Permissions Release Notes: Data Mapping Automation (Summer '25 - Winter '26)

Important:

This article contains historical Data Mapping Automation permissions release notes from the Summer '25, Fall '25, and Winter '26 seasons. For permissions release notes starting from the Spring '26 season onward, click here.

This article consolidates all permissions release notes for Data Mapping Automation from the OneTrust 202507.1.0 release through the OneTrust 202602.1.0 release, providing a reference point for changes that impact roles, access, and permissions. Each section below corresponds to a release version and includes permissions release notes announced for the product in the respective release. The absence of a release below indicates that there were no permissions release notes announced for the product for that release. For details on permissions release notes across the platform, see Permissions Release Notes Catalog.

Important:

Starting in the OneTrust 202601.1.0 release, permissions release notes related to this product will be exclusively published in this article. If permissions release notes exist, the following note will appear within the Permissions section for the respective product on the myOneTrust Release Notes page with a link to this article:

"Permission changes have been implemented to improve platform usability and administrative efficiency. For more information, see Permissions Release Notes: [Product Name]. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog."

February 20, 2026 - 202602.1.0 (Winter Release)

Renamed Permissions

The following permissions have been renamed to improve clarity on the actions associated with each individual permission. No changes have been made to permission functionality.

Old permission name

New permission name

Data Mapping Automation inventory assets add

Create assets

Data Mapping Automation inventory assets delete

Delete assets

Data Mapping Automation inventory assets edit

Edit assets

Data Mapping Automation inventory assets export

Export assets

Edit assets status

Change asset status

View assets issues

View asset issues

Edit assets master records

Edit asset master records

View assets personal data

View asset personal data

Data Mapping Automation inventory assets

View assets

Data Mapping Automation add entities

Create entities

Data Mapping Automation delete entities

Delete entities

Data Mapping Automation edit entities

Edit entities

Data Mapping Automation export entities

Export entities

Edit entities status

Change entity status

View entities issues

View entity issues

Edit entities master records

Edit entity master records

View entities personal data

View entity personal data

Data Mapping Automation entities inventory

View entities

Data Mapping Automation inventory PA add

Create processing activities

Data Mapping Automation inventory PA delete

Delete processing activities

Data Mapping Automation inventory PA edit

Edit processing activities

Data Mapping Automation inventory PA export

Export processing activities

Edit processing activities status

Change processing activity status

View processing activities issues

View processing activity issues

Edit processing activities master records

Edit processing activity master records

View processing activities personal data

View processing activity personal data

Data Mapping Automation inventory processing activity

View processing activities

Contracts linked to vendors view

View vendor contracts

Data Mapping Automation inventory VRM delete

Delete vendors

Export vendor inventory

Export vendors

Edit vendors status

Change vendor status

View vendors issues

View vendor issues

Edit vendors master records

Edit vendor master records

View vendors personal data

View vendor personal data

January 30, 2026 - 202601.2.0

Assessments – Invited User Security Enhancements

OneTrust is implementing new permission controls for Invited Users and Project Respondents to align front-end access controls with back-end API behaviors. This update ensures that low-privilege users cannot access metadata or assessment content outside their assigned scope. A new permission will be available for customers who need to restore the broader access level previously granted to their Invited Users.

No action is required unless you want Invited Users to retain their previous access. If you want Invited Users to retain their previous access, you can assign the newly introduced Advanced assessment metadata permission manually to a custom copy of the Invited User role after the change goes live in OneTrust 202601.2.0. Those users with the Invited User role will then need to be reassigned to the custom invited user role with the new permission.

For more information, see Assessments – Invited User Security Enhancements, Invited Users FAQ, and Project Respondents FAQ. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog.

Split Permissions

The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:

Old permission name

New permission name

System roles

Custom roles

View personal data for inventory records

View assets personal data

These permissions have been grated to the following system roles:

AI Governance Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, Exchange Manager, IT Risk Manager, Privacy Officer, Privacy Program Auditor, Site Admin, Tech Risk & Compliance Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the View personal data for inventory records permission.

View entities personal data

View processing activities personal data

View vendors personal data

January 9, 2026 - 202601.1.0

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name

Explanation of changes

System roles

Custom roles

Bulk delete assets

The Bulk delete assets permission has been added and now controls users' ability to delete assets in bulk.

This permission has been granted to the following system roles:

Data Mapping Automation Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager

This permission has been granted to custom roles that were previously assigned the Data Mapping Automation inventory assets delete permission.

Bulk delete entities

The Bulk delete entities permission has been added and now controls users’ ability to delete entities in bulk.

This permission has been granted to the following system roles:

Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, TPDD Admin, Tech Risk & Compliance Admin, Vendor Manager

This permission has been granted to custom roles that were previously assigned the Data Mapping Automation delete entities permission.

Bulk delete processing activities

The Bulk delete processing activities permission has been added and now controls users’ ability to delete processing activities in bulk.

This permission has been granted to the following system roles:

Data Mapping Automation Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, Vendor Manager

This permission has been granted to custom roles that were previously assigned the Data Mapping Automation inventory PA delete permission.

Bulk delete vendors

The Bulk delete vendors permission has been added and now controls users’ ability to delete vendors in bulk.

This permission has been granted to the following system roles:

Data Mapping Automation Manager, IT Risk Manager, Privacy Officer, Site Admin, TPDD Admin, Tech Risk & Compliance Admin, Vendor Manager

This permission has been granted to custom roles that were previously assigned the Data Mapping Automation inventory VRM delete permission.

Split Permissions

The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:

Old permission name

New permission name

System roles

Custom roles

Copy inventory

Copy assets

These permissions have been granted to the following system roles:

Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the Copy inventory permission.

Copy processing activities

Copy entities

Copy vendors

View assets local versions

View processing activities local versions

View entities local versions

View vendors local versions

Data Mapping Automation inventory create master

Edit assets master records

These permissions have been granted to the following system roles:

Compliance Manager, Data Mapping Automation Manager, Ethics Policy Owner, IT Risk Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the Data Mapping Automation inventory create master permission.

Edit processing activities master records

Edit entities master records

Edit vendors master records

Inventory bulk edit

Bulk edit assets

These permissions have been granted to the following system roles:

Data Mapping Automation Manager, ERM Manager, Exchange Manager, IT Risk Manager, Privacy Officer, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the Inventory bulk edit permission.

Bulk edit processing activities

Bulk edit entities

Bulk edit vendors

Data Mapping Automation inventory change status

Edit assets status

These permissions have been granted to the following system roles:

Data Mapping Automation Manager, ERM Manager, IT Risk Manager, Privacy Officer, Privacy Program Auditor, Site Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Tech Risk & Compliance Admin, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the Data Mapping Automation inventory change status permission.

Edit processing activities status

Edit entities status

Edit vendors status

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name

Explanation of changes

Data Mapping Automation inventory assets delete

  • When the Data Mapping Automation inventory assets delete permission is added to the custom role, the Data Mapping Automation inventory assets edit permission will be automatically added.

Data Mapping Automation inventory PA delete

  • When the Data Mapping Automation inventory PA delete permission is added to the custom role, the Data Mapping Automation inventory PA edit permission will be automatically added.

Data Mapping Automation delete entities

  • When the Data Mapping Automation delete entities permission is added to the custom role, the Data Mapping Automation inventory edit entities permission will be automatically added.

Bulk delete assets

  • When the Bulk delete assets permission is added to the custom role, the following permissions will be automatically added:

    • Data Mapping Automation inventory assets delete

    • Data Mapping Automation inventory assets edit

Bulk delete processing activities

  • When the Bulk delete processing activities permission is added to the custom role, the following permissions will be automatically added:

    • Data Mapping Automation inventory PA delete

    • Data Mapping Automation inventory PA edit

Bulk delete entities

  • When the Bulk delete entities permission is added to the custom role, the following permissions will be automatically added:

    • Data Mapping Automation delete entities

    • Data Mapping Automation edit entities

Bulk delete vendors

  • When the Bulk delete vendors permission is added to the custom role, the following permissions will be automatically added:

    • Data Mapping Automation inventory VRM delete

    • Edit vendors

October 27, 2025 - 202510.2.0 (Fall Release)

Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name

System role

Entity Inventory Report Export

The Entity Inventory Report Export, Sync Inventory for Report, Create Data Lineage Inventory, and View Data Lineage Inventory permissions have been removed from the following system roles:

AI Governance Manager, Assessments Manager, Audit Manager, Auditor, Compliance Manager, Cookie Consultant, Cookie Manager, Data Access and Usage Manager, Data Governance Manager, Data Governance Viewer, Data Steward, Digital Policy Manager, Digital Policy Owner, Digital Policy Viewer, Disclosures Administrator, Employee, Enterprise Policy Manager, EPM Policy View Only, EPM Procedure View Only, EPM Standard View Only, EPM View Only, ERM Manager, ESG Manager, Ethics Policy Manager, Ethics Policy Owner, Ethics Policy Restricted Owner, Exchange Manager, Incident General User, Incidents Manager, Invited, IT Risk Approver, IT Risk Manager, Managed Service Provider, Maturity & Planning Manager, Policy Attestation Respondent, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Program Auditor, Privacy Rights Automation Manager, Program Benchmarking Manager, Project Owner, Project Viewer, Tech Risk & Compliance Admin, Third-Party Viewer, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Vendor Manager, Vendorpedia Assessment Coordinator

Sync Inventory for Report

Create Data Lineage Inventory

View Data Lineage Inventory

September 12, 2025 - 202509.1.0

As part of permission standardization efforts, some permissions have been updated. Because of this, some custom roles may no longer be able to view vendor records or other inventory items. This change is expected. Please review your custom roles and enable the permissions below as necessary to restore access:

  • Assets: Data Mapping Automation inventory assets

  • Processing Activities: Data Mapping Automation inventory processing activity

  • Entities: Data Mapping Automation entities inventory

  • Vendors: Vendor Basic Fields View & Vendor Advanced Fields View

  • Attributes: Inventory view attributes

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name

Explanation of changes

System roles

Custom roles

Entity Inventory Report Export

The Entity Inventory Report Export and Sync Inventory for Report permissions have been added and now control users' ability to export and sync inventory reports.

These permissions have been granted to the following system roles:

Data Mapping Automation Manager, Privacy Officer, Site Admin

These permissions have been granted to custom roles that were previously assigned the Data Mapping Automation inventory permission.

Sync Inventory for Report

Create Controls For Inventory

The Create Controls For Inventory permission has been added and now controls users' ability to create and edit inventory control types.

This permission has been granted to the following system roles:

AI Governance Manager, Assessments Manager, Audit Manager, Auditor, Compliance Manager, Cookie Consultant, Cookie Manager, Data Access and Usage Manager, Data Governance Manager, Data Governance Viewer, Data Mapping Automation Manager, Data Steward, Digital Policy Manager, Digital Policy Owner, Digital Policy Viewer, Disclosures Administrator, EPM Policy View Only, EPM Procedure View Only, EPM Standard View Only, EPM View Only

This permission has been granted to custom roles that were previously assigned the Control implementation edit and Data Mapping Automation inventory permissions.

Update Controls For Inventory

The Update Controls For Inventory permission has been added and now controls users' ability to edit inventory control types.

This permission has been granted to the following system roles:

AI Governance Manager, Assessments Manager, Audit Manager, Compliance Manager, Data Mapping Automation Manager, ERM Manager, ESG Manager, Enterprise Policy Manager, Exchange Manager, IT Risk Approver, IT Risk Manager, Incidents Manager, Invited, Policy Owner, Privacy Notice Author, Privacy Notice Manager, Privacy Officer, Project Owner, Site Admin, Tech Risk & Compliance Admin

This permission has been granted to custom roles that were previously assigned the Control implementation edit and Data Mapping Automation inventory permissions.

View Cross Border Inventory

The View Cross Border Inventory permission has been added and now controls users' ability to view inventory cross-border maps.

This permission has been granted to the following system roles:

Data Mapping Automation Manager, Employee, IT Risk Manager, Privacy Officer, Privacy Program Auditor, Site Admin, Tech Risk & Compliance Admin, Vendor Manager

This permission has been granted to custom roles that were previously assigned the DM view inventory relationships permission.

Create Data Lineage Inventory

The Create Data Lineage Inventory and View Data Lineage Inventory permissions have been added and now control users' ability to manage inventory data lineage.

These permissions have been granted to the following system roles:

Data Mapping Automation Manager, IT Risk Manager, Privacy Officer, Privacy Program Auditor, Site Admin, Tech Risk & Compliance Admin, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the Data Mapping Automation inventory permission.

View Data Lineage Inventory

Create Vendor Workflow Rules

The Create Vendor Workflow Rules, View Vendor Workflow Rules, Edit Vendor Workflow Rules, and Delete Vendor Workflow Rules permissions have been added and now control users' ability to manage vendor workflow rule configurations.

These permissions have been granted to the following system roles:

Data Mapping Automation Manager, IT Risk Manager, Privacy Officer, Site Admin, Tech Risk & Compliance Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the following combination of permissions:

  • Vendor workflow rules

  • Vendor workflow rules create

  • Vendor workflow rules edit

View Vendor Workflow Rules

Edit Vendor Workflow Rules

Delete Vendor Workflow Rules

Create Inventory Type Associations

The Create Inventory Type Associations, View Inventory Type Associations, Edit Inventory Type Associations, and Delete Inventory Type Associations permissions have been added and now control users' ability to manage inventory type associations.

These permissions have been granted to system and custom roles that were previously assigned the following combination of permissions:

  • Inventory view related

  • Third-Party Risk Management

  • Templatesv2

  • Templates view

  • DM assessmentv2

View Inventory Type Associations

Edit Inventory Type Associations

Delete Inventory Type Associations

Permission changes have been retroactively included in Data Mapping Automation 202507.1.0 and 202508.1.0 release notes.

August 1, 2025 - 202508.1.0 (Summer Release)

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name

Explanation of changes

System roles

Custom roles

View personal data for inventory records

The View personal data for inventory records permission has been added and now controls users' ability to view personal data for inventory records.

This permission has been granted to system and custom roles that were previously assigned the following combination of permissions:

  • Inventory view related

  • Third-Party Risk Management

  • Assessments

  • Assessment details view

Create personal data for inventory records

The Create personal data for inventory records, Edit personal data for inventory records, and Delete personal data for inventory records permissions have been added and now control users' ability to manage personal data for inventory records.

These permissions have been granted to system and custom roles that were previously assigned the following combination of permissions:

  • Data Mapping Automation inventory manage related

  • Data Mapping Automation inventory VRM edit

  • Data Mapping Automation inventory

Edit personal data for inventory records

Delete personal data for inventory records

Inventory view attributes

The Inventory view attributes permission has been added and now controls users' ability to view the Attribute Manager and the list of individual attributes for each inventory type.

This permission has been granted to system and custom roles that were previously assigned the following combination of permissions:

  • Assessments

  • Assessment details view

  • Third-Party Risk Management

  • Vendorpedia

  • Vpconnect

Updated Permissions

The following permissions have been updated in the platform:

Permission name

Explanation of changes

Data Mapping Automation inventory manage related

The Data Mapping Automation inventory manage related permission now only controls users' ability to manage related inventory items through the Related tab in the inventory details of asset, processing activity, and entity records. This permission no longer controls access to the Personal data tab of Inventory details screens.

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name

Explanation of changes

View personal data for inventory records

  • When any of the following permissions are added to the custom role, the View personal data for inventory records permission will be automatically added:

    • Create personal data for inventory records

    • Edit personal data for inventory records

    • Delete personal data for inventory records

July 11, 2025 - 202507.1.0

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name

Explanation of changes

System roles

Custom roles

Vendor basic fields view

The Vendor basic fields view and the Vendor advanced fields view permissions have been added and now control users' ability to view basic attribute details for all vendors and view all attribute details for all vendors, respectively.

Note:

If a role with minimal permissions has access to the Vendors tab, users assigned to that role can view vendor details only if they are designated as the business owner for that vendor. This access is granted even if the role does not have the Vendor basic fields view or the Vendor advanced fields view permissions.

These permissions have been granted to system and custom roles that were previously assigned the following combination of permissions:

  • Third-Party Risk Management

  • Third-Party Risk Exchange

  • View vendor details

  • Vpconnect

  • Data Mapping view vendors

Vendor advanced fields view

Edit vendors

The Edit vendors permission has been added and now controls users' ability to edit existing vendor records.

This permission has been granted to system and custom roles that were previously assigned the following combination of permissions:

  • Data Mapping Automation inventory VRM edit

  • Add contracts from contracts list view

  • Engagements limited view

  • Engagements full view

  • Self Service Portal

  • Vendor document tab

Create vendors

The Create Vendors permission has been added and now controls users' ability to create new vendor records.

This permission has been granted to system and custom roles that were previously assigned the following combination of permissions:

  • Data Mapping Automation inventory VRM add

  • TPRM engagement add

  • Vendorpedia

  • VP Exchange actions

  • Request assessment

  • Self Service Portal

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name

Explanation of change

Vendor advanced fields view

  • When the Vendor advanced fields view permission is added to the custom role, the Vendor basic fields view will be automatically added.