Define the reason for replacing OneTrust
Start with the work that is not going well: an unused module, difficult ownership handover, an integration that needs manual reconciliation or a renewal proposal that no longer matches the scope. Do not assume every organisation has the same problem or that a smaller product will automatically cost less to operate.
OneTrust’s pricing page describes packages with pricing drivers that vary by solution. Capture your actual package, usage and contractual conditions before comparing alternatives. Ask the incumbent whether a configuration or scope change would solve the issue, then compare that option with migration on the same basis.
Hosting is a separate due-diligence question. An EU data centre does not eliminate the need to examine support access, subprocessors and onward transfers. The relevant GDPR transfer rules concern the actual processing arrangement. Record the legal entity receiving the data and the safeguards rather than scoring nationality as a complete answer.
Build a shortlist from the workflow you need
The following providers are candidates for investigation, not an independently tested ranking. Their own sites describe the current offers; confirm the proposed plan, processing terms and functions in your trial. Public pages were checked on September 8, 2026.
| Candidate or approach | Starting source | Question for your evaluation |
|---|---|---|
| Dastra | Published plan comparison | Which register, assessment and rights workflows are included in the quoted plan? |
| Didomi | Consent and preference platform | Does the consent scope match the channels and preferences you need to replace? |
| TrustArc | Privacy management offering | Which existing assessment and management workflows can be reproduced and exported? |
| DataGrail | Privacy platform | Which of your actual systems and rights-request steps are supported in the offered configuration? |
| Osano | Privacy management offering | Which required modules, usage limits and review steps are included? |
| Ethyca | Privacy technology offering | What engineering work is needed to operate the proposed controls in your environment? |
| Managed service with structured records | Your scoped adviser proposal | Who maintains the records, handles absences and returns the complete evidence at exit? |
A provider may cover several needs, but the advertised category is not proof of a specific integration or export. If you are replacing only a consent module, use the CMP comparison. If you need broader privacy operations, start from the GDPR software guide and retain the requirements relevant to your team.
Before requesting demonstrations, write down which incumbent functions will be retired, retained or replaced elsewhere. Keeping a specialist consent tool while migrating the processing register can be reasonable, provided responsibilities and data flows remain clear. Avoid comparing a partial replacement price with the cost of a broader incumbent contract.
Choose with a common evidence worksheet
Select three representative tasks, such as updating a processing activity, responding to an access request and recording an incident decision. Give every candidate the same invented data and expected outcome. Record the observed result, limitations, manual work and the evidence file. A promised roadmap feature should remain distinct from a function demonstrated in the proposed plan.
Add requirements for access segregation, languages, export and administration by your actual team. Weight the tasks according to current workload and risk. If your largest problem is maintaining processor relationships, do not let a polished dashboard for an unrelated module dominate the decision.
The purchase record should explain why the chosen option fits your needs and which compromises were accepted. It should not claim that the software makes the organisation compliant or that a competitor cannot perform a task that was never tested.
Migration Effort and Lock-In
Inventory the records, attachments, custom fields and integrations you would need to move. Request a sample export and check whether the replacement preserves the references your team relies on. Identify any manual reconstruction before agreeing a schedule. Assign an owner to validate imported records and document the acceptance criteria before switching the team to the new system.
A practical shortlist review
Ask each shortlisted vendor to work through the same anonymised example: one processing-register entry, its supporting files and a change awaiting approval. Record the manual steps, reviewer permissions and exported result. Then agree who maps existing fields, checks imported records and signs off the migration. Keep subscription, setup, integrations and support as separate proposal lines. This gives your team a concrete comparison to revisit before committing to a replacement.
Validate migration before agreeing a cutover date
A migration rehearsal should use a representative export containing records, attachments, relationships and history. Count the source objects by type and identify fields that cannot be mapped directly. Preserve stable references where they are used in contracts, advice or audit reports. A total record count can match even when the relationships have been lost.
Use a hypothetical processing activity linked to two providers, an assessment and an open action. Import it into the candidate system, then have a reviewer follow every relationship. Check whether the original dates, ownership and approval state remain intelligible. An imported note saying “approved” is different from preserving who approved which version and on what basis.
Next, rehearse an update during migration. Decide where the authoritative record lives, how changes are captured and how they are reconciled before cutover. Without that decision, staff may amend both systems and create conflicting versions. Keep a specific list of open requests and incident tasks; none should lose its owner or timing merely because the platform changes.
For attachments, verify filenames, access restrictions, retrieval and relevance. Do not migrate unnecessary personal data just because it is present in the archive. Retain or delete according to the applicable purpose and rule, with legal holds considered separately.
Agree a rollback condition before the move: for example, unresolved mapping of critical records or inability to retrieve required evidence. The condition should be observable. Keep the old environment available for the agreed transition period and confirm which contract terms govern export assistance and eventual deletion.
FAQ
Is replacing OneTrust always cheaper?
No. Compare the actual renewal or reconfiguration proposal with subscription, migration, integrations, training and continuing manual work at the alternative. The cost and pricing worksheet helps keep those lines separate. Headcount alone does not establish whether a proposal offers value.
How long should a migration take?
Determine the schedule from the rehearsal, data quality, integrations and acceptance reviews. There is no reliable universal promise of days or weeks. Make the cutover dependent on reconciled records, working access controls and a complete handover of open work.
Can a vendor’s security certificate settle the privacy assessment?
No. Check the certificate’s scope and relevance, then assess the processing contract, support access, subprocessors, transfer arrangement and your own configuration. A security document is one input into the decision; it does not answer every GDPR question.
What should remain available after exit?
The organisation should retain the records and evidence it needs under its applicable retention rules, in an agreed usable format. Confirm how history, attachments and relationship references are returned, who verifies completeness and when the vendor deletes remaining copies. Keep a record of the handover and any unresolved limitations.
Compare the shortlisted offers
Use the documented vendor comparison to turn your shortlist into a shared demonstration scenario, a first-year cost worksheet and explicit acceptance criteria.
Confirm the operational owner can run the replacement
Ask the person who will administer the system to repeat a key task without the implementation consultant. They should change an owner, adjust a permission, find an overdue action and export its evidence. Record where specialist assistance is still necessary and how that support is obtained.
For an access-control check, use two invented entities or clients. Confirm that a user scoped to one cannot retrieve the other’s records through search, exports, notifications or shared links. A correctly filtered dashboard is only part of that check. Agree who maintains permissions after a staff change and how the configuration is periodically reviewed.
Finally, compare the chosen offer with the option of keeping and improving the current system. The decision is strongest when it explains the concrete problem solved, the migration risk accepted and the evidence supporting the choice. Preserve the common trial pack so later reviewers can understand the basis without reconstructing the sales conversations.
Make the commercial comparison auditable
Keep the proposed configuration beside the price, including the version of the quote and its validity period. List the assumptions that could change the total: active users, visitors, stored records, connected systems, entities and assistance days. Ask the supplier how a limit is measured and what happens when it is exceeded. A price that looks lower can cover a different measurement unit.
Treat migration and exit assistance as defined deliverables. Specify the input format, responsibility for mapping errors, number of rehearsal imports and acceptance evidence. If the supplier will perform manual reconstruction, identify the records concerned and the review required from your team. This makes the service comparable without pretending that all platforms handle historical data identically.
Retain the rejected alternatives and the reason each was excluded, such as an unresolved export gap or a required integration outside the offer. That short record helps a future owner distinguish a deliberate compromise from a function that was simply never investigated.