OneTrust Privacy Management Software Pricing and the Package You Need for Data Subject Requests

Short answer: OneTrust privacy management software is sold as two packages, Privacy Automation Base and Privacy Automation Suite, priced on users and the size of your privacy asset inventory. OneTrust publishes no prices. Reported buyer data puts the median OneTrust contract near $11,970 a year across 153 unique buyers, with a platform minimum reported around $10,000. The detail most buyers miss: data subject request automation is only in Suite, not Base.

That last point decides a lot of OneTrust evaluations. If the reason you are looking at OneTrust is that access and deletion requests have started arriving, the package that answers them is the bigger one, and the smaller one will not help with that job at all. This guide lays out what each package includes, what it reportedly costs, and when a request-only tool is the more proportionate buy.

OneTrust privacy management software packages compared

OneTrust's pricing page groups its privacy products into a handful of packages, each with its own meter. None shows a price; every one routes to a quote.

So the shortest path to a OneTrust tool that handles a DSAR runs through Privacy Automation Suite, which also brings data mapping, assessments, vendor risk and incident management whether you need them this year or not.

How much does OneTrust privacy management software cost?

OneTrust does not publish prices. Aggregated procurement data puts the median OneTrust contract at about $11,970 a year across 307 tracked purchases from 153 unique buyers, with a tenth to ninetieth percentile band of $1,620 to $48,230. Third-party reviews report a platform minimum of roughly $10,000 a year since early 2026, and typical annual spend from about $10,000 to over $200,000.

Two things push a real quote above the median. First, the median is pulled down by hundreds of cheap single-module consent purchases, so a privacy automation package with DSR fulfillment usually lands higher. Second, implementation is reported at 20 to 40 percent of the annual subscription in year one, on top of the license. Buyers report negotiating an average of about 20 percent off the first quote. Our full breakdown, including what drives each line, is in OneTrust pricing.

Does OneTrust Privacy Automation Base include DSAR?

No. OneTrust's own package description lists data mapping, assessments, vendor privacy risk and DataGuidance in Base, and puts "data subject request (DSR) fulfillment including intake, ID verification, data retrieval and deletion, and secure communication" in Suite only. A team that buys Base to start small still answers every access and deletion request by hand. We cover the request module on its own in OneTrust DSAR.

This is the same pattern we keep finding across the category. Ketch puts rights workflows on a paid add-on at Plus and bundles them only on its custom-quoted Pro tier. iubenda ships its subject rights tool on Ultimate only. Osano gates them to higher tiers. The published or entry price in privacy software is almost never the price of answering a request.

What does OneTrust privacy management software include?

Across both packages, OneTrust covers six jobs: a data map of where personal data lives and why, privacy impact and risk assessments, vendor privacy reviews with DPAs and transfer records, regulatory research through DataGuidance, subject request fulfillment, and incident and breach notification. Consent and cookie banners are sold separately under the consent packages.

Most US companies under a few hundred people carry two of those obligations day to day: consent on the website and requests from customers. Assessments and data mapping matter more as you grow, process sensitive data, or face a regulator asking to see them. If you are unsure which of the six you need, our guide to privacy management software maps each module to the obligation that triggers it.

Is OneTrust worth it for a small or mid-size company?

It is worth it when you will use most of the platform. A company with a privacy team, a long vendor list, regular assessments and requests across many systems gets real value from having all of it in one place, and OneTrust was named a Leader in the Forrester Wave for privacy management software in Q4 2025. A company whose actual workload is ten customer requests a month is paying a platform price for one job.

The modules you would skip are not always ones you can ignore, but they rarely need a platform either. Your vendor DPAs still need somewhere to live. Plenty of smaller teams already keep them in a contract management system next to the rest of their supplier paperwork rather than in a privacy suite. What they lack is a fast way to answer requests.

What a year of each option costs for ten requests a month

Here is the comparison for a US company with about 150 staff that receives roughly ten access or deletion requests a month, mostly from customers whose data sits in a CRM, a help desk and a billing system.

The gap is not close. At ten requests a month, a request-only tool costs less than the implementation fee alone on a platform contract.

When OneTrust is the right buy

Choose OneTrust when several of these are true: you run a formal privacy program with assessments that auditors or regulators will read, you manage hundreds of vendors and transfers, you operate in many jurisdictions and want DataGuidance research in the same tool, you need consent across many brands and apps, and you have someone whose job is to administer the platform. In that situation the per-module economics work, and consolidating on one vendor has real value. Use the median and the 20 percent negotiation figure when the quote arrives.

When a focused DSAR tool is the better buy

Choose a request tool when the obligation actually costing you time is answering people. The work in a request is finding the person in every system, compiling what you hold, redacting other people's details, drafting the reply and hitting the deadline: one month under the GDPR and 45 days under the CCPA and most US state laws.

That is all Obtainer does. It finds where a person's data lives across your CRM, help desk, billing and product database, compiles one reviewable manifest with the source of every item, drafts a deadline-safe response and tracks the clock. Nothing is disclosed until a human approves the redactions. It runs alongside whatever banner you already use, and plans are published from $34 a month billed yearly. If your CRM is Salesforce, the same trade-off applies to its add-on; see Salesforce Privacy Center pricing and the alternative.

Who are OneTrust's main competitors for privacy management?

TrustArc, Osano, BigID, Securiti, Transcend, DataGrail and Ketch compete with OneTrust on privacy management, and each prices the request module differently. TrustArc lists privacy rights automation from $25,000 a year; Osano's reported median is about $8,459. Our side-by-side of all of them, with buyer counts next to every median, is on OneTrust competitors, and the shortlist for request handling alone is on OneTrust alternative.

Pricing notes: OneTrust package contents are from OneTrust's pricing page. Contract figures are aggregated buyer-reported procurement data and third-party reviews, not OneTrust quotes. Obtainer prices are on our pricing page. Obtainer helps you comply; it is not legal advice.