OneTrust MCP. Manage all privacy compliance from a single chat window.

You're connecting your OneTrust account straight to your AI agent. This lets you manage all your data compliance headaches—from vendor risk checks to handling privacy requests—using plain language prompts. You don't gotta navigate a dozen dashboards; you just talk to the system.

Managing Data Subject Requests (DSARs)
You need to handle access or deletion requests? Just ask, and your agent will use onetrust_create_dsar to register that new privacy request right into the fulfillment workflow. Want to know what's going on with a specific person’s data? Run onetrust_get_dsar to pull up their full history, see which steps are done, and check the regulatory context for the request.

If you need a quick snapshot of everything waiting in line, onetrust_list_dsars gives you a list of all those data subject requests—you can spot who's open or overdue and who's assigned to handle it.

Mapping Personal Data Flows & Inventory
Figuring out where personal data lives is half the battle. You can run onetrust_list_assets to get a complete data map, listing every single system, database, or service that touches personal data. That gives you the purpose and legal basis for each one. For managing consent, your agent knows how to use onetrust_list_consent_purposes, letting you list all configured consent purposes and cookie categories used in your preference center.

Auditing Assessments & Risks
Compliance assessments aren't just paper shuffling; they show real risk. You can check the status of every Privacy Impact Assessment (PIA) or Data Protection Impact Assessment (DPIA) using onetrust_list_assessments. This list shows you their current risk score and whether they’ve been approved yet. To dig deep into one assessment, use onetrust_get_assessment to pull up the full details, any risk findings, and recommendations that came out of it.

When it comes to general risks across the company, onetrust_list_risks gives you a rundown of identified threats, showing the impact level, how likely they are, and what treatment plan is required.

Vendor and Incident Tracking
Third-party vendors? You gotta keep tabs on 'em. Running onetrust_list_vendors provides a list of your partners, letting you see their current risk score and if their assessment is finished. If there's an issue—a security scare or a privacy breach—you can use onetrust_list_incidents. This tool lists all the incidents, detailing the severity, what kind of event it was, which subjects were affected, and if regulatory notification was required.

Knowing Your Rules
You also gotta know what risks you're tracking generally. If you need a master list of potential threats, onetrust_list_risks gives you that overview, including the impact level, likelihood score, and treatment plan for each one. And if you want to see who your vendors are, onetrust_list_vendors pulls up all those accounts with their current risk status and assessment completion details.