No public evidenceOneTrust and GDPR
CertReports found no public GDPR evidence for OneTrust as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
- Kind
- listing
- Issued or listed
- 14 Sep 2016
- Expires or valid through
- 13 Jul 2027
- Scope
- OneTrust collects visitor and customer data that individuals provide to us, such as names, email addresses, and phone numbers that are input into the system. OneTrust also processes any other data that individuals voluntarily enter into the system while using our Services, such as information they choose to enter and store on our system when using tools such as data mapping, privacy impact assessments, or data incident services. OneTrust employs other companies and people to perform tasks on its behalf, including a payment processing company, a website analytics company, a product feedback or help desk software provider, a CRM service provider, and an email service provider. OneTrust may process employee data of European residents for the purpose of administering and carrying out employment or personnel relationships.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | OneTrust, LLC: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 aec5ffe251 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is OneTrust GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Compliance and GRC category) whose GDPR row is verified or vendor-stated, ranked by similarity.
