Permissions Release Notes: Third-Party Risk Management (Spring '26 - Current)

This article consolidates all permissions release notes for Third-Party Risk Management since the OneTrust 202603.1.0 release, providing a reference point for changes that impact roles, access, and permissions. Each section below corresponds to a release version and includes permissions release notes announced for the product in the respective release. The absence of a release below indicates that there were no permissions release notes announced for the product for that release. For details on permissions release notes across the platform, see Permissions Release Notes Catalog.

Important:

Starting in the OneTrust 202601.1.0 release, permissions release notes related to this product will be exclusively published in this article. If permissions release notes exist, the following note will appear within the Permissions section for the respective product on the myOneTrust Release Notes page with a link to this article:

"Permission changes have been implemented to improve platform usability and administrative efficiency. For more information, see Permissions Release Notes: [Product Name]. For a complete list of products with permission updates in this release, see Permissions Release Notes Catalog."

October 16, 2026 - 202610.1.0

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name

Explanation of changes

System roles

Custom roles

View vendor attachments

The View vendor attachments permission has been added and now controls users' ability to view vendor attachments.

This permission has been granted to the following system roles:

IT Risk Manager, Privacy Officer, Project Viewer, Site Admin, Tech Risk & Compliance Admin, TPDD Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, Vendor Manager

This permission has been granted to custom roles that were previously assigned the Vendor document tab permission.

August 7, 2026 - 202608.1.0 (Summer Release)

Merged Permissions

The following permissions have been merged. The existing functionality is now controlled by a single permission as defined below:

Permission name

Explanation of changes

View asset issues

Note:

The View asset issues permission belongs to the Data Mapping Automation permission group.

The TPRM issues assets permission has been merged into the View asset issues permission.

This permission has been additionally granted to the Data Mapping Automation Manager and Privacy Officer system roles and custom roles that were previously assigned the TPRM issues assets permission.

View entity issues

Note:

The View entity issues permission belongs to the Data Mapping Automation permission group.

The TPRM issues entities permission has been merged into the View entity issues permission.

This permission has been additionally granted to the Data Mapping Automation Manager and Privacy Officer system roles and custom roles that were previously assigned the TPRM issues entities permission.

View vendor issues

Note:

The View vendor issues permission belongs to the Data Mapping Automation permission group.

The TPRM issues vendors permission has been merged into the View vendor issues permission.

This permission has been additionally granted to the Data Mapping Automation Manager and Privacy Officer system roles and custom roles that were previously assigned the TPRM issues vendors permission.
Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name

Explanation of changes

VRM tile launcher

  • When the VRM tile launcher permission is added to the custom role, the Vendor inventory list permission will be automatically added.

  • When the VRM tile launcher permission is removed from the custom role, the Vendor inventory list permission will be automatically removed.

July 17, 2026 - 202607.1.0

Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name

Explanation of changes

View contract related objects

  • When the View contract related objects permission is removed from the custom role, the Edit personal data in contract relationships and the Remove related objects from contracts permissions will be automatically removed.

Edit contract related objects

  • When the Edit contract related objects permission is added to the custom role, the View contract related objects permission will be automatically added.

Remove related objects from contracts

  • When the Remove related objects from contracts permission is added to the custom role, the View contract related objects permission will be automatically added.

View personal data in contract relationships

  • When the View personal data in contract relationships permission is removed from the custom role, the Edit personal data in contract relationships permission will be automatically removed.

Edit personal data in contract relationships

  • When the Edit personal data in contract relationships permission is added to the custom role, the View personal data in contract relationships permission will be automatically added.

View engagement related objects

  • When the View engagement related objects permission is removed from the custom role, the Edit personal data in engagement relationships and the Delete engagement related objects permission will be automatically removed.

Edit personal data in engagement relationships

  • When the Edit personal data in engagement relationships permission is added to the custom role, the View engagement related objects permission will be automatically added.

Delete engagement related objects

  • When the Delete engagement related objects permission is added to the custom role, the View engagement related objects permission will be automatically added.

View personal data in engagement relationships

  • When the View personal data in engagement relationships permission is removed from the custom role, the Edit personal data in engagement relationships permission will be automatically removed.

Edit personal data in engagement relationships

  • When the Edit personal data in engagement relationships permission is added to the custom role, the View personal data in engagement relationships permission will be automatically added.
Renamed Permissions

The following permissions have been renamed to improve clarity on the actions associated with each individual permission. No changes have been made to permission functionality.

Old permission name

New permission name

Create column report in engagements

Create/update/delete engagements column report
Removed Permissions

The following permissions have been removed from the platform or removed from select system roles as defined below:

Permission name

Explanation of change

Edit contract related objects

The Edit contract related objects, Edit personal data in contract relationships, Edit engagement related objects, and Edit personal data in engagement relationships permissions have been removed from the Data Mapping Automation Manager system role.

Edit personal data in contract relationships

Edit engagement related objects

Edit personal data in engagement relationships

May 15, 2026 - 202605.1.0 (Spring Release)

For users with access toThird-Party Risk Management, theProcessing activities,Assets,Vendors, andEntitiesitems on the navigation menu will now be visible to these users by default regardless of whether they have permission to view those inventories. However, users will not be able to view inventory information on those respective screens without the necessary permissions.

Split Permissions

The following permissions have been split for more granular and precise access controls and have been granted to system and custom roles as defined below:

Old permission name

New permission name

System roles

Custom roles

Manage vendor workflows

Create Vendor Workflows

Note:

The Create Vendor Workflows permission belongs to the Data Mapping Automation permission group.

These permissions have been granted to the following system roles:

Data Mapping Automation Manager, IT Risk Manager, Privacy Officer, Project Owner, Site Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, TPDD Admin, Tech Risk & Compliance Admin, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the Manage vendor workflows permission.

View setup for vendor workflows

Note:

The View setup for vendor workflows permission belongs to the Data Mapping Automation permission group.

Edit Vendor Workflows

Note:

The Edit Vendor Workflows permission belongs to the Data Mapping Automation permission group.

Publish vendor workflows

Note:

The Publish vendor workflows permission belongs to the Data Mapping Automation permission group.

Vendor workflow automate stage progression

Edit rules for vendor workflows

Note:

The Edit rules for vendor workflows permission belongs to the Data Mapping Automation permission group.

These permissions have been granted to the following system roles:

Data Mapping Automation Manager, IT Risk Manager, Privacy Officer, Project Owner, Site Admin, TPDD Compliance Manager, TPDD Enhanced Due Diligence Requester, TPDD Admin, Tech Risk & Compliance Admin, Vendor Manager

These permissions have been granted to custom roles that were previously assigned the Vendor workflow automate stage progression permission.

View rules for vendor workflows

Note:

The View rules for vendor workflows permission belongs to the Data Mapping Automation permission group.

Delete rules for vendor workflows

Note:

The Delete rules for vendor workflows permission belongs to the Data Mapping Automation permission group.
Renamed Permissions

The following permissions have been renamed to improve clarity on the actions associated with each individual permission. No changes have been made to permission functionality.

Old permission name

New permission name

View current workflow on vendors details page

View vendor workflows

Note:

The View vendor workflows permission has been moved from the Third-Party Risk Management permission group to the Data Mapping Automation permission group.

Change vendor workflows

Change vendor workflow

Note:

The Change vendor workflow permission has been moved from the Third-Party Risk Management permission group to the Data Mapping Automation permission group.

VRM delete workflows

Delete vendor workflows

Note:

The Delete vendor workflows permission has been moved from the Third-Party Risk Management permission group to the Data Mapping Automation permission group.

Vendor Routing Rules Create

Create rules for vendor workflows

Note:

The Create rules for vendor workflows permission has been moved from the Third-Party Risk Management permission group to the Data Mapping Automation permission group.

Advance the workflow stage of a vendor

Change vendor workflow stage

Note:

The Change vendor workflow stage permission has been moved from the Third-Party Risk Management permission group to the Data Mapping Automation permission group.

April 2, 2026 - 202604.1.0

Permission Group Change

The permission groups associated with the following permissions have been updated as defined below:

Permission name

Explanation of changes

Delete vendor attachments

The Delete vendor attachments permission has been moved from the Third-Party Risk Management permission group to the Data Mapping Automation permission group.

Edit vendor attachments

The Edit vendor attachments permission has been moved from the Third-Party Risk Management permission group to the Data Mapping Automation permission group.

View vendor attachments

The View vendor attachments permission has been moved from the Third-Party Risk Management permission group to the Data Mapping Automation permission group.

March 13, 2026 - 202603.1.0

New Permissions

The following permissions have been added to the platform and have been granted to system and custom roles as defined below:

Permission name

Explanation of changes

System roles

Custom roles

Edit personal data in engagement relationships

The Edit personal data in engagement relationships permission has been added and now controls users' ability to edit personal data in relationships for engagements.

This permission has been granted to the following system roles:

Data Mapping Automation manager, IT Risk manager, Privacy officer, Site admin, Tech Risk & Compliance admin, Vendor manager

This permission has been granted to custom roles that were previously assigned the DM edit relationship personal data permission.
Linked Permissions

The following permissions have been linked and will be automatically added or removed from the custom rule during configuration as defined below. For more information, see Understanding Linked Permissions.

Permission name

Explanation of changes

Edit contracts

  • When the Edit contracts permission is added to the custom role, the View basic fields for contracts permission will be automatically added.

View contract comments

  • When the View contract comments permission is removed from the custom role, the Create contract comments permission will be automatically removed.

View personal data in contract relationships

  • When the View personal data in contract relationships permission is added to the custom role, the View contract related objects permission is automatically added.

View contract related objects

  • When the View contract related objects permission is removed from the custom role, the View personal data in contract relationships permission will be automatically removed.

View engagement assessments

  • When any of the permissions listed below are added to the custom role, the View engagement assessments permission will be automatically added:

    • Create engagement assessments

    • Link assessments to engagement

    • Unlink engagement assessments

Create contracts

  • When the Create contracts permission is added to the custom role, the following permissions will be automatically added:

    • View basic fields for contracts

    • View advanced fields for contracts

Delete contracts

  • When the Delete contracts permission is added to the custom role, the View basic fields for contracts permission will be automatically added.

View advanced fields for contracts

  • When the View advanced fields for contracts permission is added to the custom role, the View basic fields for contracts permission will be automatically added.

Edit personal data in engagement relationships

  • When the Edit personal data in engagement relationships permission is added to the custom role, the DM edit relationship personal data permission will be automatically added.

  • When the Edit personal data in engagement relationships permission is removed from the custom role, the DM edit relationship personal data permission will be automatically removed.