OneTrust
Consent management · onetrust.com · last read 2026-11-09
At a glance
- Is OneTrust GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what OneTrust itself publishes, each answer linked to its source and the date we read it.
- Does OneTrust have a data processing agreement (DPA)?
- Yes. OneTrust publishes a data processing agreement at onetrust.com. It gives 30 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
- Does OneTrust have a SOC 2 report?
- OneTrust lists a SOC 2 Type 2 report on its own page, with a link to the report itself. We read this on 2026-10-25. Source and date
- Is OneTrust ISO 27001 certified?
- OneTrust states ISO/IEC 27001 certification, and its own page links to the certificate. We read this on 2026-10-25. Source and date
- Where is OneTrust's trust center?
- OneTrust publishes a page it calls “Trust Center” at onetrust.com/trust. Its front page shows no request or sign-in step; documents further in may still have one. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors, security questionnaires and a DPA. We read it on 2026-11-03. Source and date
- How does OneTrust transfer personal data out of the EU?
- OneTrust's agreement relies on the EU standard contractual clauses. OneTrust, LLC is on the official Data Privacy Framework List (status: Active). Source and date
- Does OneTrust offer EU data residency?
- An EU location is offered and the page states no additional charge. Source and date
- Who are OneTrust's subprocessors?
- OneTrust lists 16 third-party subprocessors; 8 of them name at least one processing country outside the EEA. We last read the list on 2026-10-25. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | OneTrust LLC |
|---|---|
| HQ | — |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | OneTrust B.V. |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | onetrust.com · 2026-10-25 |
OneTrust data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | No extra charge | — | docs.onetrust.com | 2026-10-25 |
EU: The standard Cloud option lets the customer "Select hosting locality in" Germany or France, among other locations. It is "Included with all license types," and the document says "Hosting included in license." Only the Dedicated Cloud option requires an Enterprise license and an annual fee.
The same question for every vendor: where SaaS vendors store EU data.
OneTrust's subprocessor list names AWS and Microsoft for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
16 third parties · 11 of the vendor's own group companies · 8 with a country outside the EEA · all read 2026-10-25
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc. | — | Hosting and Infrastructure |
| Birdie (Philo Labs, SAS) | US | Customer support services |
| Cloudflare, Inc. | US, EU | Content Delivery Network ("CDN") and DDoS Protection |
| Confluent Inc. | — | Data streaming and messaging platform |
| Databricks, Inc. | — | Data processing and analytics platform |
| E6DATA, Inc. | — | Analytics platform |
| Elasticsearch, Inc. | — | Documentation Search Engine |
| Glean Technologies, Inc. | US | Customer Support Services |
| Google LLC | — | Bot detection and abuse prevention for websites, including web-based forms using Google reCAPTCHA v.2 or v.3 |
| LangChain, Inc. | US, EU | Deployment and observability for AI agents |
| MavenAGI, Inc. | US | Customer support services |
| Microsoft Corporation | — | Azure AI Services |
| Microsoft Corporation | — | Azure Hosting Services |
| Pendo.io, Inc. | US | End User Behavior Analysis |
| Salesforce | US | Customer Support Services |
| Twilio, Inc. | US | SendGrid services Voice, E-mail, and SMS services |
OneTrust's own group companies listed as subprocessors (11)
| Company | Country | Purpose |
|---|---|---|
| OneTrust Canada Inc. | CA | Implementation, maintenance, support and other related services |
| OneTrust Germany GmbH | DE | Implementation, maintenance, support and other related services |
| OneTrust LLC | US | Implementation, maintenance, support and other related services |
| OneTrust Netherlands B.V. | NL | Implementation, maintenance, support and other related services |
| OneTrust SAS | FR | Implementation, maintenance, support and other related services |
| OneTrust Singapore PTE Limited | SG | Implementation, maintenance, support and other related services |
| OneTrust Technology Limited | GB | Implementation, maintenance, support and other related services |
| OT (Australia) Privacy Ltd | AU | Implementation, maintenance, support and other related services |
| OT Privacy Software Pvt Ltd. | IN | Maintenance and Support |
| OT Technology Inc. | US | Implementation, maintenance, support and other related services |
| OT Technology Spain S.L.U. | ES | Implementation, maintenance, support and other related services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-25 · onetrust.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Notice of new subprocessors | At least 30 days before the change, by updating the online Subprocessors List (shorter in emergencies); customers can sign up for email notifications |
| If you object to one | May object before the appointment on reasonable data protection grounds; may then suspend or terminate the Agreement (fees already incurred still apply) |
| Obligations passed to subprocessors | imposes data protection terms on each subprocessor requiring protection of the Data to the standard required by Applicable Data Protection Law; OneTrust remains liable for subprocessor breaches |
| Breach notification | without undue delay |
| Deletion when the service ends | After the 60-day export period following termination, OneTrust may destroy all Data; this does not apply to Data it must keep by law or Data archived on back-up and support systems, which it continues to protect |
| Getting your data back | On expiration or termination, Customer may export a copy of Customer Content stored in the Software in a structured, commonly used and machine-readable format within 60 days; after that OneTrust may delete any remaining Customer Content |
| Requests from data subjects | reasonable and timely assistance (at Customer's expense) in responding to data subject requests; requests made directly to OneTrust are promptly passed to Customer with full details |
| Audit | Customer reviews compliance information first. If that isn't enough, an audit of procedures and documentation is allowed with at least 45 days' notice and a reasonable fee, no more than once a year (a second is allowed after a material breach). Remote audits are used where possible; on-site only if a walkthrough is needed |
| Transfer impact assessment | Before transferring Data outside the EEA, OneTrust reviews the adequacy of data protection in the third country and applies supplementary measures where necessary |
| Transfer impact assessment | Before transferring to a third country, the vendor reviews whether data protection there is adequate and applies supplementary measures where needed; the measures are described in the OneTrust Support Portal |
| Transfer impact assessment | Vendor provides reasonable cooperation, at customer's expense, so the customer can conduct required transfer impact assessments |
| Processing on your instructions | processing only as strictly necessary to provide the Software and otherwise in accordance with Customer's instructions |
| Confidentiality of staff | Workforce members sign non-disclosure agreements |
| Security measures | appropriate technical and organisational measures ensuring security appropriate to the risk, protecting against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (ISO/IEC 27001 and 27701 certified; SOC 2 Type 2 report) |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does OneTrust have a SOC 2 report?
OneTrust lists a SOC 2 Type 2 report on its own page, with a link to the report itself. We read this on 2026-10-25.
- Certificate published “Audit Reports - SOC 2 Type II”
Source: onetrust.com, 2026-10-25
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is OneTrust ISO 27001 certified?
OneTrust states ISO/IEC 27001 certification, and its own page links to the certificate. We read this on 2026-10-25.
- Certificate published “ISO/IEC 27001 Certification”
Source: onetrust.com, 2026-10-25
On the same list OneTrust also names ISO/IEC 27017 and ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CAIQ: Consensus Assessments Initiative Questionnaire v4.0.3 · CAIQ | Certificate published | Self-Assessment | onetrust.com | 2026-10-25 |
| ENS: Esquema Nacional de Seguridad - Basic attestation · ENS | Certificate published | Basic | onetrust.com | 2026-10-25 |
| HITRUST | Certificate published | — | onetrust.com | 2026-10-25 |
| ISO/IEC 27001 · ISO27001 | Certificate published | — | onetrust.com | 2026-10-25 |
| ISO/IEC 27017 · ISO27017 | Certificate published | — | onetrust.com | 2026-10-25 |
| ISO/IEC 27701 · ISO27701 | Certificate published | — | onetrust.com | 2026-10-25 |
| ISO 9001 · ISO9001 | Certificate published | — | onetrust.com | 2026-10-25 |
| PCI DSS · PCIDSS | Certificate published | — | onetrust.com | 2026-10-25 |
| SOC 2 Type II · SOC2T2 | Certificate published | OneTrust Audit Report; Certification Automation Audit Report | onetrust.com | 2026-10-25 |
| TISAX | Certificate published | — | onetrust.com | 2026-10-25 |
| TX-RAMP · TXRAMP | Certificate published | — | onetrust.com | 2026-10-25 |
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · OneTrust, LLC | Active | HR data, non-HR data | 2027-07-13 | 2026-10-25 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · OneTrust, LLC | Active | HR data, non-HR data | 2027-07-13 | 2026-10-25 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · OneTrust, LLC | Active | HR data, non-HR data | 2027-07-13 | 2026-10-25 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under OneTrust; OneTrust B.V.; OneTrust LLC
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under OneTrust; OneTrust B.V.; OneTrust LLC
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-25)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is OneTrust's trust center?
OneTrust publishes a page it calls “Trust Center” at onetrust.com/trust. Its front page shows no request or sign-in step; documents further in may still have one. The page mentions SOC 2, ISO 27001, a penetration test, subprocessors, security questionnaires and a DPA. We read it on 2026-11-03. Open onetrust.com/trust
- Name “Trust Center”
Source: onetrust.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-25 |
| dpa | Public | full | 200 | 2026-10-25 |
| identity | Public | full | 200 | 2026-10-25 |
| residency | Public | full | 200 | 2026-10-25 |
| subprocessors | Public | full | 200 | 2026-10-25 |
History
Nothing has moved since we started watching this vendor on 2026-10-25. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.