Reviews

Permission management is both very complex and tedious to tailor and configure properly, and at the same time incapable of addressing certain basic privacy and security needs such as not giving a user full access to every record in a module where their role only requires read permissions for a few records, and write permission for a single one. There are many odd inconsistencies between seemingly very similar functionalities across different modules, often requiring back-end engineering to reconcile. Requests for such improvements may or may not get on the roadmap, causing certain irritating discrepancies to survive for years. Some fundamentally basic everyday use cases in the privacy and security professions (such as keeping separate and different inventories of internal and external IT assets) cannot be easily accommodated and require out-of-the-box thinking, creativity and engineering by the customer. The only solution is often to figure out a way to leverage an existing but unused functionality for a purpose it was never meant or designed to serve, and which it therefore suits very imperfectly. Too often, to the question of 'how does the tool address this utterly business-as-usual scenario, OneTrust's answer is It doesn't but let us try to figure out a workaround. In the compliance space, that's not a reassuring approach to put on record. Claims of being used successfully by many large organizations become less credible every time OneTrust is unable to demonstrate how certain very ordinary tasks -- which must have come up with every single customer from the outset -- still can't be solved on the platform. No amount of OneTrust green paint all over every privacy event in the world will make that go away. Some Marketing budget would be better spent on Engineering.

June 11, 2021