OneTrust raises $210M to expand its enterprise compliance solutions

OneTrust, a privacy and marketing, security, and data governance firm based in Atlanta, Georgia, today announced it raised $210 million in a series C extension led by SoftBank’s Vision Fund 2, with participation from Franklin Templeton. The company says the round adds a strategic geographical position in Japan — SoftBank is Tokyo-based — as market demands accelerate in Asia Pacific and across the globe.

About 64% of respondents around the world feel that adhering to compliance requirements is a “very” or “extremely”effective way to keep data secure, according to a Thales report. But compliance is expensive. In a 2017 PricewaterhouseCoopers survey of execs at U.S., U.K., and Japanese tech companies, 88% said their company planned to spend over $1 million preparing for the EU’s General Data Protection Regulation (GDPR) in the run-up to its full May 2018 implementation. A smaller percentage of respondents — 40% — said they expected to spend $10 million or more.

Kabir Barday, a former developer at BlackRock and previously director of product management at Dell-owned VMWare, anticipated the nearly $51.5 billion compliance management market’s growth in 2016 when he founded OneTrust with cochair Alan Dabbiere, a cofounder of Manhattan Associates and AirWatch. Barday was an early employee at AirWatch, which raised $200 million in 2013 before VMware acquired it for $1.5 billion. OneTrust went on to raise $210 million in a series B round last February at a whopping $2.7 billion valuation — a valuation the firm more than doubled to $5.1 billion in December 2020.

This latest cash infusion comes after roughly a year during which OneTrust grew its customer base to more than 8,000 organizations across 100 countries. According to Barday, nearly half the Fortune 500 companies now use the company’s product suite, including brands like Aetna, Oracle,  21st Century Fox, and Salesforce.

Above: Cross-border data-mapping with OneTrust

OneTrust offers a privacy management program that helps companies comply with the GDPR, the California Consumer Privacy Act (CCPA), and hundreds of other global privacy laws by using research portals and automation tools. The company streamlines the intake and fulfillment of consumer and subject rights requests and allows customers to benchmark against peers, map and inventory records of processing, and generate custom reports as data flows through their organization.

OneTrust’s tools enable companies to drive opt-in demand while demonstrating full compliance. Businesses can deploy interfaces and experiences across marketing and sales activities that collect consent and preferences and sync them across channels, while at the same time automating the fulfillment of consumer rights requests and the maintenance of historical consent records from a single portal. On the third-party risk side of the equation, OneTrust assesses IT and non-IT vendors, direct suppliers, services, legal organizations, franchisees and retailers, agents, and contractors with risk mitigation workflows and ongoing monitoring. It prepopulates security and privacy data on thousands of global vendors in total, each with information at the service and product level, and it lets managers create automated rules to trigger reassessment or receive alerts when enforcement actions occur.

Above: OneTrust “readiness” dashboard

It’s safe to say that compliance management is a red-hot sector, as alluded to earlier. In 2019, San Francisco-based TrustArc raised a $70 million round of funding to help companies implement privacy and compliance programs; Privitar nabbed $40 million to better enable businesses to engineer privacy protection into their data projects; and InCountry exited stealth with $7 million in seed funding to help multinationals comply with local data residency regulations. Back in 2018, BigID nabbed $30 million to expand its data privacy management platform for enterprises. And at the end of 2019, LogicGate, which provides a platform that automates processes and compliance tracking, raised $24.75 million to invest in content, frameworks, data partnerships, and integration.

To stay ahead of the competition, in 2020 OneTrust launched Athena, an AI and robotic automation engine built into the OneTrust platform. After acquiring Seattle-based Integris, OneTrust also rolled out new data governance and guidance, ethics, and privacy products; DataDiscovery, a data discovery and classification solution; and free tools to automate GDPR and CCPA compliance programs. OneTrust Environmental, Social & Governance is OneTrust’s newest software, which allows clients to manage initiatives in those areas, like carbon output or diversity, equity, and inclusion programs.

More recently, OneTrust acquired Convercent, a Denver, Colorado-based firm developing “whistleblowing” software that lets employees report problems they see with their company — anonymously or otherwise. The purchase came weeks after OneTrust bought Docuvision for its ability to use AI to redact specific information, and it marks the company’s sixth acquisition overall.

OneTrust, which is co-headquartered in London, with additional offices in Bangalore, Melbourne, Seattle, San Francisco, New York, São Paulo, Munich, Paris, Hong Kong, and Bangkok, has over 1,500 employees globally. It recently expanded to France with a dedicated team of local privacy and marketing experts and a datacenter, shortly after announcing new operations in Brazil with hosting options and support for Brazilian Portuguese and “dozens” of other languages.

OneTrust has raised $920 million in funding to date from investors Insight Partners, Coatue, and TCV in addition to Softbank and Templeton. The extension brings thee series C round to $510 million.