Skip to main content
Audact
See the offer

Connector · OneTrust

Governance events where the DPO already looks.

Planned · no date set

OneTrust is where the privacy team already keeps the consent register and the audit trail. The planned connector reads jurisdiction and data-subject records from it, and pushes each governance event and its receipt back into the same audit trail. The disclosure on a voice call then shows up where a DPO is already looking, rather than in a second console nobody opens.

What the connector pushes

{
  "source": "audact",
  "subject_ref": "onetrust:ds:8h2k9d7",
  "event": "article_50_disclosure",
  "jurisdiction": "DE",
  "occurred_at": "2026-08-15T10:14:23Z",
  "receipt_id": "rcpt_01HX7K9M3P4Q5R6S7T8U9V",
  "chain": { "previous": "rcpt_01HX7J8L2N...", "merkle_root": "0x4a7d1ed414..." }
}

Worked example. Acme GmbH and Nova Industries are fictional; no customer data appears here.

One record per governance event, carrying the chain link. The audit trail keeps its own ordering; the chain keeps ours, and the two can be reconciled.

What the connector will carry

Data-subject and jurisdiction records read from OneTrust into the policy engine.
Planned
Governance events and receipts pushed into the OneTrust audit trail.
Planned
Article 50 attestation and cross-jurisdiction consent as native widgets.
Planned
The governance itself (disclosure, gate, eligibility) does not depend on the connector; it is In controlled testing (Germany: national policy layer active. Netherlands: in development. Belgium and Austria: planned.).
In controlled testing

Who it is for

The organisation that has already made its choice.

By the time a company runs OneTrust, the privacy operating model is settled and the appetite for a second system is zero. A voice deployment that produces its own console produces a gap: the events are real, and nobody in the governance function ever sees them.

Financial services, healthcare, public sector and regulated commerce are the four shapes this comes in. The details differ; the objection is always the same, and it is a reasonable one.

Setup

Five steps, once the connector ships.

  1. Install the Audact connector from the OneTrust catalogue.
  2. Map your OneTrust data-subject schema to the Audact consent vault.
  3. Configure the per-jurisdiction policy packs in the Audact policy engine.
  4. Enable evidence export so receipts land in the OneTrust audit trail.
  5. Switch to live. Governance events flow as they happen.

Questions

Is this an official OneTrust listing?
Not yet. A catalogue listing is planned and this page will say when it exists. OneTrust is a registered trademark of its owner and is named here for interoperability reference only.
What happens until it ships?
The governance does not depend on the connector: disclosure, gate and eligibility are In controlled testing. What the connector adds is where they appear.

The same primitives, without the connector

A connector is a shorter path into one platform. Underneath it are six endpoints that run inside the managed platform, and an evidence chain that is identical either way.

See the API

Related