One-Time Password for Invited Users

To enhance security and prevent unauthorized access, OneTrust introduced a One-Time Password (OTP) verification code process for invited users when accessing assessments in the OneTrust Platform. OTP for invited users was enabled by default for UAT environments in the OneTrust 202505.2.0 release and was later enabled by default for all shared environments in the OneTrust 202506.1.0 release. OTPs add an additional layer of security by requiring users to enter a login code that is sent to their registered email address upon clicking links for assessments that they have been explicitly invited to complete, reducing the risk of unauthorized access.

What to Expect

The following section outlines what to expect when OTP for invited users is enabled for your account.

  • Invited users will continue to receive a unique dynamic link via email when they are assigned an assessment. They can continue to use this link to access the assessment without having to log in to OneTrust.

  • Upon clicking the assessment link, invited users will be redirected to the OneTrust Platform, required to complete a CAPTCHA security measure, and prompted to enter a One-Time Password (OTP). The OTP will be sent to the email address specified in the Respondent(s) field for that assessment. For more information, see Invited User Flow with One-Time Password.

  • Invited users should no longer forward the email notification that they received with the unique assessment link to other email addresses in order for those recipients to access the same assessment.

  • To include additional respondents, the creator of the assessment will need to explicitly add any additional individuals as a respondent on the assessment by editing the Respondent(s) field for that assessment within the platform. If the User Respondent Delegation setting is enabled for the related assessment template, then existing respondents can also explicitly add any additional individuals as a respondent on the assessment by editing the Respondent(s) field for that assessment within the platform.

  • Assessment email notification templates within Global Settings will be updated with the following disclaimer to indicate that the email message can no longer be forwarded: "This organization requires authenticated login. Please do not forward this email."

    CAUTION:

    No email template updates will be made for the following instances:

    • Assessment email templates that have been overridden

    • Assessment email templates translated for languages that are not actively supported

    If one of the instances above applies to your assessment email templates, OneTrust recommends that you update these email templates to include the new disclaimer.

Invited User Flow with One-Time Password

  1. Upon clicking the assessment link, invited users will be prompted to first enter a CAPTCHA verification code in the Enter the characters shown in the image field.



  2. After successful CAPTCHA completion, invited users will then be prompted to enter a OTP if the One-Time Password for Invited Users feature is enabled for the environment. The OTP will be sent to the email address specified in the Respondent(s) field for that assessment.



  3. Once the OTP is received, invited users can enter the OTP in the Verification code field and click the Verify button to access the assessment.

To Enable OTP for Invited Users

OTP for invited users was enabled by default for UAT environments in the OneTrust 202505.2.0 release and was later enabled by default for all shared environments in the OneTrust 202506.1.0 release. If OTP for invited users is currently not enabled for your account, you can enable it using the following procedure:

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Access management > Two-step verification. The Two-step verification screen appears.


  3. Enable the Turn on OTP verification for invited users setting.
  4. Click the Save button.

To Disable OTP for Invited Users

Though OneTrust strongly recommends keeping OTP for invited users turned on, you can turn it off using the following procedure:

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Access management > Two-step verification. The Two-step verification screen appears.


  3. Disable the Turn on OTP verification for invited users setting. The Turn off OTP authentication for invited users modal appears.


  4. Click the Turn off OTP button.
  5. Click the Save button.

Frequently Asked Questions (FAQ)

The following responses are supported solutions to frequently asked questions (FAQ) on OTP for invited users. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified. For a general FAQ for invited users, see Invited Users FAQ.

Why is this change happening?

Previously, assessment links could be forwarded via email to others and those recipients could access the same assessment. OneTrust is requiring a OTP to enhance security and reduce the risk of unauthorized access.

When will this change take effect?

In the OneTrust 202505.2.0 release, OTP was enabled by default for UAT environments. In the OneTrust 202506.1.0 release, OTP was enabled by default for all shared environments.

Can we turn off the OTP requirement for invited users?

Yes, the OTP requirement for invited users can be turned off by following the To Disable OTP for Invited Users procedure.

To what email address will the verification code be sent?

A verification code will be sent to the email address specified in the Respondent(s) field for that assessment.

How frequently does the OTP have to be entered?

Invited users will need to enter the OTP every time they click the assessment link.