Settings & Administration - October, 2026 - 202610.1.0

General Availability

Global Table Enhancements

Tables and table functionalities have been upgraded to improve usability, accessibility, and customization, including resizable columns, more records per view, clearer row actions, and more. These updates are designed to provide a consistent and improved user experience, helping users work more efficiently with data and tailor their experience to their specific needs. Tables have been updated on the following screens:

  • Add role screen when assigning permissions based on permission groups in Global Settings.

  • Approvers in current stage modal on Workflow & Approval tab of all object types.

  • Notifications screen in the Alert Center.

Enable/Disable Status of Stage Rules and Workflow Rules

Users with permission to update rules can now enable or disable stage rules and workflow rules without deleting them. Disabled stage rules won't run when a workflow enters the stage, and disabled workflow rules won't run when their configured trigger occurs.

This enhancement will be available for the following products, refer to their release notes for impacted workflows:

  • AI Governance

  • Audit Management

  • Enterprise Policy Management

  • Incident Management

  • IT Risk Management

Attribute Options Limit

A limit of 10,000 options is now applied to all single-select and multi-select attributes. Attribute option creation will fail if the total number of active and inactive options exceeds this limit.

This enhancement will be available for the following products, refer to their release notes for impacted workflows:

  • AI Governance

  • Audit Management

  • Enterprise Policy Management

  • Incident Management

  • Issues Management

  • IT Risk Management

  • Third-Party Risk Management

  • Universal Consent & Preference Management

Enhancements to Access Management APIs

Updated the Access Management APIs to support granular OAuth scopes for organization, user group, and user management operations. These enhancements enable more precise access control by allowing integrations to request only the permissions required for specific read, write, and delete operations.

  • Added the ORGANIZATION_READ, ORGANIZATION_WRITE, and ORGANIZATION_DELETE OAuth scopes for the Organizations APIs.

  • Added the USER_GROUP_READ, USER_GROUP_WRITE, and USER_GROUP_DELETE OAuth scopes for the User Groups and User Groups V2 APIs.

  • Added the USER_READ, USER_WRITE, and USER_DELETE OAuth scopes for the Users V2 APIs.

Enhancements to Document APIs

Updated the Upload File API to support the ATTACHMENT_WRITE OAuth scope in addition to the existing ATTACHMENT scope. This enhancement provides a more granular permission option for attachment upload operations.

Fixed

  • Resolved API documentation issues to correct schema definitions, field requirements, response codes, and OAuth scope requirements across various SCIM APIs to align with actual SCIM API behavior.

Existing Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

ABAC Phase 1: Foundations is available for supported objects across AI Governance, Privacy Automation, Tech Risk & Compliance, and Third-Party Management, and introduces the following core capabilities to manage record-level access and collaboration:

Basic Role

Use the new minimal-access Basic role available on theRolesscreen to configure users with access only to the OneTrust Platform homepage, supporting least-privileged access from the start.

Assignments

Leverage out-of-the-box or custom assignments, which are sets of permissions that define what users can do on a record. Assignments can be applied through record sharing or inherited through user attributes and workflow stages to automatically grant record-level permissions for owners, approvers, reviewers, and other users involved in the record lifecycle.

Sharing, Requesting & Managing Access

Share records directly with users, request access to records, review who currently has access, and modify or revoke access as needed.

Record-Level Auditing

Review audit history for record access and assignment configuration changes to understand what changed, who made the change, and when the change occurred.

ABAC helps organizations manage access more precisely by aligning permissions to records and assignments rather than relying on increasingly complex role structures. This enables granular record-level access control, improves governance, and simplifies collaboration across teams and workflows. With this enhancement, administrators can reduce access-management complexity while strengthening security and accountability across the OneTrust Platform.

For more information, see Attribute-Based Access Control (ABAC) User Guide. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0, with support initially available for a subset of objects and functionality. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

OneTrust Activity Log

Gain a unified, real-time view of user and system audit events across the OneTrust Platform with the Activity logs screen to increase visibility and control, investigate issues faster, and meet compliance requirements with a complete, traceable audit trail. Through a centralized audit experience, teams can quickly search and filter audit records, monitor activity across solutions from a single location, and export audit data for broader reporting and analysis.

For more information, see OneTrust Activity Log.

Privacy Risk Agent |Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

SCIM Users and Groups Integrations

Utilize the Integrations module to configure triggers and actions for SCIM Users and Groups. This feature allows users to automate their organization's processes when managing user and group information using SCIM APIs.

For complete details on these workflow options, see Managing Custom Integration Workflows.

New Root Organization

Create a new root organization at the top of an existing organizational hierarchy using the new Set as the Root Organization check box on the Add Organization modal. This feature allows you to move an existing organizational structure, along with certain previously configured settings, under a new root organization.

For more information, see Managing Organizations.

Integrate Tasks with External Systems

Manage tasks created within the application across external systems by creating integration workflows using the following new integration events:

  • Task Add Attachment

  • Task Add Comment

  • Task Created

  • Task Deleted

  • Task Remove Attachment

  • Task Updated

This enhancement allows you to manage tasks across external systems, which may be helpful when addressing tasks that require a large volume of actions.

For more information, see Integrating Tasks with External Systems.

Things to Know

Legacy Sharing vs ABAC Sharing

OneTrust is planning to transition customers from the legacy sharing experience to Attribute-Based Access Control (ABAC) sharing for Inventory objects. ABAC provides a more consistent and scalable access model, supports Assets, Processing Activities, Entities, Vendors, and Projects, and offers more advanced access-control options. 

If your tenant currently uses Legacy Share, your existing sharing configuration will continue to work until you are ready to transition. The migration is not automatic, and Legacy Share continues to take precedence for Inventory objects where both sharing models are available. Review your current sharing setup and discuss readiness with your stakeholders; when you are ready, contact your Customer Success Manager or support representative to coordinate the migration.

Copy Assignments to Sandbox

Assignments are now copied from the parent tenant to a sandbox during sandbox creation or refresh. The copy includes seeded and custom assignments, as well as user-attribute and workflow-stage approval assignment mappings. After the copy, you can create additional assignments directly in the sandbox, helping you test assignment-dependent workflows in an environment that more closely reflects the parent tenant. This enhancement applies to sandboxes created after the 202609.1.0 release. If your sandbox was created before that release, refresh it before creating assignments.

For more information, see Sandbox Management Overview.

Notification Screen Table Design

The Notifications screen has been updated with a new table design by default, providing a consistent experience for managing in-app notifications.

Custom Role Limits

The custom role limit of 150 is now enforced when using the Import role option on the Roles screen.

Email Reminders for Pending User Email Updates

Administrators now receive email reminders for pending user email updates initiated via bulk import. Reminders are sent after 24 and 72 hours, with requests automatically canceled after 7 days to prevent import blockages. To clear long-standing requests already in the system, including requests pending for 5–6 years, OneTrust will remove these requests in an upcoming release. Before the cleanup, administrators will receive two reminder emails with the deadline to resolve the requests.

ABAC Assignments are now grouped and sorted
When users edit a user in Manage Access, assignments are now split into System and Custom groups. System assignments are listed from least to most access: Viewer, Editor, then Internal Owner.
Clearer messages for access options
New messages explain to users when an assignment has no access options set and explain what happens when users change an assignment's access option.
Organizations Listed First
In the Add Role modal, users can now pick the Organization before the Roles, so the roles they see match the organization chosen.
About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.