 of the Arizona Revised Statutes (Arizona Breach Notification Law).

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that prevented integration workflows from correctly evaluating assessment risk levels.

• Resolved an issue that prevented users from exporting an assessment list when an Unassigned approver filter was applied.

• Resolved an issue that prevented assessment notes configured as Visible to approver from being included in PDF exports.

• Resolved an issue that excluded approval records without comments from assessment PDF exports.

• Resolved an issue that partially truncated the SHOW option for show/skip logic on the Template details screen.

• Resolved an issue that prevented Risk approver and Risk owner details from displaying in assessment PDF exports.

• Resolved an issue that prevented control-related templates from displaying in the Template filter dropdown on the Assessments screen.

• Resolved an issue that prevented the approver name and icon from updating immediately on the assessment header after the approver was edited.

• Resolved an issue that prevented the open issues count indicator from displaying on the Assessment details screen for Third-Party Risk Management.

  addendum: This release note was added on September 11, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Privacy Automation.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Assessment Automation. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

TheShareoption is now available from theContextmenu on theAssessmentscreen for Attribute-Based Access Control (ABAC)-enabled environments. You can now use theSharemodal to configure access and manage permissions without accessing the assessment directly.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Select Multiple Subtasks in Workflow Stage Rules

Users can now select multiple subtask templates when configuring a Create subtask stage rule action. This enhancement helps you automate more complex workflows and reduce manual subtask creation.

For more information, see Adding Rules to Workflow Stages.

New Privacy Workflows

Leverage new and updated privacy workflows for enhanced compliance with US, EU, and international privacy laws, including:

• 98 new and updated workflows, featuring content based on the comprehensive privacy laws of the following 13 US states:

  • Alabama

  • California

  • Colorado

  • Connecticut

  • Indiana

  • Kentucky

  • Louisiana

  • Oklahoma

  • Oregon

  • Rhode Island

  • Texas

  • Utah

  • Virginia

• 45 new workflows featuring content based on the comprehensive privacy laws of the following 7 jurisdictions:

  • France

  • India

  • Italy

  • Saudi Arabia

  • Spain

  • Switzerland

  • Vietnam

• An updated version of the default workflow.

For more information, see Managing Language Options for Privacy Rights.

Fixed

• Resolved an issue that sent unexpected verification reminder emails for expired requests when the reminder setting had recently been enabled on a web form.

• Resolved an issue that prevented subtasks created via Use a subtask template from displaying as options for the subtask resolution condition when configuring workflow rules.

• Resolved an issue that caused the text that explains why the Submit button is disabled to be overwritten when switching languages and updating unrelated visibility rules.

  addendum: This release note was added on September 11, 2026.

• Resolved an issue that caused content from multiple response templates to display in the editor when selecting and removing different response templates.

  addendum: This release note was added on September 11, 2026.

• Resolved an issue that caused duplicate request records to display on the Requests screen and subtasks from different workflow stages to display on stages for which they were not configured.

  addendum: This release note was added on September 11, 2026.

New Public Preview Features

New Get List of DROP Records API

Added the Get List of DROP Records API to retrieve DROP records with support for filtering, pagination, and sorting. This API enables developers to programmatically query DROP records by criteria such as status, created date, and updated date, making it easier to monitor and manage DROP request processing workflows.

Existing Public Preview Features

Table Enhancements for Results Summary

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following tabs and modals within the Data subject request details screen:

• Attachments tab

• Review file segments modal

• Structured data tab

• Suggested Redactions tab

Note:

Select tables across Privacy Rights Automation may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary.

For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Manage DROP Requests with OneTrust

Leverage OneTrust's DROP support to automate DROP request intake and status reporting. This enhancement enables California-registered data brokers to automatically download hashed requests on a defined schedule and posts status updates back to DROP.

For more information, see Managing Delete Request and Opt-Out Platform (DROP) Requests and Creating a Workflow for Managing DROP Requests.

New DROP Management APIs

Added the Create Data Subject Request for DROP Record API and the Update DROP Record API to create and update the status of Delete Request and Opt-out Platform (DROP) requests, respectively. These APIs support California-registered data brokers in managing DROP requests for deleting or opting out data subjects permanently.

Things to Know

TheSettingsbutton has been removed from theCollectionscreen inData Redactionto align with least privilege access principles.

The following email templates have been added to the CookiePro environment:

• DSAR group assigned case

• Data subject group assigned request reminder

• Data subject request subtask comment added

• Data subject request deadline paused

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Workflow List Table Experience Updates

Workflow list tables have been enhanced to deliver a more consistent and intuitive table experience. This update includes:

• Visible ascending and descending sort arrows to make sort direction easier to recognize at a glance

• A column picker that gives users more control over which columns are displayed in the table

• A repositioned context menu on the left side of the table to support a more consistent and easier-to-find interaction pattern

These enhancements will be reflected on the workflow list tables for the following objects:

• Audit

• Findings

• Workpaper

Assign Tasks Using User-Type Attributes

Assign tasks with the Create Task stage rule action to either system users or eligible single-select, user-type attributes. This workflow update allows you to dynamically route tasks to the right users while preserving existing task-assignment behavior. This enhancement will be available for the following workflows:

• Audits

• Workpapers

Send Notifications to User Groups

Select a group in the assignee field of a Send Notification rule action. This helps route workflow notifications to all relevant team members across standard workflows. This enhancement will be available for the following workflows:

• Audits

• Findings

• Workpapers

Fixed

• Resolved an issue that prevented the Added by field from displaying the user's name when adding controls to the Scope tab of an audit.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Fixed

• Resolved an issue that caused the number of evidence tasks displayed on the Standards & frameworks screen to differ from the number of tasks shown in column reports.

• Resolved an issue that displayed archived inventories as available for selection when creating an initiative.

• Resolved an issue that prevented the Analyze evidence using AI option from appearing on the Add attachment modal for custom roles when collecting evidence.

• Resolved an issue that prevented users from accessing evidence tasks via the Controls screen.

  addendum: This release note was added on September 11, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Stage & Workflow Rules for Seeded Evidence Interval Workflows

Add stage and workflow rules to the seeded evidence interval workflows to automatically send notifications, change evidence task stages, and change workflows. This enhancement allows organizations to tailor workflows and approval paths to match their evidence review processes and customize existing seeded workflows for greater flexibility.

For more information, see Adding Stage Rules to Evidence Interval Workflows and Adding Workflow Rules to Evidence Interval Workflows.

Standard / Control Framework Changes

California Consumer Privacy Act (CCPA as amended) (2025) Framework Updated

Framework content has been expanded to include all requirements associated with Article 9 of the CPPA regulations governing annual cybersecurity audits. Every requirement within Article 9 is now represented by an associated control in the framework, providing comprehensive coverage of the regulation's cybersecurity audit obligations.

For more information, see Supported Control Frameworks.

Things to Know

TheDelete recordsbutton is now called theRecycle binbutton on theAssets,Processing activities,Entities, andVendorsscreens. This enhancement better reflects the increased functionality available via theRecycle binscreen.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Workflow List Table Experience Updates

Workflow list tables have been enhanced to deliver a more consistent and intuitive table experience. This update includes:

• Visible ascending and descending sort arrows to make sort direction easier to recognize at a glance

• A column picker that gives users more control over which columns are displayed in the table

• A repositioned context menu on the left side of the table to support a more consistent and easier-to-find interaction pattern

These enhancements will be reflected on the workflow list tables for the following objects:

• Exceptions

• Policies

• Privacy Notices

• Procedures

• Standards

Assign Tasks Using User-Type Attributes

Assign tasks with the Create Task stage rule action to either system users or eligible single-select, user-type attributes for Exception workflows. This workflow update allows you to dynamically route tasks to the right users while preserving existing task-assignment behavior.

Send Notifications to User Groups

Select a group in the Assignee field of a Send Notification rule action for Exception workflows. This helps route workflow notifications to all relevant team members across standard workflows.

Fixed

• Resolved an issue that prevented Site Admins from selecting documents and creating exceptions if the policy had been moved between organizations.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

AI-Powered Document Analysis

|Available with Solution Packaging Only

Analyze documents against a standard or framework using the new Analyze document button on the Document details screen. This AI-powered feature identifies gaps and provides recommendations to help remediate issues related to the following objects:

• Controls

• Risks

• Issues

AI-generated recommendations will appear in the Recommended section of the Related, Controls, Risks, and Issues tabs of the Document details screen. These recommendations may include relating controls, creating relationships, or linking risks and issues.

For more information, see Using AI-Powered Document Analysis. This feature is related to the following idea: OT-I-14780.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Disable Editing of Details

Disable users from editing details on closed issues and preserve the record once the workflow is completed. This workflow configuration setting is optional during activation and is only available if the Close record setting is enabled. Users must reopen the issue record in order to edit a field.

For more information, see Managing Issue Workflows.

Assign Tasks Using User-Type Attributes

Assign tasks with the Create Task stage rule action to either system users or eligible single-select, user-type attributes for Issue workflows. This workflow update allows you to dynamically route tasks to the right users while preserving existing task-assignment behavior.

Send Notifications to User Groups

Select a group in the Assignee field of a Send Notification rule action for Issue workflows. This helps route workflow notifications to all relevant team members across standard workflows.

Fixed

• Resolved an issue that prevented the linked assessment question from displaying on issues when multiple issues shared the same name.

• Resolved an issue that caused the Location column in the Issue register to display UUIDs instead of country names after refreshing the screen.

• Resolved an issue that caused error messages to display incorrectly across multiple questions when configuring assessment rules to create issues.

• Resolved an issue that caused bulk imports to fail with a timeout error when attempting to create issues for assessments using source IDs from a different tenant.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Issue Attribute Visibility Rules

Configure attribute visibility rules using the new Attribute visibility tab on the Issue type details screen in the Attribute Manager. This feature allows you to use conditional logic to control which fields appear when creating or editing issues to help reduce clutter and improve data accuracy.

For more information, see Creating Attribute Visibility Rules.

Things to Know

Assessmentis no longer supported as a source type in theCreate Issuesbulk import template. This support has been removed to align issue creation behavior with other object types, such as risks and controls, which do not allow object creation when the source type isAssessment.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

New Business Objective Reports

Generate PDF reports for individual or multiple risk and business objective records directly from their respective list screens using the Risk PDF report and Business objective PDF report templates. This enhancement streamlines reporting and improves visibility into key risk and objective data, helping to manage records more effectively.

For more information, see Using Reports Gallery Templates.

Workflow List Table Experience Updates

Workflow list tables have been enhanced to deliver a more consistent and intuitive table experience. This update includes:

• Visible ascending and descending sort arrows to make sort direction easier to recognize at a glance

• A column picker that gives users more control over which columns are displayed in the table

• A repositioned context menu on the left side of the table to support a more consistent and easier-to-find interaction pattern

These enhancements will be reflected on the workflow list tables for the following objects:

• Business objectives

• Controls

• Issues

Assign Tasks Using User-Type Attributes

Assign tasks with the Create Task stage rule action to either system users or eligible single-select, user-type attributes. This workflow update allows you to dynamically route tasks to the right users while preserving existing task-assignment behavior. This enhancement will be available for the following workflows:

• Business objectives

• Controls

Send Notifications to User Groups

Select a group in the Assignee field of a Send Notification rule action. This helps route workflow notifications to all relevant team members across standard workflows. This enhancement will be available for the following workflows:

• Business objectives

• Controls

• Risks

Fixed

• Resolved an issue that prevented bulk actions, such as launching assessments or deleting risks, from working on the Risk register.

• Resolved an issue that caused the filter pane to display incorrectly in the Select risks to assess modal when a small number of records were returned.

• Resolved an issue that caused a persistent loading spinner to appear when attempting to update multiple risk approvers on the Details tab of an assessment.

• Resolved an issue that prevented risks assigned to owners using custom workflows from displaying in the Assigned actions table on the Homepage.

• Resolved an issue that allowed users in a lower organization to successfully create risks for a higher organization via the Create risks bulk import template.

• Resolved an issue that prevented users from bulk assigning owners to control implementations that used custom workflows.

• Resolved an issue that prevented users from saving control implementations when using the Add other option for single-select or multi-select attributes.

• Resolved an issue that caused the Status column for related processing activities to display as blank in Control implementation column reports.

• addendum: The release note pertaining to deleting operators or functions was removed on September 11, 2026.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Tech Risk & Compliance.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Tech Risk & Compliance.

Restore Deleted Inventory Records

Restore deleted inventory items directly with the Inventory Restore Feature. Users can restore a single record or multiple records at once with bulk restore. When a record is recovered, the inventory item and supported associated data are also restored. This enhancement reduces the need for manual support intervention and helps teams recover records faster.

For more information, see Restoring Deleted Inventory Records.

Risk Workflow Enhancements

The following enhancements have been introduced to Risk workflows to promote a consistent workflow management experience across other products on the OneTrust Platform that have adopted this standardization:

Workflow list screen

Column sorting, search, activation, archival

Workflow rule actions

Advance to stageandChange workflow

Workflow rule event triggers

Attribute updatedandApproval rejected

Routing rules

Workflow assignment upon object creation

Workflow stage rule actions

Create tasks, send notifications manually or using system and custom templates, update attributes, generate PDF reports, and launch assessments.

Stage detail settings

Set required attributes for this stage, stage approval requirements, allow comments when moving to this stage, and close stage.

TheReason for Closureattribute can now be used as a condition when configuringStage rulesandWorkflow rules.

For more information, see Managing Risk Workflows.

Project Risk Assessments

Create and track IT projects from the Inventory menu to view both direct project risks and indirect risks from linked inventories in the Risks tab. This feature aggregates risks from inventories into a single project-level aggregated score, providing clearer visibility and enabling more informed action.

For more information, see Managing Projects in IT Risk Management.

Nested Table and Tree View for Risk Hierarchy

Identify, assess, and monitor risks across your organization with the redesigned Risk hierarchy list screen. This enhancement replaces the previous Risk Hierarchy Explorer and provides a more intuitive, visually appealing interface by using nested table and tree views to help you clearly visualize and manage parent-child risk relationships.

For more information, see Creating Risk Hierarchies.

Handling Blank Values in Formula Attributes

Enable the Assign Null (no value) to blank values in formulas setting in Global Settings to ensure blank values are treated as NULL (no value) instead of being assigned a value of zero in formulas. This setting determines how blank inputs are interpreted in the formula builder across the OneTrust Platform, specifically for score-formula and formula-type attributes.

Note:

For existing formula attributes, changes will take effect when the attribute is rescored.

For more information, see Configuring Formulas using the Formula Attribute.

Standard / Control Framework Changes

California Consumer Privacy Act (CCPA as amended) (2025) Framework Updated

Framework content has been expanded to include all requirements associated with Article 9 of the CPPA regulations governing annual cybersecurity audits. Every requirement within Article 9 is now represented by an associated control in the framework, providing comprehensive coverage of the regulation's cybersecurity audit obligations.

For more information, see Supported Control Frameworks.

Things to Know

TheDelete recordsbutton is now called theRecycle binbutton on theAssets,Processing activities,Entities, andVendorsscreens. This enhancement better reflects the increased functionality available via theRecycle binscreen.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

Permissions

• Permission changes have been implemented to improve platform usability and administrative efficiency.

  For more information, see Permissions Release Notes: Third-Party Risk Exchange. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Things to Know

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue. 

General Availability

Table Enhancements for Third-Party Risk Management

Tables and table functionalities within the Assessments tab of the Engagement overview screen has been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs.

Note:

Select tables across Third-Party Risk Management may support these enhancements while others may not. These updates will continue to roll out incrementally so availability may vary. For more information, see Table Enhancements Across the OneTrust Platform and Table Enhancements User Guide.

Fixed

• Resolved an issue that prevented the Primary Record ID from displaying on the Assessments tab for inventory records.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Third-Party Management.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Third-Party Management.

Things to Know

Improved the DORA Tab 5.01 CSV export to provide the currency and amount in separate columns, and include additional data columns to align the CSV export with the Excel format.

TheDelete recordsbutton is now called theRecycle binbutton on theAssets,Processing activities,Entities, andVendorsscreens. This enhancement better reflects the increased functionality available via theRecycle binscreen.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.