OneTrust experienced a major incident on October 6, 2026, lasting 2h 16m. The incident has been resolved; the full update timeline is below.
Update timeline
- investigating Oct 06, 2026, 12:51 PM UTC
We are investigating an issue affecting multiple services within the APP-AE environment. Customers may experience service unavailability or failures when accessing affected modules and associated functionality. Our Engineering teams are actively investigating to determine the cause and restore normal service. We will provide a further update as more information becomes available.
- investigating Oct 06, 2026, 01:23 PM UTC
We have identified that the current disruption is associated with connectivity to a third-party service used by the APP-AE environment. The connectivity issue is affecting multiple OneTrust services and resulting in service unavailability. We have escalated the issue directly with the provider, and our Cloud Operations and Engineering teams are working alongside them to restore normal service. Customers may observe the following behaviours: Login Login failures, API call failing to validate credentials Core Gateway failures, Notifications (emails) delivery delays/failures, Missing Translations, scheduled events not triggered, exports/uploads/download of documents failing Unable to access environment Cookies Unable to add new sites for scanning. Unable to view the progress of existing scans. Unable to add manual cookies. Unable to add or modify services. Unable to publish domains. Unable to perform any actions on the template or framework. DSAR Failures of request submission or delays in creating the submitted request Failures in accessing the data subject portal and webform GRC Risk Register won’t load as it depends on User/Org services for enriching user/org data. Create/Update risk will fail as we are validating/creating users set as risk approvers/owners. Controls could not be accessed as they depend on User/Org services for enriching user/org data. Data Mapping Customers may be unable to access or update inventory items, including assets, processing activities, vendors, and legal entities. Submission of assessments related to inventory may be affected. Ongoing bulk import jobs for inventory data might experience disruptions. VRM Vendor, Engagement and Contract Screens cannot be accessed. Automation rules/Workflow rules related to Vendor, Engagement and Contract objects will not be working. Assessments involving Vendor, Engagement, and Contract objects cannot be responded/ approved. Public API involving Vendor, Engagement, and Contract objects will fail Privacy Portal The following Consent APIs will not function: /api/consent/V2/reciepts /api/consentmanager/V1/datasubjects/profiles/ /api/consentmanager/V2/linkedidentitygroups/ /api/consentmanager/V2/datasubjects /api/consentmanager/V1/linktokens /api/consentmanager/V1/preferencecenters/{preferenceCenterUUID}/datasubjects/preferences Data Discovery Customers won't be able to initiate new scans Existing scan ingestion will be impacted Term/Tag assignments will be impacted Disabled feature for Policy & Automation Rules
- identified Oct 06, 2026, 02:46 PM UTC
We are seeing recovery across the APP-AE environment, with the majority of affected services successfully reconnecting and returning to normal operation. Consent, DSAR and DSAR Webform services remain affected at this time. Our third-party service provider, Confluent, has confirmed that the disruption was caused by a server-side issue within their service. Our Engineering and Cloud Operations teams remain engaged with Confluent while we work to restore connectivity for the remaining affected services. We continue to closely monitor recovery and will provide a further update once all services have been restored.
- resolved Oct 06, 2026, 03:07 PM UTC
The service disruption affecting multiple modules within the APP-AE environment has been resolved, and all affected services have returned to normal operation. Our investigation confirmed that the disruption resulted from a server-side issue affecting a third-party service provider used by the APP-AE environment. We worked directly with the provider to restore connectivity and have confirmed recovery across all affected services. We apologise for the disruption and appreciate your patience while we worked to restore service. A Root Cause Analysis (RCA) providing further details of the incident will be made available within 10 days.