OneTrust
The vendor that made enterprise-grade security work for the mid-market— the platform organisations run privacy, risk and compliance on, with a Gartner Leader placement for third-party risk. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Five intel pages. One integrated platform.
The complete OneTrust platform — every linked card is a full intel page, from the privacy core to the third-party risk line Gartner named a Leader.
Privacy Automation
Run the privacy programme, not a spreadsheet.
Privacy Operations, DSR Automation and DataGuidance: data maps, automated subject requests, regulatory tracking; carries DPDP rights.
Consent & Preferences
Collect consent, and prove you did.
Universal Consent & Preference Management and the CMP: capture consent across web, app and marketing, honour withdrawal, keep records.
Third-Party Management
Know who your vendors are, and their risk.
TPRM, Third-Party Due Diligence and the Risk Exchange, a Leader in Gartner’s 2026 TPRM MQ; maps onto RBI and IRDAI vendor-risk rules.
Tech Risk & Compliance
One control, evidenced once, across frameworks.
Compliance Automation and IT Risk Management: map controls to frameworks and reuse evidence once. A GRC workflow, not an auditor.
AI Governance
Inventory the AI you already run.
Discover, inventory and risk-assess the AI systems and models in use; a Visionary in Gartner’s inaugural 2026 AI Governance MQ.
Data Use Governance
Platform & engineA solution area OneTrust lists with no separate products under it, so no page here; ask TechBag to scope it in the platform quote.
What to settle before you sign
Platform & enginePricing is quote-only, renewals have jumped after a metering change, and ownership is unsettled: fix terms in the first contract.
Why “one inventory, many obligations” is the whole story
Every privacy and compliance obligation starts from the same question — what data do we hold, and where — so separate tools rebuild the same inventory for each deadline. OneTrust bet on one data inventory under every obligation — and a Gartner Leader placement for third-party risk doubled down on it.
One inventory, many obligations
Every module reads one data inventory and control set, so the privacy map also answers a DPDP request and scopes a vendor assessment. With one module, it is a point tool.
Consent at the edge
Consent capture sits in your web, app and marketing stack. Under DPDP the notice and withdrawal path are explicit duties, so a regulator’s questions land here first.
Assessments as workflow
Vendor due diligence, privacy impact assessments and AI reviews share one engine — questionnaire, reviewer, record — so evidence collected once serves several frameworks.
The regulatory feed
DataGuidance tracks regulatory change across jurisdictions and feeds the programme — timely, with India’s DPDP Rules notified in November 2025 on a phased timeline.
Start with the obligation that is actually forcing the decision — a DPDP consent notice, a regulator asking about vendors — then expand across the platform from evidence rather than from a diagram.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
LEADER — MQ for TPRM
Assurance Leaders
Visionary — AI Governance
inaugural MQ; not a Leader
Privacy Automation
mapping, DSR, regulatory feed
Six solution areas
one inventory underneath
2016 · Atlanta
privacy-first from the start
Dedicated DPDP solution
Rules notified Nov 2025
Quote-only pricing
no published figure
Ownership unsettled
PE sale explored, none closed
The company in six figures
See the platform, hear the pitch
OneTrust Privacy Automation solution demo
Data mapping, DSR automation and privacy operations.
OneTrust Third-Party Management solution demo
The MQ Leader line — inventory, assessment, records.
Winter Release 2026: AI Assessment Automation
AI-assisted assessments for privacy programmes.
Where OneTrust sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
OneTrust Across Its Solution Areas
Each dot is a OneTrust solution area: competitive position vs category momentum.
Leader on the 2026 Gartner MQ for TPRM.
The Depth × Breadth Map
Depth in privacy and risk vs breadth across the platform — where OneTrust sits against the alternatives.
Broadest privacy-to-risk platform; quote-only.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with OneTrust?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is forcing the decision?
2. Where does the work sit today?
3. How broad is the mandate?
What DPDP actually asks of you
Consent notice, the right to withdraw, data-principal requests and breach reporting — the obligations a platform has to carry.
Read →Why consent is a record, not a banner
A cookie banner is the visible part. The obligation is proving what was agreed, when, and honouring withdrawal.
Read →Third-party risk, and why RBI cares
Indian regulated buyers must evidence who their vendors are and how each was assessed.
Read →Leader on one MQ, Visionary on another
OneTrust is a Leader for TPRM and a Visionary for AI Governance. They are different reports and the difference matters.
Read →A GRC platform is not an auditor
It collects and organises evidence. The certificate still comes from a licensed audit firm, priced separately.
Read →Quote-only, and what to fix in contract
No published price. Fix the metering metric and renewal terms in the first contract, not the second.
Read →The acronym decoder
Every term on these pages, in one place- OneTrust
- A privacy, risk and compliance platform founded 2016 in Atlanta, from consent to AI governance.
- DPDP Act
- India’s Digital Personal Data Protection Act; its Rules were notified on 13 November 2025, phased in.
- Data principal
- The DPDP term for the person whose data is processed and who exercises access, correction and erasure rights.
- DSR
- Data Subject Request — asking what you hold, or to correct or delete it, on a statutory clock.
- Consent notice
- The notice shown when consent is collected; under DPDP, clear, specific and as easy to withdraw from.
- TPRM
- Third-Party Risk Management — identifying and assessing vendors, and evidencing it to a regulator or auditor.
- Magic Quadrant
- A Gartner report rating vendors on execution and vision; Leaders sit top-right, Visionaries have less proven execution.
- Data map
- The record of what personal data you hold, where, why and who can reach it — the base of a privacy programme.
- Evidence reuse
- Testing a control once and reusing that evidence across several frameworks.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Name the obligation first
DPDP consent, data-principal requests or vendor risk? The obligation decides the module; buying the platform before naming it is how shelfware happens.
Check what the data map needs
Every module reads one inventory. Scoping which systems must be mapped, and who owns that work, is the real project — the licence is the easy part.
Decide breadth honestly
The platform argument pays off across modules. With one obligation to close, a point tool may be the better buy, and TechBag will say so.
Get the quote — there is no list price
OneTrust publishes no pricing. Aggregator figures are generated, not vendor numbers. TechBag returns a scoped quote in INR with GST.
Fix the metering and the renewal
Some buyers have reported steep increases after a metering change. Settle the metric and the renewal terms in the first contract, not at renewal.
Ask about ownership
A PE sale was reported as explored in Nov 2025 and has not closed. Ask what it means for roadmap and partner terms over a multi-year commitment.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| Privacy Automation | Quote-only — scoped by programme | Data mapping, DSR automation, DataGuidance | Make DPDP operational |
| Consent & Preferences | Quote-only — scoped by volume | Consent capture, preference centre, withdrawal | Meet DPDP at the customer edge |
| Third-Party Management | Quote-only — scoped by vendors | Inventory, assessments, due diligence | Evidence vendor risk to a regulator |
| Tech Risk & Compliance | Quote-only — scoped by frameworks | Control mapping, evidence reuse, IT risk | Stop re-testing the same control |
| AI Governance | Quote-only — newest line | AI inventory, assessment, oversight record | Govern AI already in use |
Quote-only, scoped by module and volume — TechBag models which obligations actually need which modules, in INR with GST.
Five pitfalls that cost buyers quarters
Reading Visionary as Leader
Leader in the 2026 Gartner MQ for Third-Party Risk Management; Visionary in the inaugural 2026 MQ for AI Governance Platforms, where IBM is a Leader. Don’t cite the TPRM spot for the AI product.
Buying the platform before naming the obligation
Six solution areas is how organisations end up paying for modules nobody runs. If one obligation drives the purchase, scope that module and expand on evidence.
Expecting a GRC platform to be an auditor
Tech Risk & Compliance collects evidence and runs the workflow, but issues no certificate. SOC 2 and ISO 27001 still need a licensed audit firm, paid separately — often near the licence fee.
Budgeting from an aggregator price
OneTrust publishes no pricing; aggregator figures come from reported contracts and vary with scope. Some buyers report steep renewals after a metering change — fix both in the first contract.
Ignoring the ownership question
Reported in Nov 2025 to be exploring a PE sale (rumoured above $10B, last valued ~$4.5B); no deal closed as of Sep 2026. Ask what a sale would change for roadmap, partner terms and support.
The evaluation kit
Each intel page carries an 8-question vendor checklist and a value calculator:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Four trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directionally consistent with public analyst forecasts; verify exact figures before quoting. The takeaway: privacy, vendor risk and AI governance are converging onto one inventory, which is the ground OneTrust is built on.
DPDP moves from statute to deadline
The DPDP Rules were notified on 13 November 2025 with a phased implementation timeline.
What it means for you
Consent, withdrawal and data-principal requests become a system with a deadline, not a policy.
Vendor risk becomes an evidence problem
RBI and IRDAI outsourcing expectations mean a regulated Indian buyer must show who its vendors are and how they were assessed.
What it means for you
OneTrust’s Leader placement rests here — the assessment workflow and audit record.
AI governance gets an analyst frame
Gartner published the first Magic Quadrant for AI Governance Platforms in June 2026.
What it means for you
The category now has a reference point, but it is young — OneTrust is a Visionary, not a Leader.
Evidence reuse beats framework sprawl
Organisations increasingly carry several frameworks at once — ISO 27001, SOC 2, DPDP, sector rules.
What it means for you
Test once, reuse the evidence: the case for a GRC platform over spreadsheets.
Questions buyers ask about OneTrust
Ready to shortlist OneTrust?
Open any of the five intel pages for the deep dive, or let a TechBag advisor build the case with you — DPDP-obligation scoping, quotes, trials, GST invoicing and lifecycle support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.