Assessment Automation - August 7, 2026 - 202608.1.0 (Summer Release)

General Availability

Question-Level Scoring in Column Reports

View a more detailed breakdown of assessment scores in column reports with question-level score details that show how each question contributed to the final profile score. This enhancement improves score transparency and auditing for newly-completed assessments.

For more information about configuring column reports, see: Configuring a Column Report. This feature is related to the following ideas: OT-I-15164 and ADAN-I-61.

Custom Notifications for Assessment Templates

Send customized, trigger-based automated email messages from a new global Notifications tab on the Assessment templates screen. This enhancement speeds up assessment completion, reduces support requirements, and provides users with more relevant information in the assessment.

For more information, see Configuring Custom Email Notifications on Assessment Templates. This feature is related to the following ideas: OT-I-949, OT-I-1270, OT-I-3522, OT-I-7945, and OT-I-16348.

Configuring Approver-only Assessment Sections

Configure approver-only sections on assessments automatically using template rules or inventory-based values. These enhancements mean users can launch assessments with approver-only sections directly from the self-service portal.

For more information, see Configuring Approver-only Assessment Sections. This feature is related to the following ideas: AA-I-293 and AA-I-302.

Leveraging AI Auto-responses for Assessments

Opt out of automatically scanning your three most recent assessments, plus add more files, more file types, and bigger files to your uploads. These enhancements improve the performance and accuracy of the AI Doc Scanner.

For more information, see Leveraging AI Auto-responses for Assessments.

Enhancements to Assessment Automation APIs

The following enhancements have been made to the Assessment Automation APIs:

  • Updated the Launch Assessment V3 API to include the recordAdminId request parameter. This parameter specifies the user who will be assigned as the record admin for the assessment.

  • Updated the Get Assessment Record API to include the questionResponseWithAiMetadata response object. This object will return AI-generated answer metadata, including confidence scores, flags, and answer source information.

  • Updated the Get List of Assessments by Criteria API with the following enhancements:

    • Added the completedBy response parameter to return the unique identifier of the user who completed the assessment.

    • Added the assessmentCompletedBy response object to return details about the user who completed the assessment, such as the full name and email address.

    • Added the assessmentDetailUrl response parameter to return a direct link to the assessment.

    • Added the recordAdminId, recordAdmin, and recordAdminData response parameters to return record admin information, including the record admin's identifier and user details.

New Public Preview Features

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by using assignments through sharing, attributes, or workflows to determine which records users can access and what permissions they have on those records. This feature introduces assignment-based permissions, sharing and access management, and record-level auditing, helping organizations implement least-privileged access, improve governance, and simplify collaboration across teams and workflows.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC is being introduced through a phased rollout that begins with ABAC Phase 1: Foundations, available in Public Preview as part of OneTrust 202608.1.0 for supported objects across Privacy Automation.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Fixed

  • Resolved an issue that caused the PDF reports containing risks and controls to display object IDs for Control owners and approvers instead of names.

  • Resolved an issue that prevented the Submit button from responding when attempting to submit sections during a reassessment, which caused users to be unable to complete or progress through their reassessment workflow.

  • Resolved an issue that prevented users from submitting an assessment when a project referenced in the assessment had been deleted.

    addendum: This release note was added on August 14, 2026.

  • Resolved an issue that prevented text formatting, such as bullet points and lists, from displaying correctly in assessment template descriptions after saving the template.

    addendum: This release note was added on August 14, 2026.

  • Resolved an issue that prevented risk data from displaying in assessment reports and also prevented reports containing risk data from becoming available for download in the Alert Center.

    addendum: This release note was added on August 14, 2026.

Existing Public Preview Features

Privacy Risk Agent

|Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started

Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.

Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Permissions

Template Updates

OnePIA (Full) - 7.6 Change Log

The Vietnam Personal Data Protection Law and related implementing decree establish a comprehensive framework governing the processing of personal data, setting clear requirements for lawful processing. It imposes core controller obligations such as contractual requirements and the performance of data protection and transfer impact assessments, broadly aligning with other global privacy frameworks. The law also grants individuals enforceable rights over their personal data. Customers interested in compliance with this framework are impacted by this release.

The following is the change log for this release:

  • The Welcome Text was updated to account for the Vietnam Personal Data Protection Law (2025) and related implementing decree.

  • Updated conditional logics throughout the template to account for the addition of the above-mentioned framework.

  • Updated applicable laws on question 3.1.

  • Removed question 7.24.

  • Added new question 6.26 for Automated processing of personal data [VN].

  • Updated the description text of question 4.13.

  • Updated the description text of question 4.39.

  • Updated the question and description text of question 4.58.

  • Updated the Consent rule.

  • Created the new Impact Assessment Dossier on the Personal Data Processing [VN] rule.

  • Created the new Impact Assessment Dossier on Personal Data Cross-border Transfer [VN] rule.

  • Created the new Image Collection [VN] rule.

  • Created the new Automated processing of personal data [VN] rule.

OnePIA (Lite) - 7.6 Change Log

The Vietnam Personal Data Protection Law and related implementing decree establish a comprehensive framework governing the processing of personal data, setting clear requirements for lawful processing. It imposes core controller obligations such as contractual requirements and the performance of data protection and transfer impact assessments, broadly aligning with other global privacy frameworks. The law also grants individuals enforceable rights over their personal data. Customers interested in compliance with this framework are impacted by this release.

The following is the change log for this release:

  • The Welcome Text was updated to account for the Vietnam Personal Data Protection Law (2025) and related implementing decree.

  • Updated applicable laws on question 3.1.

  • Created the new Impact Assessment Dossier on the Personal Data Processing [VN] rule.

  • Created the new Impact Assessment Dossier on Personal Data Cross-border Transfer [VN] rule.

OneVendor Lite v6.5 Change Log

The Vietnam Personal Data Protection Law and related implementing decree establish a comprehensive framework governing the processing of personal data, setting clear requirements for lawful processing. It imposes core controller obligations such as contractual requirements and the performance of data protection and transfer impact assessments, broadly aligning with other global privacy frameworks. The law also grants individuals enforceable rights over their personal data. Customers interested in compliance with this framework are impacted by this release.

The following is the change log for this release:

  • The Welcome Text was updated to account for the Vietnam Personal Data Protection Law (2025) and related implementing decree.

  • Added a new answer option to question 2.3 to account for the newly introduced framework.

  • Updated the description text of question 2.10.

  • Created the new Data Transfer [VN] rule.

  • Updated conditional logics throughout the template to account for the addition of the newly introduced framework.

OneVendor Full v6.5 Change Log

The Vietnam Personal Data Protection Law and related implementing decree establish a comprehensive framework governing the processing of personal data, setting clear requirements for lawful processing. It imposes core controller obligations such as contractual requirements and the performance of data protection and transfer impact assessments, broadly aligning with other global privacy frameworks. The law also grants individuals enforceable rights over their personal data. Customers interested in compliance with this framework are impacted by this release.

The following is the change log for this release:

  • The Welcome Text was updated to account for the Vietnam Personal Data Protection Law (2025) and related implementing decree.

  • Added a new answer option to question 3.1 to account for the newly introduced framework.

  • Removed question 3.20.

  • Updated the question and description text of question 3.24.

  • Renamed question 3.24.

  • Updated conditional logics throughout the template to account for the addition of the newly introduced framework.

  • Created the new Cloud Computing [MX] rule.

  • Created the new Cloud Computing [PE] rule.

  • Created the new Cloud Computing [VN] rule.

  • Created the new Data Transfer [VN] rule.

  • Created the new Data Processing Agreement [DPA] rule.

  • Deleted Vendor Contract [US].

Things to Know

Assessment submission now provides a specific error message when an inventory name exceeds the 2,000-character limit, explaining that users must shorten the name, instead of displaying a generic server error.

Assessment responses containing unsupported HTML or invalid text content are now identified before final submission. Assessments now display an actionable error message that identifies the affected question or field and explains what needs to be corrected.

addendum: This release note was added on August 14, 2026.

Assessments launched through theSelf-Service Portalnow inherit the template’s configuredDeadlineandSend email remindersettings.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.