OneTrust vs TrustArc: how they compare in 2026

OneTrust's core is registry and workflow software, from a data map, consent banners and preference centers to data subject request automation, vendor inventories, assessment templates for more than fifty standards and policy approvals, all of which work without a model. AI speeds up existing steps. Copilot's privacy risk, third party risk and analytics agents make recommendations a user approves or dismisses, AI driven assessments are in private preview, and DataGuidance Copilot answers questions about global laws. OneTrust also sells AI governance as a subject, registering and controlling a customer's own models and agents through AI Governance and CORIE, which manages someone else's AI rather than being AI.

TrustArc's Terms of Use for AI Features state that use of any AI enabled feature is strictly optional, that no customer data is processed by AI technologies unless the customer uses such a feature, and that the customer may discontinue them at any time. Table 1 lists the features as assistants, lookups, autofill, similarity search, bulk record creation, translations and summaries layered onto PrivacyCentral, Data Mapping, Assessment Manager, Cookie Consent Manager, Trust Center and Nymity Research, each of which functions as a privacy management, assessment or research product without them. Arc Intelligence reached general availability in December 2025 on a platform in operation for decades.

OneTrust's AI assisted assessments produce risk summaries and rated findings that a compliance officer acts on, and DataGuidance Copilot answers questions about global laws by retrieving from OneTrust's DataGuidance research. The AI Transparency Report describes each feature's model and data handling, and the Master Terms disclaim any warranty on the accuracy of AI output. No accuracy rate, benchmark, test set or failure mode is published for either, and whether DataGuidance Copilot answers link to the underlying research is not described.

The AI Terms say TrustArc takes measures designed to ensure accuracy but is not responsible for the quality, accuracy or effectiveness of AI output, and that every output must be reviewed, with a subject matter expert if needed, before use. The NymityAI research chatbot answers from the Nymity library of regulatory summaries and templates, which is licensed content rather than primary law that can be verified without a subscription. No accuracy figure, test set, evaluation or description of how answers cite their sources is published in the AI Terms or on the product pages.

OneTrust's AI Transparency Report says its AI features never act without user approval and their recommendations are always dismissible, and administrators can switch each feature on or off, with preview features off by default. Data subject request redaction lets users validate or edit before approving, AI driven record of processing changes can be reviewed before they are applied, and the AI use case workflow sends assessments to named privacy, security and legal reviewers before a use case proceeds. For customers' own agents, CORIE can allow, stop or route an action to a person and records each request in an evidence ledger. No route for correcting or rolling back an AI output after approval is published.

AI Terms section 2.1 requires the customer to review and validate AI outputs and not rely on them for decision making without human oversight. Section 1.1 requires notice before any AI technology processes customer data and makes every AI feature optional and revocable on request. The features themselves are assistive, with suggestions, lookups, autofill and an evidence analyzer that a user accepts into an assessment or record. No threshold at which the system acts without a person, no description of what executes automatically, and no route back after an output is wrong beyond the customer's own review is published.

The GOL Airlines customer story credits Privacy Coordinator Guilherme with vendor approval falling from almost thirty days to between five and zero and request completion from fourteen or fifteen days to minutes, and quotes Bruna Boccini, Head of Compliance and Data Protection Officer, on reports falling from two or three weeks to minutes. A commissioned Forrester Total Economic Impact study, dated 24 September 2024, reports a 227 percent three year return and a seven month payback with a documented method. Fiserv, Blackbaud, Lumen and Iberia are named in 2026 releases and stories without figures, and OneTrust says more than half the Fortune 500 use it. The GOL figures are the interviewees' own accounts rather than a measured study.

A published case study names the New England Journal of Medicine and its data protection officer, Sean McInnis, describing a migration of a cookie consent tool and the support received, with no measured outcome. A second case study attributes figures to an unnamed Fortune 500 consumer products company: time to compliance cut by up to fifteen percent, privacy program operating expenses reduced by sixteen to thirty percent, and more than three quarters of privacy processes automated, with no method stated. Nothing joins a named customer to a figure, and the AI features are not the subject of either study.

OneTrust's published contract documents include a Data Processing Addendum with version history, a purpose limit under which customer content is used only to provide the services, customer ownership of all data input, tenant separation in a logically separated database with one production environment per customer, ISO 27701 certification, and deletion or export during the term and for sixty days after. The AI Transparency Report says customer data is never used to train the AI models, a policy statement, while the Master Terms let OneTrust use usage data, including query logs, to develop and improve its products. The report names the third party model providers. Privilege and work product are not addressed, though the platform is sold to privacy counsel and assigns a legal reviewer.

AI Terms section 1.1(b), incorporated into the customer agreement, states that customer data will not be used for AI model training, model improvement or any similar purpose, and 1.1(d) that the third party AI technologies are explicitly opted out of LLM training and used solely to generate responses for authenticated users within the TrustArc environment. Table 1 names the third party providers feature by feature. The subscription agreement gives a thirty day retrieval window after termination followed by deletion, and the AI Terms commit to ceasing AI processing promptly on request. No statement on segregation between customers or matters, and no treatment of privilege or work product, appears in the AI Terms or on the trust center.

OneTrust's Master Terms state that the services, documentation and other information it provides do not constitute legal advice, and its AI Transparency Report tells readers to contact their attorney. The platform assigns risk ratings, generates assessments against the EU AI Act, GDPR and state privacy laws, routes them to privacy, security and legal reviewers, and through DataGuidance Copilot answers questions about global laws. No jurisdiction limit, and no treatment of the supervision and competence duties of counsel relying on those outputs, is published.

AI Terms section 1.2(b) requires the customer to review all AI output before use, suggesting consultation with an internal or external subject matter expert, and section 2.1 bars relying on outputs for decisions without human oversight. The buyer is stated as privacy and compliance teams. The Nymity library publishes legal summaries and the research chatbot answers from them, and no page says whether those outputs are or are not legal advice. No jurisdiction limit is named.

OneTrust's trust center says its AI governance program is run by an interdisciplinary AI Governance Committee, with governance processes across the AI lifecycle, an internal AI use policy and employee training. The AI Transparency Report, dated November 2026, publishes six AI principles, including fairness and inclusivity, and gives each AI feature an EU AI Act risk rating alongside its model and data handling. No individual is named as accountable, and no bias evaluation, test regime or result is published, although OneTrust sells bias and drift monitoring to its customers.

The AI Terms are substantive on data use, provider transparency, opt out and change notice, but they say nothing about who inside TrustArc is accountable for the AI features, what is tested before a feature ships, or what has been found about uneven output. No responsible AI page, ISO 42001 or equivalent certification, or model evaluation is published in the legal center or on the trust center. The Assessment Manager product sells AI risk assessment to customers, which is governance of the customer's AI rather than TrustArc's own.

Retention is set by the customer, with built in data minimization including automatic deletion and retention periods that OneTrust encourages customers to shorten. Customers may delete or export their data in a structured, machine readable format at any time during the term and for up to sixty days after, after which remaining data is destroyed. Access is managed by the customer, with ISO 27001, 27017 and 27701 certification and security duties set out in the published Data Processing Addendum. Subprocessor changes carry thirty days' notice and a right to object, remedied by an alternative or termination of the affected subscription, and incidents are notified without undue delay. Encryption is AES-256 at rest and in backup and at least TLS 1.2 in transit. The AI Transparency Report says customer data is never used to train the AI models and that AI features are off by default in EU and UK environments. The full subprocessor list sits on the customer portal rather than the open trust center.

On retention, the subscription agreement keeps customer data for thirty days after termination for retrieval and then permits deletion, except for copies the law requires. The trust center privacy notice keeps personal information only as long as necessary and leaves data about people named in customer assessments under customer control. On deletion, the AI Terms commit to stopping AI processing on request. A public subprocessor list gives each one's location, purpose and transfer mechanism, with emailed notice thirty days before any addition and a separate list of affiliates. On incidents, AI Terms section 1.3 commits to prompt notice of any security incident involving AI processing under the agreement or DPA. The legal center publishes a technical and organizational measures document and a DPA of February 2024. The trust center security page states TLS 1.2 in transit and AES 256 at rest, with intrusion detection and logging.

OneTrust publishes its Master Terms of Service in a legal center with every version back to August 2020, and version 5.2 is now current after version 5.1 ran from 23 March 2026, alongside the Data Processing Addendum, Standard Contractual Clauses, Business Associate Agreement and product terms. Each party's liability is capped at twelve months' fees, with indemnity, payment, intellectual property and willful misconduct claims outside the cap. An indemnity covers third party intellectual property claims from use of the cloud services, and a warranty commits the services to conform materially to the User Guide. The terms disclaim any warranty on the completeness, accuracy or suitability of AI output and of content from third party data sources, so the risk of a wrong AI output stays with the customer. A plain language explainer sets out the contracting position, including why OneTrust declines uncapped liability for data breach, and no insurance position is stated.

Section 8.1 of the subscription agreement gives a TrustArc defense and indemnity for third party claims, stated to be its entire liability and the customer's exclusive remedy, with exclusions for modifications, combinations and use that does not comply. Section 8.2 has the customer indemnify TrustArc for customer data and other matters, and section 7.2 warrants core functionality against documentation, no material decrease during the term, measures against malicious code and diligent services. The terms for users on partner channels cap either party's liability at fees paid for the solution in the previous twelve months. AI Terms section 2.1 gives the AI features the same warranties and exclusions as the solutions, and section 1.2(b) disclaims responsibility for the quality and accuracy of AI output.

OneTrust publishes an API and SDK reference on its developer site, and its integrations catalog lists 112 connectors. Named connections include Microsoft 365, Snowflake, Adobe and Amazon Redshift, Athena and RDS, and the AI Governance product connects to Amazon Bedrock AgentCore, Azure AI Foundry, Databricks Unity Catalog, Google Vertex AI, Jira and Palo Alto Networks. An MCP Gateway to Claude, ChatGPT, Copilot and Glean is in private preview, and a Workday Agent Passport integration was announced in October 2026 as planned. OneTrust is also sold through the Azure Marketplace. What each connector moves, and in which direction, is not described in the catalog.

The subscription agreement contemplates Third Party Applications the customer enables, exchanging data on its behalf, and the Trust Center product page describes pushing documents from content systems, notifying Slack and creating ServiceNow tasks through TrustArc Integrations. No practice, document or matter system is named in either, and nothing describes what syncs or in which direction for the privacy applications.

OneTrust's contracting explainer describes cloud services on shared architecture, with customer data in a logically separated cloud database and each customer given a single production tenant, plus nonproduction environments in some subscriptions. Its support documentation lists twelve hosting regions on Microsoft Azure, in the United States, United Kingdom, Germany, France, Switzerland, Australia, Singapore, Canada, Brazil, Japan, India and the United Arab Emirates. HIPAA and PCI compliant environments are available, backed by a published PCI attestation and HITRUST certification. AI features are off by default in the German, EU, French, Swiss and UK environments, and where AI processing runs is not stated separately from where data is stored.

The subprocessor disclosure gives a location for each processor, including Microsoft in Washington and Canada Central for logging and messaging and Mailgun in Texas for research alerts. The AI Terms place one feature, Ask Arc, on Anthropic in the United States or Bedrock in the EU, which is a region choice stated for that feature alone. The trust center security page refers to an enterprise grade cloud hosting provider without naming it. Nothing states whether customers share infrastructure or where the platform's primary data store sits, and no residency option is described for the platform as a whole.

Current, independent attestations can be downloaded directly as PDFs, with no form, email capture or NDA click, including a SOC 2 Type II report, a second SOC 2 Type II for Certification Automation, ISO/IEC 27001, 27701, 27017 and ISO 9001 certificates, and a Statement of Applicability showing which controls are in scope. Alongside them sit a PCI DSS attestation signed November 2025 with a responsibility matrix, a HITRUST certification letter, TISAX, TX-RAMP, the Spanish ENS conformity statement, and a CAIQ v4.0.3 self assessment on the Cloud Security Alliance STAR registry. Documentation extends to a 2026 penetration test summary, a completed SIG questionnaire, a security, privacy and architecture whitepaper, disaster recovery and continuity exercise memos, a live status page and, since November 2026, an AI Transparency Report. OneTrust lists no ISO 42001 certification of its own.

The trust center security page states an annual assessment by a qualified outside auditor against the AICPA SOC 2 Type II standard, alongside TLS 1.2 in transit, AES 256 at rest, intrusion detection, logging and incident response plans. The trust center has privacy, security, availability and legal sections. No auditor is named and no coverage period is stated. The report sits behind the trust center's permissions, which TrustArc's own Trust Center product page describes as keeping SOC 2 reports behind confidentiality requirements. No ISO certification is stated on the trust center.

OneTrust's AI Transparency Report, dated November 2026 and linked from its trust page, names the model behind each AI feature. Most features run on the GPT-4 family from Azure OpenAI, including GPT-4o, GPT-4o-mini and o3-mini, alongside OpenAI embeddings, Microsoft Translator and an in house classifier, and Gemini 3 Flash is used in preview for Third-Party Risk only. The report adds that MavenAGI presently uses OpenAI and Anthropic as model providers. It says models may change without notice except where they process customer data, which brings those changes under the data processing addendum's thirty day subprocessor notice. Where each model runs is not stated beyond the provider, and AI features are off by default in EU and UK environments.

Table 1 of the AI Terms maps every AI feature to its AI technology and outside provider, and the models themselves are not named. The Azure AI Platform from Microsoft runs the Nymity research chatbot and lookups. The OpenAI API runs autofill, similarity search, bulk record creation, evidence analysis, summaries and cookie research, and the Gemini API from Google Cloud runs translations and assisted upload. Ask Arc runs on either Anthropic in the United States and Amazon Bedrock in the EU, or on the OpenAI API, depending on which of two versions of the table the page shows; the two versions disagree. Section 2.2(b) commits to thirty days' notice and a right to object before any change that materially and adversely affects the customer, including changes to provider relationships. Section 1.1(d) says the providers are opted out of training language models. The technology column names platforms and APIs rather than models.

OneTrust's pricing and packaging page sets out nine packages across five solution families, listing key features so the split between base and suite editions is visible, and gives each package its own charging meter. AI Governance is metered on admin users and AI inventory, the Consent Management Platform on average daily visitors, Universal Consent and Preference Management on data subject profiles, Privacy Automation on users and privacy asset inventory, Tech Risk and Compliance on admin users and asset inventory, and Third-Party Management on admin users and third party inventory. Pricing runs in tiers on those meters, and an account executive moves a customer up a tier when usage consistently exceeds its limits. No rate, band, floor or currency is published, every package routes to a pricing form, and implementation and professional services costs are not stated.

No pricing information is published in the legal center, the subscription agreement or the AI Terms. The legal center lists agreements and policies with no pricing document, the subscription agreement refers fees to the order, and the AI Terms mention usage limits such as daily query caps without a charge.

Coverage is described by function, role and regulation. Six solution families cover AI governance, data use governance, privacy automation, consent and preferences, tech risk and compliance, and third party management, role pages address data, marketing, privacy, and security and risk teams, and regulation pages cover GDPR, United States privacy law and the EU AI Act. Tech Risk and Compliance carries templates for more than fifty standards, AI Governance aligns to the EU AI Act, NIST and ISO 42001, and third party screening draws on Dow Jones data. Named customers include Fiserv, Blackbaud, Lumen, GOL Airlines and Iberia, and OneTrust says more than half the Fortune 500 use it. Organization size and poor fit are not addressed, and the role menu has no page for legal teams, although the product's workflow assigns a legal reviewer.

The buyer is stated as privacy, legal, security and compliance teams in enterprises, with the Nymity library covering privacy regulations, legal summaries and operational templates globally. Product navigation names the EU AI Act, India's data protection law and the EU US Data Privacy Framework among covered regimes. Case studies span healthcare, publishing and consumer products, and the TRUSTe assurance programs serve a separate certification market. Nothing states where the product stops: no jurisdiction or regulation is named as unsupported and no law firm use is described.