OneTrust Master Terms of Service

The OneTrust Master Terms of Service are the standard agreement for OneTrust’s cloud services. They apply together with any Order Forms and documents incorporated by reference, and the agreement is made between the customer named on the Order Form and OneTrust.^[1] The legal center lists them as a numbered series: Version 5.1 is current, effective March 23rd 2026, preceded by Version 5.0 (effective March 31st 2025 to March 23rd 2026), Version 4.0 (June 3rd 2024 to March 31st 2025), Version 3.0 (February 1st 2023 to June 3rd 2024) and Version 2.1 (September 29th 2021 to February 1st 2023), with others earlier.^[3] OneTrust describes the terms as reflecting a “one-to-many delivery model” under which services, operations and controls are the same across its customer base, and it says it cannot agree to modifications to its standard statement of work, Support Description or User Guide.^[3] The legal center overview states that it is informational and not part of any contract.^[3] The article below follows the section order of Version 5.1.

Definitions that carry licensing weight

All rows are drawn from ^[1]. The row for Authorized Users records the definition; it is also the metric for DataGuidance Research when that product is bought outside the Privacy Automation Suite.^[4]

Provision of Cloud Services and restrictions

Section 2.1 says OneTrust will make the Cloud Services available for the Subscription Term, and that unless an Order Form says otherwise the customer’s right to use them is limited to one production tenant.^[1] The Production tenant row records that limit. The legal center adds that customers receive a single production tenant in which all subscribed services are available, that some subscriptions also include a non-production environment, and that customers may buy additional production and non-production environments.^[3] Under the 2021 terms the equivalent unit was an “Environment”, defined as one software installation with a unique database in a logically separated tenant environment, and the right to use the Software was limited to one production Environment.^[2]

Section 2.2 lists what the customer shall not do:^[1]

• use the Cloud Services other than for its internal business or compliance purposes;
• permit any third party other than Authorized Users to access the services;
• copy, modify or reverse engineer them;
• use them in breach of law or the Documentation;
• access, store or transmit viruses, spam or unlawful, abusive or harmful material;
• input Protected Health Information, or similar information under health privacy laws;
• try to gain unauthorized access to any service, device, data, account or network;
• submit Customer Content that violates third-party intellectual property rights; and
• use the Cloud Services to build, train or configure any artificial intelligence model not provided by OneTrust.

Section 2.3 adds export control and sanctions restrictions, including a bar on use by organisations or individuals on a government denied-party list or owned 50% or more by one.^[1] The customer is responsible for Authorized Users’ compliance, for its use of Third-Party Services, for activity under its accounts and for Customer Content, and indemnifies OneTrust for third-party claims arising from Customer Content.^[1] Section 2.5 states that the purchase is “not contingent upon the delivery of any future functionality or features or services”.^[1] Two restrictions are new in Version 5.1 compared with the 2021 text: the AI-model restriction, and the extension of the Protected Health Information bar beyond U.S. data. The 2021 version barred inputting Protected Health Information only “for data in or from the United States”.^[2]

Fees and payment

Fees are payable within thirty days of the invoice date unless the Order Form says otherwise. All payment obligations are non-cancellable, and all amounts paid are non-refundable unless the agreement expressly says otherwise. Payment is in the currency on the Order Form without set-off, and fees exclude taxes, which the customer pays unless it provides a valid exemption certificate.^[1] The 2021 version also provided for a late fee of 1.5% of the invoice amount, charged after OneTrust contacted the customer about the delinquency.^[2] The text of Version 5.1 reviewed contains no late-fee clause.

Usage monitoring

Version 5.1 section 8.4 lets OneTrust “collect and use Usage Data to develop, improve, operate, support and monitor usage limits of its products and services”, and bars disclosure of Usage Data to third parties except in anonymised, aggregated form or under the confidentiality section.^[1] The 2021 version instead contained a section on surveys: OneTrust “may conduct periodic surveys on a remote basis for the sole purposes of verifying Customer’s use of the Software in compliance with the Agreement”.^[2] In both versions the only audit right OneTrust reserves concerns confirming that Components have been removed after the term. The metric definitions and the Overuse Policy that apply these limits are in the Product Usage Terms.^[4]

Warranty and liability

OneTrust warrants that the Cloud Services will substantially perform the functions set out in the Documentation, that Support will conform to the Support Description and not materially degrade during the term, that Professional Services will be performed in a workmanlike manner, and that it will use industry-standard measures against viruses. If the customer notifies a failure, OneTrust repairs, replaces or reperforms, or, if unable to, terminates the nonconforming Services and refunds prepaid fees for the remainder of the term; this is the sole and exclusive warranty remedy.^[1] OneTrust disclaims other warranties, including for AI output and content from third-party data sources.^[1]

Section 5.1 caps each Party’s aggregate liability, together with its Affiliates, at “the total of the fees paid and payable to OneTrust for Services provided to Customer under the Agreement in the twelve (12) months preceding the first event giving rise to a claim”. The cap does not apply to indemnification obligations, the customer’s payment obligations, violation of a Party’s intellectual property rights, or wilful misconduct.^[1] The 2021 version capped liability at the amounts paid and payable under the Agreement in the year preceding the first event, and excluded breaches of the licence restrictions, indemnities, payment obligations, confidentiality breaches and wilful misconduct from the cap.^[2] The legal center states that OneTrust does not agree to uncapped liability for unauthorized disclosure of customer data or for breaches of security, privacy or confidentiality obligations.^[3] OneTrust provides a defence and indemnity for third-party claims that the use of the Cloud Services infringes patent, copyright or trademark or misappropriates a trade secret, subject to listed exclusions, and that is the customer’s sole remedy for such claims.^[1]

Components

Where Cloud Services are provided with a component to implement on the customer’s systems or websites, section 11 grants “a limited, non-sublicensable, non-transferable, nonexclusive, revocable license” to use it for the Subscription Term. The customer is responsible for implementing updates where it opts out of automatic updates or they are unavailable, must remove all Components within thirty days after the term ends, and OneTrust “reserves the right to audit compliance with this obligation”.^[1] The legal center gives Cookie Consent and Data Discovery as examples of services delivered with such a component.^[3] See Component licence.

Additional Services

Section 10 covers Free Services and non-production tenant environments. They are not intended to hold production-level data, may contain forward-looking code, are for evaluation purposes only, and are provided as-is; if an exclusion of liability is prohibited by law, OneTrust’s total liability is capped at $1,000.00. Free Services run for the period on the Order Form or, if none is stated, OneTrust may end access at any time.^[1] See Additional Services.

Term, renewal, termination and suspension

The agreement takes effect on the earlier of the last signature on the first Order Form or the customer’s first access to the Cloud Services, and remains in force until all Subscription Terms have expired or ended. Each Service other than Professional Services renews automatically for twelve months on OneTrust’s then-current terms unless either Party gives notice of non-renewal at least thirty days before the end of the term.^[1] The 2021 version similarly renewed each Order Form for twelve months on OneTrust’s then-current pricing and terms and added that OneTrust “will provide Customer with sixty (60) days’ notice of an upcoming Renewal Term”; the Version 5.1 text reviewed contains no such sentence.^[2] The legal center states that OneTrust does not agree to termination for convenience, because its pricing “is conditional upon both parties being committed to the full subscription term”.^[3] See Subscription Term and automatic renewal.

Either Party may terminate on written notice if the other breaches a material obligation and does not cure within thirty business days, or becomes subject to insolvency proceedings. A customer terminating for uncured breach receives a refund of prepaid unused fees. After termination the customer ceases use, may export Customer Content in a structured, machine-readable format within sixty days, and OneTrust may then delete it.^[1] On fourteen days’ prior written notice, except in an emergency, OneTrust may suspend access if payment is past due, if the customer breaches section 2, or if suspension is necessary to preserve the integrity, security, availability or performance of the services, and ends the suspension when the cause is cured.^[1]

General terms

• Contracting entity and law (13.1 and Exhibit A). Governing law and exclusive jurisdiction follow the contracting entity: OT Technology, Inc. for North and South America (excluding Canada) and Asia Pacific, with Georgia law and Atlanta courts; OneTrust Canada Inc. with Alberta law; OneTrust Technology Ltd. for the UK, Guernsey and Jersey, and OT Technology Spain S.L.U. for the rest of Europe, the Middle East and Africa, both under the law of England and Wales; and OT (Australia) Pty Ltd for Australia and New Zealand, also under the law of England and Wales. An Order Form naming a different OneTrust entity displaces the domicile-based default. The parties waive jury trial where the law allows.^[1]
• Assignment (13.2). Neither Party may assign without the other’s prior written consent (not to be unreasonably withheld), except that OneTrust may assign to an Affiliate or to a successor in a merger, acquisition, change of control or asset sale.^[1]
• Order of precedence (13.5). The Order Form prevails over the Master Terms in a conflict, and additional or different customer terms are excluded.^[1]
• Claims period (13.9). No claim may be brought after two years from when the cause of action arose, with exceptions for OneTrust’s collection of fees and for intellectual property violations.^[1] The 2021 version set the period at one year.^[2]
• Reseller orders (14). For purchases through an Authorized Reseller, the reseller handles invoicing, taxes, payments and refunds, OneTrust may share usage information with the reseller, and the reseller cannot make warranties for OneTrust; renewals follow the Order Form between OneTrust and the reseller, and the customer may choose another reseller or renew directly.^[1] See Reseller order.
• U.S. government end users (13.8). The services consist of commercial items under FAR 2.101, and government rights are those in the Agreement.^[1]

Points for a licence manager

These points follow from the text and are commentary, not contractual advice.

1. Identify which Master Terms version governs each Order Form. The renewal clause moves a customer to “then current terms”, so the version in force at last renewal may be later than the one signed.
2. Read the Order Form for tenants, usage limits and any named contracting entity; it prevails over the Master Terms.
3. Treat the committed term as firm: payment obligations are non-cancellable, termination for convenience is not offered, and renewal notice is thirty days.
4. Track Components deployed on websites and systems; removal within thirty days after the term, with an audit right, is an obligation that outlasts the subscription.
5. Keep use inside Authorized Users: employees, contractors, vendors and consultants of the customer and its Affiliates.

Out of scope

This article does not cover the Data Processing Addendum, the Standard Contractual Clauses, the Business Associate Agreement, supplemental terms for specific products named in the legal center, the mutual non-disclosure agreement, or any negotiated order form.