DataGuard vs OneTrust: how they compare in 2026
DataGuard and OneTrust both run privacy programs in one platform, from records of processing and subject requests to impact assessments and consent. The difference is people against paper. DataGuard sells its own certified consultants with the software, can act as a customer's external data protection officer or information security officer, and adds dedicated AI experts for ISO 42001 work, with the platform hosted on Google Cloud in the EU and UK. OneTrust sells software and publishes the documents a reviewer needs: versioned master terms, a data processing addendum, SOC 2 Type II and ISO reports as direct downloads, and an AI Transparency Report naming the model behind each feature. Its AI Governance product and CORIE also register and control a customer's own models and agents. European teams that want compliance done with them should look first at DataGuard. Teams that need to govern AI across many regions and read every term before buying should look first at OneTrust.
Which one fits
Choose DataGuard if
- You want consultants and software from one supplier. DataGuard's Pro plan adds direct access to its certified consultants, and add ons let you appoint DataGuard as your external data protection officer or information security officer.
- You run several European frameworks at once. DataGuard supports GDPR and UK GDPR, ISO 27001, NIS2, TISAX, SOC 2, the EU AI Act, ISO 42001 and the Cyber Resilience Act across multiple entities, with templates and guided workflows aimed at certification.
- You want your compliance data hosted in Europe. DataGuard's platform privacy policy places its virtual machines on Google Cloud in the EMEA region, with processing in the EU and UK and backups on AWS in the same regions.
- Certification speed matters. thankscoach reports reaching ISO 27001 in nine months with no nonconformities, and Windhoff passed a TISAX reaudit in under two months.
- You need consent synced into marketing and CRM tools. DataGuard's consent module documents integrations with Salesforce, HubSpot, Microsoft Dynamics, Braze, Mailchimp and Snowflake, with a REST API, webhooks and setup guides for each.
Choose OneTrust if
- Legal wants to read the contract before a demo. OneTrust publishes its master terms, now at version 5.2, its data processing addendum and standard contractual clauses with every version since 2020, including a liability cap equal to a year's fees and a statement that its services are not legal advice.
- You need to tell a client whose models touch its data. OneTrust's AI Transparency Report, published in November 2026, names the model behind each AI feature, mostly the GPT-4 family through Azure OpenAI, and says customer data never trains them.
- Security wants reports without a sales call. OneTrust's trust center offers its SOC 2 Type II report, ISO 27001, 27017 and 27701 certificates with a statement of applicability, and a 2026 penetration test summary as direct downloads.
- You are governing your own AI models and agents. OneTrust's AI Governance product registers models, agents and datasets against the EU AI Act, NIST and ISO 42001, and CORIE can allow, stop or route an agent's action to a person.
- Your data must sit in a specific region. OneTrust lists twelve hosting regions on Microsoft Azure, from the United States and Germany to Japan, India and the United Arab Emirates, and keeps AI features off by default in EU and UK environments.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
What DataGuard sells is a policy and control library, a risk register with treatment plans, an asset inventory, framework templates, evidence collection and the statutory privacy workflows, all of which work without models. AI sits on top. It drafts policies, ranks high priority risks and suggests security questionnaire answers from previously validated data, and DataGuard says AI keeps work aligned with specific regulatory requirements. In the plan comparison an AI Co-pilot appears as a feature line, and questionnaire processing with AI needs the advanced security platform. DataGuard headlines up to 40 percent of tasks automated.
OneTrust's core is registry and workflow software, from a data map, consent banners and preference centers to data subject request automation, vendor inventories, assessment templates for more than fifty standards and policy approvals, all of which work without a model. AI speeds up existing steps. Copilot's privacy risk, third party risk and analytics agents make recommendations a user approves or dismisses, AI driven assessments are in private preview, and DataGuidance Copilot answers questions about global laws. OneTrust also sells AI governance as a subject, registering and controlling a customer's own models and agents through AI Governance and CORIE, which manages someone else's AI rather than being AI.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
DataGuard's AI security questionnaire tool, described on a February 2024 product update page, claims to answer 100 questions in 10 minutes with at least 90 percent accuracy, filling answers from those saved in the customer's library, which the user can then edit. No test set, method or failure mode accompanies the figure, and the site wide footer says figures are for information only, based on internal estimates and given without warranty as to accuracy or reliability. Other percentages, such as up to 40 percent of tasks automated and certification 75 percent faster, are efficiency claims rather than accuracy measures. Accuracy is asserted without measurement, and grounding is limited to the customer's own saved answers.
OneTrust's AI assisted assessments produce risk summaries and rated findings that a compliance officer acts on, and DataGuidance Copilot answers questions about global laws by retrieving from OneTrust's DataGuidance research. The AI Transparency Report describes each feature's model and data handling, and the Master Terms disclaim any warranty on the accuracy of AI output. No accuracy rate, benchmark, test set or failure mode is published for either, and whether DataGuidance Copilot answers link to the underlying research is not described.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
DataGuard sells oversight as Experts in the Loop, with certified consultants stepping in for complex decisions and strategic review. Those humans are DataGuard's consultants rather than the customer's reviewers, and access to them separates Pro from Base. Inside the product, the questionnaire tool fills answers from the customer's saved library for the user to edit, the one review step described for AI output. No confidence signal, approval rule for automated actions or route for correcting a wrong AI entry that later supports a certification audit is published.
OneTrust's AI Transparency Report says its AI features never act without user approval and their recommendations are always dismissible, and administrators can switch each feature on or off, with preview features off by default. Data subject request redaction lets users validate or edit before approving, AI driven record of processing changes can be reviewed before they are applied, and the AI use case workflow sends assessments to named privacy, security and legal reviewers before a use case proceeds. For customers' own agents, CORIE can allow, stop or route an action to a person and records each request in an evidence ledger. No route for correcting or rolling back an AI output after approval is published.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
DataGuard's customer pages name results. The Law Society of Ireland automated 70 percent of its manual work, thankscoach, through its COO Johannes Darrmann, reports ISO 27001 in nine months with no nonconformities and twice as many tenders won, Aberdeen cut migration effort by half across 23 countries, AppNavi reduced compliance effort to one or two days a month, Cision gained 40 percent efficiency in data mapping, Windhoff passed a TISAX reaudit in under two months and CBTL reached the highest TISAX label in six months. DataGuard claims more than 4,000 organizations in 50 or more countries, and its G2 Fall 2026 badges include first places for Data Privacy Management in Europe, EMEA and the UK. No figure carries a measurement method, and the site footer calls all data internal estimates given without warranty.
The GOL Airlines customer story credits Privacy Coordinator Guilherme with vendor approval falling from almost thirty days to between five and zero and request completion from fourteen or fifteen days to minutes, and quotes Bruna Boccini, Head of Compliance and Data Protection Officer, on reports falling from two or three weeks to minutes. A commissioned Forrester Total Economic Impact study, dated 24 September 2024, reports a 227 percent three year return and a seven month payback with a documented method. Fiserv, Blackbaud, Lumen and Iberia are named in 2026 releases and stories without figures, and OneTrust says more than half the Fortune 500 use it. The GOL figures are the interviewees' own accounts rather than a measured study.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
DataGuard publishes an ISO 27001 Statement of Applicability through its trust center, offers single sign on and granular permissions, and hosts on Google Cloud in the EU and UK under a platform privacy policy, dated April 2026, that names its key processors. Neither that policy nor the General Terms and Conditions says whether customer content trains models, gives a retention period for customer material or identifies a model provider. The content at stake is a customer's record of processing, breach register and certification evidence.
OneTrust's published contract documents include a Data Processing Addendum with version history, a purpose limit under which customer content is used only to provide the services, customer ownership of all data input, tenant separation in a logically separated database with one production environment per customer, ISO 27701 certification, and deletion or export during the term and for sixty days after. The AI Transparency Report says customer data is never used to train the AI models, a policy statement, while the Master Terms let OneTrust use usage data, including query logs, to develop and improve its products. The report names the third party model providers. Privilege and work product are not addressed, though the platform is sold to privacy counsel and assigns a legal reviewer.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Clause 6.3 of DataCo's General Terms and Conditions says its services support the customer in areas within the customer's sole responsibility and that DataCo takes no responsibility for any specific result. The marketing reaches further. The Experts page lists compliance experts, technology advisors and legal counsel, consultants advise on regulatory obligations and certification, an add on appoints DataGuard as the customer's external Data Protection Officer under Articles 37 to 39 of the GDPR, and the Alasco customer story says Alasco replaced expensive law firms with DataGuard's privacy as a service. No page states whether the guided workflows and templates amount to legal advice, and nothing addresses how a nominated DPO stays independent of the platform being assessed.
OneTrust's Master Terms state that the services, documentation and other information it provides do not constitute legal advice, and its AI Transparency Report tells readers to contact their attorney. The platform assigns risk ratings, generates assessments against the EU AI Act, GDPR and state privacy laws, routes them to privacy, security and legal reviewers, and through DataGuidance Copilot answers questions about global laws. No jurisdiction limit, and no treatment of the supervision and competence duties of counsel relying on those outputs, is published.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
DataGuard sells AI governance to its customers, with EU AI Act and ISO 42001 framework pages, an AI system assessment template and dedicated AI expert services, but publishes no governance position for its own AI. No responsible AI statement, named owner accountable for model behavior, release evaluation, test result or bias statement covers its policy drafting, risk ranking or questionnaire features, and DataGuard claims no ISO 42001 certification of its own.
OneTrust's trust center says its AI governance program is run by an interdisciplinary AI Governance Committee, with governance processes across the AI lifecycle, an internal AI use policy and employee training. The AI Transparency Report, dated November 2026, publishes six AI principles, including fairness and inclusivity, and gives each AI feature an EU AI Act risk rating alongside its model and data handling. No individual is named as accountable, and no bias evaluation, test regime or result is published, although OneTrust sells bias and drift monitoring to its customers.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Access control is built into the product through single sign on, granular user permissions and role based permissions. The platform privacy policy, dated April 2026, lists twelve key third party processors with their processing locations, including Google Cloud, AWS, Microsoft, Salesforce, HubSpot, Auth0 and Gong, and places hosting on Google Cloud in the EU and UK with encryption at rest. Its retention language is generic, with data erased once its purpose is fulfilled, and nothing addresses what happens to documents, questionnaire answers or AI output after processing. No incident or breach notification practice for DataGuard's own processing is published, though the product sells incident and breach management to others. The trust center releases the ISO 27001 Statement of Applicability on request.
Retention is set by the customer, with built in data minimization including automatic deletion and retention periods that OneTrust encourages customers to shorten. Customers may delete or export their data in a structured, machine readable format at any time during the term and for up to sixty days after, after which remaining data is destroyed. Access is managed by the customer, with ISO 27001, 27017 and 27701 certification and security duties set out in the published Data Processing Addendum. Subprocessor changes carry thirty days' notice and a right to object, remedied by an alternative or termination of the affected subscription, and incidents are notified without undue delay. Encryption is AES-256 at rest and in backup and at least TLS 1.2 in transit. The AI Transparency Report says customer data is never used to train the AI models and that AI features are off by default in EU and UK environments. The full subprocessor list sits on the customer portal rather than the open trust center.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
DataCo GmbH's General Terms and Conditions, dated 18 December 2023, are published on its site, though not linked from the footer. Clause 17.1 leaves liability unlimited for intent and gross negligence, clause 17.2 limits liability for minor negligence to breaches of essential obligations and caps it at ten times the fees agreed for the year, clause 17.4 extends that protection to DataCo's data protection officers personally, and clause 17.5 sets a one year claims period. Clauses 14.1 and 14.2 give no guarantees, and German law and Munich courts apply. The terms predate the AI features and do not mention AI, so a wrong AI output falls under a standard limitation clause.
OneTrust publishes its Master Terms of Service in a legal center with every version back to August 2020, and version 5.2 is now current after version 5.1 ran from 23 March 2026, alongside the Data Processing Addendum, Standard Contractual Clauses, Business Associate Agreement and product terms. Each party's liability is capped at twelve months' fees, with indemnity, payment, intellectual property and willful misconduct claims outside the cap. An indemnity covers third party intellectual property claims from use of the cloud services, and a warranty commits the services to conform materially to the User Guide. The terms disclaim any warranty on the completeness, accuracy or suitability of AI output and of content from third party data sources, so the risk of a wrong AI output stays with the customer. A plain language explainer sets out the contracting position, including why OneTrust declines uncapped liability for data breach, and no insurance position is stated.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The developer documentation for DataGuard's Consent and Preference Management product gives a setup guide for each named integration. For CRM it covers Salesforce, HubSpot and Microsoft Dynamics, and for marketing automation Braze, Brevo, Mailchimp and Salesforce Marketing Cloud. Identity runs through Auth0 and Ping Identity, data warehousing through Snowflake, and forms through FormAssembly, Formstack and WordPress Contact Form 7. It also documents a REST API with an OpenAPI reference and Postman collection, webhooks, bulk export, import and deletion endpoints, embeddable JavaScript widgets, mobile integration paths, and single sign on via Azure Active Directory, SAML and OpenID Connect. The documentation covers only the consent module, which is sold as an add on rather than as the core platform, and it sits on a separate domain carrying an acquired product's branding, last updated November 2024.
OneTrust publishes an API and SDK reference on its developer site, and its integrations catalog lists 112 connectors. Named connections include Microsoft 365, Snowflake, Adobe and Amazon Redshift, Athena and RDS, and the AI Governance product connects to Amazon Bedrock AgentCore, Azure AI Foundry, Databricks Unity Catalog, Google Vertex AI, Jira and Palo Alto Networks. An MCP Gateway to Claude, ChatGPT, Copilot and Glean is in private preview, and a Workday Agent Passport integration was announced in October 2026 as planned. OneTrust is also sold through the Azure Marketplace. What each connector moves, and in which direction, is not described in the catalog.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
DataGuard's platform privacy policy, dated April 2026, says the platform's virtual machines run on Google Cloud in its EMEA region with all data encrypted at rest and processing in the EU and UK, and that AWS holds backups, also in the EU and UK. No country or data center is named, nothing states whether the platform is single or multitenant, and no dedicated or private deployment is offered at any tier. Where AI processing runs is not given separately from platform hosting, and the Enterprise tier's region specific configurations describe a setup capability rather than a residency choice.
OneTrust's contracting explainer describes cloud services on shared architecture, with customer data in a logically separated cloud database and each customer given a single production tenant, plus nonproduction environments in some subscriptions. Its support documentation lists twelve hosting regions on Microsoft Azure, in the United States, United Kingdom, Germany, France, Switzerland, Australia, Singapore, Canada, Brazil, Japan, India and the United Arab Emirates. HIPAA and PCI compliant environments are available, backed by a published PCI attestation and HITRUST certification. AI features are off by default in the German, EU, French, Swiss and UK environments, and where AI processing runs is not stated separately from where data is stored.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The trust center at trust.dataguard.com is linked from the footer and sets out its access process. A document is requested by entering an email address, requests are typically reviewed within 24 hours, and anything unlisted can be requested by email, so documents are released without a sales conversation. The one named artifact is DataGuard's ISO 27001 Statement of Applicability, alongside a generic Reports section. No certifying body, certificate number, scope or validity period is published, and DataGuard, which sells ISO 42001 support to customers, claims no ISO 42001 certificate of its own.
Current, independent attestations can be downloaded directly as PDFs, with no form, email capture or NDA click, including a SOC 2 Type II report, a second SOC 2 Type II for Certification Automation, ISO/IEC 27001, 27701, 27017 and ISO 9001 certificates, and a Statement of Applicability showing which controls are in scope. Alongside them sit a PCI DSS attestation signed November 2025 with a responsibility matrix, a HITRUST certification letter, TISAX, TX-RAMP, the Spanish ENS conformity statement, and a CAIQ v4.0.3 self assessment on the Cloud Security Alliance STAR registry. Documentation extends to a 2026 penetration test summary, a completed SIG questionnaire, a security, privacy and architecture whitepaper, disaster recovery and continuity exercise memos, a live status page and, since November 2026, an AI Transparency Report. OneTrust lists no ISO 42001 certification of its own.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
DataGuard names AI powered automation as a platform pillar, and its AI drafts policies, ranks high priority risks and suggests security questionnaire answers. No model, provider or version is named anywhere, including the platform privacy policy's list of twelve key third party processors, whose entries such as Google Cloud, AWS, Microsoft and Salesforce are not identified as model providers. Where AI processing runs is not stated separately from platform hosting on Google Cloud in the EU and UK, and no commitment to notify customers of a model change is published. The AI is described without identifying what sits underneath it.
OneTrust's AI Transparency Report, dated November 2026 and linked from its trust page, names the model behind each AI feature. Most features run on the GPT-4 family from Azure OpenAI, including GPT-4o, GPT-4o-mini and o3-mini, alongside OpenAI embeddings, Microsoft Translator and an in house classifier, and Gemini 3 Flash is used in preview for Third-Party Risk only. The report adds that MavenAGI presently uses OpenAI and Anthropic as model providers. It says models may change without notice except where they process customer data, which brings those changes under the data processing addendum's thirty day subprocessor notice. Where each model runs is not stated beyond the provider, and AI features are off by default in EU and UK environments.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Three tiers each have a stated audience. Base is the platform alone for teams with internal expertise, Pro adds direct access to in house experts, and Enterprise serves complex needs across multiple entities. A feature comparison marks which capabilities need the advanced platform or a dedicated expert, and add ons show what costs extra, including consent and cookie management, whistleblowing, global legal analysis, exposure management, external Information Security Officer and Data Protection Officer services, and dedicated AI experts for ISO 42001. Every tier resolves to a quote request. No figure, range, currency or charging unit is published, so whether pricing runs per seat, entity, framework or employee is not stated.
OneTrust's pricing and packaging page sets out nine packages across five solution families, listing key features so the split between base and suite editions is visible, and gives each package its own charging meter. AI Governance is metered on admin users and AI inventory, the Consent Management Platform on average daily visitors, Universal Consent and Preference Management on data subject profiles, Privacy Automation on users and privacy asset inventory, Tech Risk and Compliance on admin users and asset inventory, and Third-Party Management on admin users and third party inventory. Pricing runs in tiers on those meters, and an account executive moves a customer up a tier when usage consistently exceeds its limits. No rate, band, floor or currency is published, every package routes to a pricing form, and implementation and professional services costs are not stated.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Coverage is described by framework and segment. Framework pages cover GDPR and UK GDPR, ISO 27001, NIS2, TISAX, SOC 2, the EU AI Act, ISO 42001, ISO 9001:2026 and the Cyber Resilience Act, and operation across multiple entities and frameworks is a named capability. Solutions pages address SMEs, corporates, manufacturing and industrial firms, healthcare and technology companies, and named customers range from the Law Society of Ireland and Aberdeen to Cision, Windhoff and thankscoach. DataGuard claims more than 4,000 organizations in 50 or more countries. Company size limits and unsupported jurisdictions are not stated, and no page is written for in house legal teams or data protection officers as buyers.
Coverage is described by function, role and regulation. Six solution families cover AI governance, data use governance, privacy automation, consent and preferences, tech risk and compliance, and third party management, role pages address data, marketing, privacy, and security and risk teams, and regulation pages cover GDPR, United States privacy law and the EU AI Act. Tech Risk and Compliance carries templates for more than fifty standards, AI Governance aligns to the EU AI Act, NIST and ISO 42001, and third party screening draws on Dow Jones data. Named customers include Fiserv, Blackbaud, Lumen, GOL Airlines and Iberia, and OneTrust says more than half the Fortune 500 use it. Organization size and poor fit are not addressed, and the role menu has no page for legal teams, although the product's workflow assigns a legal reviewer.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
DataGuard's General Terms and Conditions, dated 18 December 2023, and its platform privacy policy, dated April 2026, both govern the customer relationship, and neither mentions AI or model training, so the silence sits in documents that could carry the answer. The AI features, including questionnaire answers drawn from a customer's saved library, are described with no data commitment, and no model provider is named. Nothing grants or withholds a right to train.
OneTrust's AI Transparency Report, published in November 2026, says customer data is never used to train the AI models, a policy statement rather than a contract term. The Master Terms limit use of customer content to providing the services but let OneTrust use usage data, including query logs, to develop and improve its products, and they do not say whether query logs fall under the training statement.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
DataGuard's platform privacy policy, dated April 2026, says data is erased once the purpose of processing is fulfilled, with no period for prompts, outputs, questionnaire answers or uploaded evidence. The AI features are described by function without data handling terms, and no deletion route, configurable window or default period appears for AI material.
Retention is a product setting under the customer's control. The contracting explainer says some services include built in data minimization, including automatic deletion and retention periods, and that OneTrust encourages customers to configure them to reduce the personal data held. Customers may delete or export their data in a structured, machine readable format at any time during the term and for up to sixty days after termination, after which remaining data is destroyed.
No zero retention option is stated, and no separate period is published for AI prompts or generated assessments as distinct from customer records generally.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
A permission model of DataGuard's own is offered as product features. The plan comparison names single sign on and granular user permissions together under an Admin and Access Controls feature group available across tiers, and role based permissions appear in the platform's documented feature set. The consent module's developer documentation adds single sign on via Azure Active Directory, SAML and OpenID Connect, API authentication and separate environments.
Operation across multiple entities is published as a capability, which is how a group separates one subsidiary's compliance program from another's. How those permissions map to a wall in practice is not published, and nothing addresses separation between engagements where DataGuard's own consultants have access under the Pro tier or as a nominated external Data Protection Officer.
OneTrust runs its own documented permission and separation model at tenant and user level. The contracting explainer says customer data sits in a logically separated cloud database, each customer gets a single production tenant for all subscribed services, and the customer's own users control access and what data is submitted, with OneTrust having no specific access to it. ISO 27701 certification covers the surrounding privacy management system.
Nothing describes separation within one customer account, such as walls between teams, business units or matters, although the published workflow sends one AI use case to privacy, security and legal reviewers in different functions.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
No compelled disclosure or customer notice position appears on DataGuard's product, framework or pricing pages, its trust center or its platform privacy policy, and no transparency report or government request statement is published. The question sits within DataGuard's own subject matter, since customers buy it to handle data subject and authority interactions.
OneTrust's contracting explainer says it does not voluntarily disclose or give access to customers' personal data to government authorities unless required by law, and points to a published policy and transparency report on government and law enforcement requests. The Master Terms commit to notice before a compelled disclosure of confidential information, a term that includes customer content.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
GDPR, UK GDPR, ISO 27001, NIS2, TISAX, SOC 2, the EU AI Act, ISO 42001, ISO 9001:2026 and the Cyber Resilience Act are delivered through policy templates, ready made risk and control libraries and guided workflows, with a global legal analysis add on tracking regulatory developments. No regulatory data source, publisher or feed is named, and no update cadence is published for the libraries or the legal analysis add on.
No licensing basis is stated for any standard reproduced in the platform, though ISO and TISAX content are proprietary and the site separately disclaims any affiliation with the ENX Association that owns TISAX.
OneTrust names the reference data behind its products. DataGuidance Copilot's answers are generated from proprietary OneTrust DataGuidance research, the consent product draws on a database of more than 45 million categorized cookies and trackers, third party management carries risk data on millions of third parties, and Dow Jones databases supply politically exposed person, sanctions and watchlist screening. DataGuidance is OneTrust's own, no license basis is stated for the third party datasets, and no update cadence is published for any of them.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Staying current with changing regulation is sold as a product capability: a global legal analysis add on that tracks legal requirements, framework libraries maintained for GDPR, ISO 27001, NIS2, TISAX and the EU AI Act, and monitoring and periodic review workflows. Nothing states how or how often the regulatory content is updated, no effective date or version is shown on template or control content, nothing flags when a requirement a customer has mapped has changed, and no verification prompt exists.
The product does not retrieve or cite primary legal authority; for a compliance platform the equivalent risk is a control library that has fallen behind a regulation.
OneTrust's assessments, registers and controls do not cite case law, and DataGuidance Copilot answers questions about global laws from OneTrust's DataGuidance research rather than returning authorities with subsequent history. No citator or treatment check is described. The nearest equivalent is regulatory currency, with DataGuidance intelligence tracking regulatory changes and AI Governance aligning assessments to the EU AI Act, NIST and ISO 42001.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
DataGuard does not describe what its AI does when it cannot answer reliably: no way to abstain or return no answer, and no confidence or grounding signal on policy drafts, risk rankings or questionnaire answers. The questionnaire tool fills answers from the customer's saved library for the user to edit, and the Experts in the Loop tier lets DataGuard's consultants step in for complex decisions. Both are routes to human review, available in full only from the Pro plan upward, rather than a description of how the system behaves when unsure.
OneTrust's AI assessments return a risk summary and rated findings, but a risk rating is a conclusion about the subject rather than the model's confidence, and no abstention path, confidence measure or coverage indicator is documented for its features or for DataGuidance Copilot. The AI Transparency Report says recommendations are always dismissible and features never act without user approval, so an uncertain output is caught by the reviewer rather than flagged by the system.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
Damien Charlotin's AI Hallucination Cases database, which held 2,262 cases on 2 November 2026, names no court order, opinion or disciplinary record involving DataGuard or DataCo GmbH. DataGuard's AI drafts compliance policies, ranks risks and suggests questionnaire answers rather than preparing court submissions.
Damien Charlotin's AI Hallucination Cases database, which held 2,262 cases on 2 November 2026, names no court order, opinion or disciplinary record involving OneTrust or OneTrust Copilot. OneTrust's AI output is a risk rating, assessment or model documentation used inside a governance workflow and gated by human approval, along with DataGuidance Copilot answers on global laws, rather than citations prepared for filing.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No public material engages professional guidance or any professional authority. The regulatory frameworks DataGuard serves are named throughout, but they are the subject matter of the compliance work rather than guidance on how a professional should use software in that work. No bar association, law society, supervisory authority, data protection authority or professional body is named, no guidance or opinion is cited, and nothing addresses the professional obligations of a Data Protection Officer using the platform or of DataGuard's own personnel when nominated to that statutory role under the external Data Protection Officer add on.
The European Data Protection Board and national supervisory authorities publish directly relevant guidance, and none is referenced.
OneTrust covers regulation extensively as subject matter, naming GDPR, state privacy laws, the EU AI Act, NIST, ISO 42001, DORA and more than fifty standards. Its Master Terms say its services are not legal advice, and its AI Transparency Report tells readers to contact their attorney. No ethics opinion, state bar guidance, or Law Society or SRA guidance on counsel using AI is referenced, and nothing addresses how a lawyer's professional duties apply when relying on the platform's assessments.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
DataGuard's customers buy compliance work for themselves rather than billing a client for it, and DataGuard sells its own advisory time alongside the software through the Pro tier, dedicated expert upgrades and external officer add ons. The Alasco customer story describes a set number of expert hours included in the package, so automation bears on the hours a customer buys. Savings claims of up to 40 percent of tasks automated and certification up to 75 percent faster are aimed at the customer's own cost, and the site footer calls all figures internal estimates given without warranty.
OneTrust's buyers are in house privacy, legal and risk teams rather than firms billing clients, and its savings claims are aimed at their own cost. A commissioned Forrester study from September 2024 reports a 227 percent three year return and a seven month payback, and OneTrust says AI driven assessments run 66 percent faster on average. Outside counsel and consultancies that run the platform on client work get no guidance on disclosing or billing AI assisted assessments, and no per matter record of AI assisted work is described for that purpose.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
DataGuard's platform privacy policy lists twelve key third party processors with processing locations, such as Google Cloud, AWS, Microsoft, Salesforce, HubSpot, Auth0 and Gong, which tells a client where data sits. None is identified as running the models behind DataGuard's AI, and no page says who does, so the list does not tell a client who sees its content through the AI. The trust center releases its ISO 27001 Statement of Applicability and reports to anyone who requests them by email, typically within 24 hours, and no data processing agreement or AI terms are published.
OneTrust's AI Transparency Report, published openly in November 2026, names who runs the models behind its AI, with the GPT-4 family from Azure OpenAI for most features, Gemini 3 Flash in preview for Third-Party Risk, and OpenAI and Anthropic models behind MavenAGI. The Master Terms, Data Processing Addendum and Standard Contractual Clauses can be downloaded from the legal center without an agreement, with version histories.
The full subprocessor list sits on the customer portal, with thirty days' notice of changes and a right to object, so a firm can name the model providers to a client before contracting and needs portal access for the complete list.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
DataGuard's platform produces automated evidence collection, control monitoring, reporting ready for audit, periodic reviews, internal audit functions on the expert tiers, and, in the consent module, an audit trail of consent transactions with a documented data export endpoint, so a customer can show what its compliance program did and when. Nothing states that output from the AI Co-pilot or the questionnaire tool is marked as AI output in the record, no model or version is captured against an entry, no record of what a human reviewed or amended before an entry became evidence is described, and no guidance exists for disclosing AI involvement to a certification auditor or supervisory authority, though the evidence the product generates goes to auditors.
OneTrust sells this kind of record for a customer's own AI. AI Governance automates model documentation, audit ready evidence and regulatory reporting, and CORIE's evidence ledger records the agent, request, purpose, outcome and policy behind each AI action. For OneTrust's own features, the AI Transparency Report names the model behind each one, and the published workflow captures sign off by privacy, security and legal reviewers.
No document level export showing which output was machine generated, which model produced it and what a reviewer verified is described.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Refusal and Uncertainty Behavior
- Bar Guidance Alignment
Product updates
The latest logged changes from each vendor, newest first, each linked to its source.
OneTrust
-
Product / capability
OneTrust release 202610.1.0 made eight new Assessment Automation APIs generally available, covering workflow actions, attachments, assigned and linked assessments, and assessment search.
Source -
Safety / governance
OneTrust introduced CORIE (Contextual Orchestration for Reasoning, Intelligence and Evidence), a shared intelligence layer made of a Trust Graph that maps AI systems, models, data, vendors and identities to consent and governance requirements, a Reasoning Engine that applies policies and prior decisions, and an Evidence Ledger that keeps the audit trail.
Source
In summary
DataGuard
DataGuard, the trading name of DataCo GmbH, was founded in Munich in 2018 and runs a privacy program and an information security management system together, covering records of processing, subject requests, impact assessments, breaches, consent, policies, controls, risk and training. Its frameworks run from GDPR, ISO 27001, NIS2 and TISAX to the EU AI Act and ISO 42001, and its AI drafts policies, ranks risks and suggests questionnaire answers. It sells its own consultants and external officer roles alongside the software. The AI Legal Index records hosting on Google Cloud in the EU and UK, published general terms capping liability at ten times the year's fees, and named customer results such as the Law Society of Ireland automating 70 percent of its manual work. Its Base, Pro and Enterprise plans are each sold by quote.
OneTrust
OneTrust sells a governance platform for privacy, data and AI to privacy, security and risk, data and marketing teams, across six solution families from privacy automation and consent to AI governance and third party management with Dow Jones screening data. Copilot agents assist inside the platform, recommending actions a user approves or dismisses, and CORIE governs a customer's own AI agents. According to the AI Legal Index, OneTrust publishes its master terms and data processing addendum with version histories, offers SOC 2 Type II and ISO reports as direct downloads, and names the model behind each AI feature in an AI Transparency Report. John Heyman has led it since February 2026, and each of its nine packages is metered on its own unit and sold by quote.
Questions buyers ask
How do DataGuard and OneTrust differ?
DataGuard pairs a European compliance platform with its own consultants, and can serve as a customer's external data protection officer. OneTrust sells a broader governance platform for privacy, data and AI, with its contracts, security reports and AI model list published openly. Both run records of processing, subject requests, impact assessments and consent. From the AI Legal Index, based on each vendor's own published materials as of November 3, 2026. No vendor pays for placement.
How much do DataGuard and OneTrust cost?
Both sell by quote. DataGuard's Base, Pro and Enterprise plans differ by how much expert support is included, with external officer services and dedicated AI experts sold as add ons. OneTrust sells nine packages, each on its own meter, such as admin users and AI inventory for AI Governance or average daily visitors for consent management. From the AI Legal Index, based on each vendor's own published materials as of November 3, 2026. No vendor pays for placement.
Can DataGuard act as our data protection officer?
Yes. DataGuard sells an add on under which a customer appoints DataGuard as its external data protection officer, with an equivalent external information security officer service, and its general terms extend the liability cap to those officers personally. From the AI Legal Index, based on each vendor's own published materials as of November 3, 2026. No vendor pays for placement.
Where do DataGuard and OneTrust host customer data?
DataGuard runs its platform on Google Cloud in the EMEA region, with processing in the EU and UK and backups on AWS in the same regions. OneTrust offers twelve hosting regions on Microsoft Azure, including the United States, United Kingdom, Germany, France, Japan and India, and keeps AI features off by default in EU and UK environments. From the AI Legal Index, based on each vendor's own published materials as of November 3, 2026. No vendor pays for placement.
Where can I get DataGuard's and OneTrust's security reports?
OneTrust's trust center offers its SOC 2 Type II report, ISO 27001, 27017 and 27701 certificates, a statement of applicability and a 2026 penetration test summary as direct downloads. DataGuard's trust center releases its ISO 27001 statement of applicability and reports when you enter an email address, with requests typically reviewed within 24 hours. From the AI Legal Index, based on each vendor's own published materials as of November 3, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Three points to weigh. DataGuard names no model provider, its general terms and platform privacy policy say nothing on training with customer data, and those terms, dated December 2023, predate its AI features. OneTrust's no training statement sits in its AI Transparency Report rather than its contract, and its Master Terms let it use usage data, including query logs, to improve its products. DataGuard's site footer calls its performance figures internal estimates given without warranty.