What it is
OneTrust is the privacy program platform most in-house legal and privacy teams inherit: cookie and consent management, data mapping and records of processing (RoPA), subject-request (DSAR) automation, privacy impact assessments, third-party risk, and — the part it now leads with — AI governance. It is sold as modules on one platform, not as a single product, and each module is priced on its own meter. Founded in Atlanta by Kabir Barday, it was valued at $4.5 billion in its last priced round (2023) and says more than half the Fortune 500 are customers. IDC’s first market-share report on privacy software put it at 29.7%, more than twice the nearest rival; that number is from 2022, but nothing published since suggests the order has flipped.
Two things changed in 2026. John Heyman replaced Barday as CEO on February 9, with Barday moving to the board. And at TrustWeek (September 28–30, Las Vegas) OneTrust made AI-agent governance the headline: CORIE, a shared reasoning and evidence layer, plus an AI Control Plane that evaluates agent actions at runtime and a Governance Command Center, all announced as generally available. The pieces that would put OneTrust inside the tools people actually use — a headless MCP Gateway for ChatGPT, Claude, Copilot and Glean, AI-driven assessments, conversational consent — are private preview for fall 2026. Gartner named it a Visionary, not a Leader, in its inaugural 2026 Magic Quadrant for AI Governance Platforms.
Why it shows up in Legal Ops stacks
- It is the system of record auditors and regulators already expect. A RoPA, a DPIA trail and a consent log that a supervisory authority has seen before is worth something in a GDPR inquiry.
- One inventory feeds several obligations. The data map built for RoPA is the same map that scopes a DSAR search and a vendor assessment. Teams running the DSAR intake flow or the vendor due-diligence skill end up needing that map anyway.
- AI inventory arrives with the EU AI Act. OneTrust’s AI governance module registers models and use cases, runs risk assessments against the Act and NIST frameworks, and ties them back to the privacy inventory. That linkage is the reason to buy it from OneTrust rather than a standalone tool.
Pricing reality
There is no published price. The pricing page lists packages — CMP Base and Suite, Privacy Automation Base and Suite, Third-Party Risk Base and Suite, AI Governance, Tech Risk & Compliance — each metered differently: admin users, daily website visitors, data profiles, or inventory size.
Vendr’s transaction data (about 309 deals) puts the median contract near $12,000 a year, with a range of roughly $1,600 to $48,000. That median is mostly single-module consent deals. A multi-module program at a 1,000–5,000-employee company runs approx. $40,000–$120,000 a year by third-party estimates, and enterprise programs go into six figures. Implementation adds 20–40% of first-year subscription. Competing vendors report that OneTrust set a $10,000 annual minimum from Q2 2026; OneTrust has not confirmed it, so treat it as the likely floor, not a quote. Vendr reports 20–30% below first quote on multi-year terms and 5–10% annual escalators as standard.
Best for
Privacy officers and Legal Ops leads at companies with 2,000+ employees operating under GDPR plus several US state privacy laws, who need consent, RoPA, DSAR and vendor assessments in one auditable system and now owe the board an AI-use inventory. Return on the platform improves with the number of modules you actually run — two or more is where the shared inventory pays for itself.
Do not buy it for a sub-500-person company whose need is a cookie banner and a few DSARs a month. That buyer pays the floor price for a fraction of the platform; a dedicated consent tool with a published per-domain monthly rate covers the same need.
Versus the alternatives
TrustArc is the oldest rival and the usual second quote. Pick it when the program is assessment- and certification-led and the team wants a smaller vendor that answers the phone; pick OneTrust when you need the broader module catalog and an AI governance layer on the same inventory.
Securiti is the challenger with the largest recent outcome: Veeam bought it for $1.725 billion in December 2025. Pick it when data discovery and DSPM across cloud data stores is the real job and security co-owns the budget; pick OneTrust when legal and privacy own the program.
Transcend fits engineering-led companies that want DSAR and consent enforced in code paths through APIs rather than handled as tickets.
Vanta wins when the driver is SOC 2 or ISO 27001 evidence, not privacy. For runtime control of which agents and MCP tools employees use, WitnessAI or Zenity enforce today what OneTrust’s control plane is just starting to do. For litigation-led buyers, Exterro shares the data map with legal hold.
If none fit, the gap is usually ownership: no one maintains the data map, and every platform here is only as current as that map.
Watch-outs
- Ownership is unresolved. The Information reported in November 2025 that OneTrust was discussing a private-equity sale reportedly valued above $10 billion; no deal had been announced as of early October 2026. A new owner can reprice renewals and retire slower modules. Guard: cap renewal increases in the contract (5% or less), add a change-of-control clause allowing termination without penalty, and avoid a term longer than 24 months until the sale resolves.
- Renewal uplifts are steep. Buyers report proposed uplifts of 20–40% at renewal, with outliers higher. Guard: start renewal talks 120 days out, bring a TrustArc or Securiti quote, and itemize every module so unused ones can be dropped.
- The agent-governance headline is mostly preview. MCP Gateway, AI-driven assessments and conversational consent are private preview, with no named production customers. Guard: buy the AI governance module for inventory and assessments that ship today, and make any agent-runtime claim a contract exhibit with acceptance criteria.
- Admin load is real. Each module has its own configuration depth; reviewers consistently rate capability above ease of use. Guard: name a dedicated platform owner before signing and budget implementation partner hours in year one.