Pricing · verified 16 Sept 2026
OneTrust pricing: what OneTrust costs a year, how much each module adds, and the six different ways OneTrust meters your bill
OneTrust publishes no price. It does publish something almost every pricing article misses: the unit each product bills on, and there are six of them across nine products. Recorded contracts sit at a median of $12,000 a year, ranging from $1,620 to $48,215, with buyers averaging 20.38 percent off the first quote. The number that will actually decide your three year cost is not the discount. It is which of those six units your quote is written in.
Price the obligations before you price the modules
Every OneTrust line is quoted against a unit you have to forecast, so the quote is only as good as your view of which obligations genuinely apply to you. Pick your industry and get the register first. No signup, nothing stored.
§ Live · Compliance scan
One free run. Nothing you pick is stored.
Fintech, US · what a scan returns
- § 01 Written AML program with a named officer
- § 02 KYC and customer due diligence
- § 03 Sanctions screening lists Changed
- § 04 PCI DSS v4.0 validation
The published metering basis
OneTrust meters six different ways across nine products, and no two modules share a unit
This is the part of OneTrust pricing that is genuinely public, and it is more useful than the dollar figure everyone hunts for. Read directly from onetrust.com/pricing on 16 September 2026, the page names nine products and states, for each, what the price is based on. Not one of them bills on the same thing as another.
| OneTrust product line | Price is based on | What makes the bill grow |
|---|---|---|
| Consent Management Platform, Base and Suite | Average daily visitors aggregated across all channels and properties | Marketing success. A good quarter for traffic is a bigger compliance bill. |
| Universal Consent and Preference Management | Total data subject profiles captured | Cumulative customer growth, and it rarely goes down. |
| Privacy Automation, Base and Suite | Users and privacy asset inventory | Finding more systems that hold personal data. |
| Tech Risk and Compliance | Admin users and asset inventory | Cataloguing more of your estate. |
| Third-Party Risk Management, Base and Suite | Admin users and third-party inventory | Onboarding more vendors, including the ones you offboard later. |
| AI Governance | Admin users and AI inventory | Discovering shadow AI, which is the entire point of buying it. |
Read the right-hand column again. Four of the six units are inventory counts, and an inventory count rewards you for doing the work badly. Run a thorough AI discovery and you surface the shadow tools your legal team has been worried about, which is exactly what you bought the module to do, and your renewal goes up. Catalogue every system holding personal data and Privacy Automation costs more next year than it did when your map was incomplete. The consent modules have the mirror problem: they bill on traffic and on cumulative profiles, so growth in the business raises the compliance bill on a curve nobody in procurement modelled.
None of that makes OneTrust a bad buy. It makes the order form the important document. Ask for banded tiers with headroom rather than a per-unit rate, and get the counting rule itself written down: whether a decommissioned vendor leaves the third-party inventory, whether a duplicate asset counts twice, whether visitor averages are taken monthly or annually. Those sentences are worth more over three years than another two points of discount.
What buyers actually sign
What OneTrust costs a year, from recorded contracts rather than estimates
Since OneTrust publishes no figure, the only real numbers are the ones buyers report after signing. Vendr's marketplace data, read 16 September 2026, is the largest such set for this vendor. Here it is against the privacy and GRC platforms it is most often shortlisted with.
| Platform | Median contract a year | Recorded range | Average off first quote |
|---|---|---|---|
| OneTrust | $12,000 | $1,620 to $48,215 | 20.38% |
| Osano | About $8,459 | Not reported | Not reported |
| TrustArc | About $15,120 | Not reported | Not reported |
| Vanta | $20,000 | $7,500 to $57,221 | 29.83% |
| Drata | $25,000 | $9,494 to $67,350 | 23.22% |
| Workiva | $49,420 | $12,736 to $153,365 | 11.44% |
The OneTrust range spans roughly thirty times from floor to ceiling, which is wider than anything else in that table. That is not a story about negotiation. A $1,620 contract is somebody buying a cookie banner, and a $48,215 contract is somebody running privacy automation, vendor risk and consent together. Quoting the floor as an entry price, which several published guides do, compares a single module to a program.
The 20.38 percent average discount is worth reading as a signal in itself. Across this market, discount tracks substitutability almost perfectly: Workiva gives up 11.44 percent because nothing drops in to assemble a 10-K, while Vanta gives up 29.83 percent because four platforms do broadly the same SOC 2 job. OneTrust sitting near 20 percent says several credible products can cover the core privacy work, and that you should have one of them on the table when you renew.
One caveat on all of it. These counts move between visits. The same source showed 309 purchases in one place on the page and 273 in another on the day we read it, and other vendors in this dataset have drifted by fifty or more recorded deals inside a month. The median, the range and the discount are stable enough to plan against. The sample size is not, so nobody should build an argument on it.
Why there is no rate card
OneTrust is absent from AWS Marketplace, which is why its competitors' prices are public and its own are not
There is a reliable back door to SaaS pricing that works on a surprising number of vendors. Anyone selling through AWS Marketplace has to publish contract dimensions with prices attached, because the buyer transacts against an AWS bill instead of a sales order. That requirement is how the rate cards for several of OneTrust's competitors became readable in public: Vanta lists ten priced lines, Drata lists sixteen, Secureframe and Sprinto each list a platform fee plus a first framework, and Workiva lists a single twelve month dimension at $1,000,000.00 that functions as a do-not-click placeholder.
OneTrust is not there. A domain-restricted search of aws.amazon.com on 16 September 2026 returned no OneTrust seller profile and no OneTrust product listing. That absence is a real finding rather than a gap in the research, and it has a practical consequence: there is no published list price anywhere for a salesperson to justify deviating from. When no anchor exists, the first number spoken becomes the anchor, and in a demo-first sales process that number is theirs unless you bring your own.
So bring your own. Walk in with the median for your scope, the counting rule you want, and a named alternative you have actually demoed. That combination is what the 20.38 percent average is made of.
Beyond the subscription
What the OneTrust quote leaves out, and what year two looks like
Implementation is the line that surprises people. Across this tier of the market it commonly adds 20 to 40 percent of first-year license, and privacy tooling sits in the middle of that band because the configuration work is real: data maps, assessment templates, workflow routing and integrations into the systems that hold the data. Budget it as a separate number from day one rather than discovering it after the platform is chosen.
Then there is uplift. Multi-year agreements in this market carry annual escalators, and OneTrust has stated a 20 to 30 percent band, rising toward 30 to 40 percent where a renewal is not competitively tested. Stack that on top of a unit that grows on its own, an inventory count or a visitor average, and year three can arrive at close to double year one without anybody having made a decision. Model both curves before signing a three year term, and put a cap on the escalator in writing if you take one.
The last one is quiet and permanent. A module switched on cheaply in year one stays in the renewal baseline forever. If a seller offers a heavily discounted third-party risk line to close the deal this quarter, price it at full rate in your own model, because that is what you will be renewing against.
Questions buyers ask
How much does OneTrust cost per year?
$12,000 a year at the median across 273 recorded deals, read 16 September 2026, with the range running $1,620 to $48,215 and an average 20.38 percent off the first quote. The low end is a single consent module and the high end a multi-module program, so the median describes scope more than it describes bargaining.
Does OneTrust publish its pricing?
No dollar figure appears anywhere on onetrust.com. What the pricing page does publish, and almost nobody quotes, is the metering basis for each of nine products. That is the more useful disclosure, because the unit sets your three year cost.
How is OneTrust pricing calculated?
Six different ways. Consent bills on average daily visitors across all properties, Universal Consent on total data subject profiles captured, Privacy Automation on users plus privacy asset inventory, Tech Risk on admin users plus asset inventory, Third-Party Risk on admin users plus third-party inventory, AI Governance on admin users plus AI inventory.
Is OneTrust expensive compared to alternatives?
Mid-market at the median rather than premium: $12,000 against Osano near $8,459, TrustArc near $15,120, Vanta at $20,000 and Workiva at $49,420. The wide 20.38 percent discount says several products can do the core job, which is leverage you should use.
What is not included in the OneTrust price?
Implementation, commonly 20 to 40 percent of first-year license in this tier, and any module you did not explicitly license. Annual uplift on multi-year terms is separate again, and OneTrust has stated a 20 to 30 percent band for it.
How much can you negotiate off OneTrust?
An average 20.38 percent across 273 recorded purchases. The better lever is the counting rule, not the rate: a banded tier with headroom on visitors or inventory protects you from growth you cannot forecast, and that is worth more over three years than another two points.
Does OneTrust sell through AWS Marketplace?
No. A domain-restricted search of aws.amazon.com on 16 September 2026 found no seller profile and no product listing. Vendors who do list there must publish priced contract dimensions, which is why several competitors' rate cards are public and OneTrust's is not.
Why does OneTrust quote each module separately?
Because no two modules share a billing unit, so they cannot be collapsed into one rate. Insist on each module on its own line with its counting rule in the order form, then model each unit forward separately. A blended total hides which line grows on its own.
Know which obligations apply before anyone quotes you a unit
Every number on this page is downstream of one question: which rules actually bind your business. Scan your obligations, get the register, and walk into the demo knowing what you need rather than being told. Then keep reading on OneTrust competitors and how the alternatives compare, or work through what compliance software costs across the whole market. If privacy is only part of the problem, the GDPR compliance software and vendor risk management pages cover the two modules buyers most often add. For the priced-by-solution end of the market, compare Workiva pricing and Drata's published rate card.
§ Live · Compliance scan
One free run. Nothing you pick is stored.
Fintech, US · what a scan returns
- § 01 Written AML program with a named officer
- § 02 KYC and customer due diligence
- § 03 Sanctions screening lists Changed
- § 04 PCI DSS v4.0 validation