Directory CybersecurityData Security & DLPOneTrust

OneTrust

About OneTrust

OneTrust provides the OneTrust AI-Ready Governance Platform, which connects privacy, data, AI, and technology risk in one system. The platform allows organizations to define purpose, automate assessments, enforce controls, and monitor risks across domains. OneTrust builds a platform that addresses trust transformation across privacy, security, and ethics. The company developed the first technology platform for responsible data use in 2016. OneTrust offers pre-built integrations to connect with other business systems.

Products

AI Governance: Embeds compliance and control across the AI lifecycle.
Universal Consent & Preference Management: Gives users control over their consent, preferences, and first-party data through a single portal.
Consent Management Platform: Captures and manages cookie consent across websites, mobile apps, OTT apps, and connected TVs.
Privacy Operations: Provides visibility into data flows, classifies assets, assesses privacy risks, and manages incidents and notices.
Data Subject Request (DSR) Automation: Automates the DSR fulfillment process from intake and ID verification to data discovery, redaction, and response.
Third-Party Risk Management: Automates the third-party lifecycle including onboarding, assessment, risk mitigation, reporting, monitoring, and offboarding.

Used for

Managing enterprise-wide AI initiatives, models, agents, datasets, and vendors in a single system of record.
Aligning AI risk assessments and tiering to global frameworks like the EU AI Act, NIST, and ISO 42001.
Automating data subject request fulfillment including intake, ID verification, data retrieval and deletion, and secure communication.
Capturing and activating consent across web, mobile, and CTV from one platform.
Automating vendor assessments and risk mitigation with customized workflows and ecosystem integrations.

Who it is for

Used by more than half of the Fortune 500.
Used by Privacy, Security, and Legal reviewers within organizations.
Used by companies of various sizes, described as large and small.
Used by compliance and data protection roles, such as a Head of Compliance and Data Protection Officer.

From OneTrust's own website, read 2026-10-23. How we build listings.

How to evaluate Data Security & DLP

This is how the CIOPages Research Team evaluates this category. It is not an assessment of OneTrust. The category covers two kinds of product, so both frameworks are here. Most buyers need one of them.

Data Loss Prevention (DLP)

30%

Classification Accuracy & Detection

Exact data match (EDM) and indexed/document matching for structured records, ML and trainable classifiers for unstructured content, fingerprinting, OCR on images and screenshots, and the false-positive rate observed on YOUR data — not the vendor’s sample set

25%

Channel Coverage & Enforcement

Consistent policy across endpoint (USB, clipboard, print, local sync), network/web, email, sanctioned and unsanctioned cloud/SaaS, and increasingly GenAI prompts — with real enforcement (block, encrypt, quarantine, justify) on each channel, not just monitoring

15%

Insider Risk & Behavioral Context

Risk-adaptive enforcement that tightens around high-risk users, UEBA and activity timelines, integration with IRM, and the ability to back-test a new policy against historical activity before it goes live

15%

Data Discovery & DSPM Convergence

At-rest discovery across endpoints, file shares, databases, and cloud stores; data-security-posture visibility (where sensitive data lives, who can access it); and whether discovery, DLP, and DSPM share one classification model and console

10%

Tuning, Operations & Incident Workflow

Quality of the incident queue and remediation workflow, policy simulation/monitor mode, end-user coaching and self-remediation, SIEM/SOAR/XDR integration, and the realistic FTE load to run the program day to day

Deployment Model & Architecture

Cloud-delivered vs. on-prem servers and appliances, endpoint agent footprint and performance impact, data residency for incident evidence, and fit with an existing SSE/SASE or M365/Workspace estate

Data Security Posture Management (DSPM)

25%

Classification Accuracy & Sensitive-Data Discovery

Precision and recall on your data — structured and unstructured — beyond regex and dictionaries; AI/ML and LLM-based context detection for proprietary IP, source code, and free-text documents; secrets and credential discovery; false-positive rate; ability to learn custom data types without heavy rule-writing

20%

Data-Store & Environment Coverage

Depth across managed cloud databases (RDS, Cosmos, Cloud SQL), object storage, data warehouses (Snowflake, BigQuery, Redshift, Databricks), SaaS apps (M365, Salesforce, Google Workspace), on-prem file shares and NAS, and shadow/unmanaged stores; agentless connect-and-scan vs. agent or proxy requirements; does data leave your tenant?

20%

Risk Context: Identity, Access & Exposure

Linking each sensitive store to who can access it (data access governance), effective permissions across human and machine identities, public/internet exposure, third-party and external sharing, and — ideally — reachable attack paths; the quality of the “exposed regulated data” shortlist versus a flat inventory

15%

AI & LLM Data Security (AI-SPM)

Discovery of sensitive data in AI training sets, RAG sources, and vector stores; governance of data flowing into and out of copilots and LLM apps; detection of shadow AI; oversharing assessments for tools like Microsoft 365 Copilot; data-use policy enforcement at the AI boundary

10%

Remediation, DDR & Workflow Integration

Guided and automated remediation (revoke access, fix permissions, quarantine, tokenize/mask), real-time data detection & response on data movement and exfiltration, ownership routing to the right team, and clean integration with SIEM/SOAR, ITSM, and existing DLP rather than a siloed dashboard

10%

Compliance, Privacy & Reporting

Out-of-the-box mapping to GDPR, CCPA/CPRA, HIPAA, PCI DSS and emerging AI regulation; data-residency and sovereignty detection; support for privacy workflows (DSAR/RoPA) where the same engine serves the privacy office; audit-ready evidence, data-risk trend reporting, and RBAC/SSO on the console

Other Data Security & DLP Vendors

CIOPages put this listing together from public sources. It’s information, not an endorsement. How we build listings. Work here? Claim this listing or .