Assessment Automation - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

New Rich Text Editor for Assessments
The new rich text editor is now available across Assessment Automation. This enhancement includes:

  • Full-screen mode: Expand any editor to full screen, including editors inside pop-ups, without losing your text or cursor position.

  • Keyboard shortcut help: A new help button that lists all keyboard shortcuts.

  • Code formatting in templates: Question descriptions and welcome messages can now use a Code paragraph style alongside Normal text.

  • Automatic links: Typing or pasting a web address turns it into a clickable link.

  • Cleaner pasting: Content pasted from Word, Teams or web pages keeps its text, lists, bold, and links.

You will see the new editor in the following places:

  • Assessment detail: Question descriptions, text answers and justifications, comments, Needs More Info requests and replies, and notes.

  • Templates: Question descriptions in the question builder and the welcome message.

  • Global Readiness: Welcome question preview.

Information Request Data in Reports

You can now access information request data directly through column reports. This enhancement streamlines tracking and analysis of requests without manual effort, and improves visibility and response times across your compliance workflows.

For more information, see Data Glossary for PIA & DPIA Automation Reports.

Lazy Loading in Multiselect Attribute Dropdown Lists

Multiselect attribute dropdown lists in assessments now use lazy loading by default. This update ensures that additional records are automatically fetched as users scroll past the initial 200 results, allowing customers with large inventories to successfully locate and select the appropriate records when answering assessment questions.

Attribute-Based Access Control (ABAC) Phase 1

Introducing Attribute-Based Access Control (ABAC), a new access-control model that brings record-level access management to the OneTrust Platform as part of ABAC Phase 1: Foundations. ABAC complements the platform's existing Role-Based Access Control (RBAC) model by adding more granular control over who can access specific records and what actions they can perform. Rather than granting access to all records within a solution, ABAC uses assignments and attributes to determine which records a user can access and what permissions they have on those records, helping organizations implement least-privileged access more effectively.

At General Availability, ABAC Phase 1: Foundations adds reporting across all object types, record-level admin access rules across all supported object types, and system assignments that are enabled for all supported objects, so users can start sharing records right away, even before you create custom assignments.

All supported objects across Privacy Automation have feature parity within the context of ABAC Phase 1 capabilities, excluding assessments, and ABAC is enabled in all tenants regardless of packaging and pricing.

For more information, see Attribute-Based Access Control (ABAC) Phase 1: Foundations in the Settings & Administration release notes. This feature is related to the following ideas: PLTI-I-638 and GCIA-I-918.

Note:

ABAC Phase 1: Foundations is rolling to General Availability incrementally by environment from November 2026 through March 2027. The rollout is per environment and is not part of the standard release process, and dates are subject to change. Additional capabilities and object support will be introduced in future releases through ABAC Phase 2: Dynamic Access.

For more information, see Attribute-Based Access Control (ABAC) User Guide and Managing Attribute-Based Access Control (ABAC) for Privacy Automation.

Mention Users in Comments with Attribute-Based Access Control (ABAC)

In Privacy Automation, mentioning other users in comments is now available for everyone when they have the access ability to comment. Permissions are checked throughout, including after an assignment changes.

Fixed

  • Resolved an issue that prevented Incident assessments based on the the PIA template from being included in assessment exports.

  • Resolved an issue that caused the Save button to remain disabled after resolving duplicate option errors when editing a multiple-choice question.

  • Resolved an issue that caused the cursor to reset to the beginning of the text box while typing responses in an assessment.

  • Resolved an issue that prevented the download link for PDF or Excel template exports from displaying in the Notification center for on-premises users.

  • Resolved an issue that allowed unauthorized users to view the user list and modify the Record admin field on an assessment.

  • Resolved an issue that prevented assessments from linking to selected project inventory records and caused existing links to be removed upon completion.

  • Resolved an issue that caused the Export Template API to omit keys with null values, such as responseCount, option, and optionId, from the response schema.

  • Resolved an issue that caused deleted user groups to be automatically added as section approvers when creating new assessments from a template.

  • Resolved an issue that prevented translated section names from displaying when viewing an assessment in a language other than English.

  • Resolved an issue that prevented the Third-Party Risk Agent from launching intake assessments in Copilot.

  • Resolved an issue that prevented update and delete requests through the Manage Assessment Question Attachments API from returning results, with users instead seeing an access denied message.

Existing Public Preview Features

Privacy Risk Agent | Available with Solution Packaging Only

Leverage our Privacy Risk Agent in Copilot to streamline the creation of processing activities and the completion of assessments. This agent dramatically reduces the time and manual effort required to complete PIAs, improves accuracy through semantic matching and document-based autofill, and provides transparent confidence scoring, which enables Privacy Managers to complete assessments faster, more consistently, and with greater confidence.

For more information, see OneTrust Privacy Risk Assessment Feature Guide.

Launch Reassessments as Not Started
Configure reassessments to default to the Not Started stage upon launching. This enhancement applies to copied assessments, reassessments launched via automation rules, and reassessments launched via API.
Company Names in Email Notifications

Display your company name in assessment email notification templates using the __TenantName__ email variable when notifying users. This enhancement enables you to provide assessment notifications on behalf of your organization that reflect your tenant's name.

For more information, see Customizing Assessment Email Templates Using Dynamic Variables.

Accessibility Conformance

  • The rich text editor now maintains high contrast and displays visible focus indicators when Forced Colors mode is enabled (WCAG‑AA 1.4.3: Contrast (Minimum)).

  • Tooltip info messages on the Complete section modal of an assessment are now focusable when using a keyboard (WCAG‑A 2.1.1: Keyboard).

  • The View approvers popover now includes a close button and no longer remains open when navigating away from the element (WCAG‑A 2.1.1: Keyboard).

Permissions

Advanced attributes redacted for users with Standard-only view permissions

Users with only Standard attribute view permissions now see Advanced attributes as redacted in the assessment list view, assessment details, and side panels. Standard attributes display as before. Users with Advanced attribute view permission continue to see all attributes, with no change.

Updated Standard and Advanced attribute classification

Assessment attributes used for Attribute-Based Access Control (ABAC) have been reclassified. ID, Stage, Date submitted and Date completed are now Standard attributes.

Standard attributes: Name, ID, Template, Workflow, Organization, Primary record ID, Primary record name, Stage, Respondent, Approver, Record admin, Tags, Deadline, Date submitted, Date completed.

Advanced attributes: Result, Inherent risk score, Residual risk score, Target risk score, Open risk count, Open issue count, Open info request count, Approval stage, Pending reviews, Date deleted, Deleted by, Template version, Creator, Date created.

Template Updates

OnePIA (Full) - 7.7 Change Log

OnePIA has been updated to account for the latest amendments to the comprehensive US state privacy laws of Connecticut and Virginia. Customers interested in compliance with these frameworks are impacted by this release.

The following is the change log for this release:

  • Updated the logic of question 4.37.

  • Added new question 5.13 for Sale of consumers' precise geolocation data [US-VA, US-CT].

  • Created the new Geolocation Data Sale [US-CT, US-VA] rule.

Things to Know

Template Support for Engagement and Contract Question Types

Gallery templates now support Engagement and Contract question types, allowing templates containing these question types to be imported and cloned to launch assessments.

Enhanced Error Messages Across Assessment Automation
Error messages across Assessment Automation have been enhanced so that failed submissions, approvals, and web form entries now display specific, accurate, and human-readable messages. They also now display a corrective next step, ensuring you will always know what you need to do to resolve an error.
Changes to Paid Permissions

Several assessment workflow permissions, including creating, editing, and publishing workflow templates, are now classified as licensed (paid) permissions. For more information, see Subscription Management: Privacy Automation.

Improved Error Messages

Users now receive a clear access denied message when attempting to access an assessment for which they do not have permission, rather than a generic page not found error.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.