Build and mature your privacy program faster and with more confidence with Program Builder:
-
- Get started faster by beginning with a prioritized, expert-built plan instead of creating one from scratch.
- Know you’re focused on the right work by using a plan mapped to the Nymity framework at every maturity level.
- Keep work on track by managing owners, due dates, and revalidation reminders in one place.
- Show measurable progress by giving leadership a clear view of completed, in-progress, and upcoming work.
When work is due for revalidation, you’ll know before it slips. No reverse-engineering the framework. No scattered spreadsheets. Just a clear path forward.
Find out how to build your privacy program here.
Complete privacy work even faster with Arc Intelligence.
Your privacy program already has all the evidence. Now Arc Intelligence can map them to the right questions, records, and assessments, speeding up your compliance journey.
PrivacyCentral: Cut time spent attaching evidence by up to 75%. Pair evidence in your evidence library, external documents, and URLs, with compliance questions in All Questions View with a new “Respond with Arc Intelligence” button.
Select evidence, review AI-recommended answers with confidence level, cited sources, and reasoning. Apply only what you approve. Never miss a piece of evidence again.
Data Mapping & Risk Manager: Draft Business Process Records with greater accuracy and completeness with Arc Intelligence, starting with a plain language description. Arc Intelligence can improve your description and recommend evidence from your Evidence Library, existing TrustArc documents, and external URLs before drafting a pre-populated Business Process Record for review. Accept, edit, or deselect any field before saving. Every suggestion traces back to its source.
Assessment Manager: Get completed, evidence-grounded assessments quickly and accurately without chasing manual replies. Your internal privacy team can generate answers using the Evidence Library to draft assessment responses. Third-party vendors can draft answers from their own uploaded documentation during assessments. Your team receives completed, evidence-grounded surveys instead of chasing manual replies.
More control over your consent infrastructure.
Better Unified Consent management and monitoring gives you greater control and confidence over consent preferences syncing across your web and mobile properties:
- Configure synchronization Keys and Groups from a new dedicated page under Cookie Consent Manager > Setup
- Four new lifecycle events surface across web integrations and the MAC SDK
- iOS App Tracking Transparency opt-out choices now correctly encode into the IAB TCF consent string and apply to downstream web tags
- Consent records are captured reliably on sites that reload immediately after a user submits preferences
New Quick action: Scan Websites ability to start a cookie & Tracker scan from the home page
Ship banners that meet accessibility standards and stay on-brand:
- Keyboard focus indicators are now visible on banner buttons across CCPA, GDPR, Google, and PIPEDA templates
- On-load scripts for IAB and IAB Accessible banner designs now execute correctly at banner load time
- The cookie consent link on your site now inherits your own font, color, and link styles.
More connected. More automated. Simpler workflows.
Avoid manual handoffs and duplicate entry with assessment workflows that connect directly to the tools your team already uses.
When a task, risk, or issue is created in an active assessment, AM automatically creates the corresponding ticket in your connected system:
- ServiceNow, Monday.com, Jira, and Coupa all supported
- Tickets stay in sync with assessment activity with no duplicate entry
When a vendor profile is created in Zip, Salesforce, or an intake form, Assessment Manager automatically generates a pre-mapped assessment and returns the live assessment link to the originating ticket. No manual step required.
Your assessment surveys get easier to complete:
- CSV exports now include a UTF-8 byte order mark so non-ASCII characters display correctly in Excel
- A new API toggle lets integration teams control survey response acceptance programmatically
- Redesigned to match the Arc look and feel
PrivacyCentral: New standards and an improved user experience.
Work faster with easier navigation across PrivacyCentral with breadcrumbs now extending to deeper pages. The Policy and Standards Library and Update Review Responses modals have all been refreshed with Arc components for a consistent look and feel.
Finally, the “Generated by Arc” filter lets users filter the All Questions View to AI-answered questions.
Also, you can leverage the new and updated standards available in PrivacyCentral:
New Standards
- Alabama – Personal Data Protection Act
- South Korea – Personal Information Protection Act 2026
- South Korea – Enforcement Decree of the Personal Information Protection Act
- Brazil – Resolution CD/ANPD No. 19/2024
- Brazil – Regulation for the Application of Law No. 13.709
- Brazil – Security Incident Regulation
- EU – Cyber Resilience Act (CRA)
- UK Online Safety Act
- US Colorado Automated Decision-Making Technology in Consequential Decisions
- US – Oklahoma CDPA
- US – Federal SEC Reg S-P 2024 amendments
Updated Standards
- US Connecticut – CTDPA
- US Maryland – ODPA
- US COPPA Rule
Nymity Research: More content. More regions. Easier navigation.
Managing your URL library is simpler this quarter. Archive, deactivate, or reactivate configured URLs individually or in bulk, and filter by active URLs for a cleaner view of what’s running.
Navigation improvements extend across Nymity, including breadcrumbs showing deeper on Nymity Research pages and improved law summary search in topic pages.
Privacy Knowledge additions this quarter
New jurisdiction
New legislation
- Australia — Cyber Security Act
- Australia — Smart Devices Rules
- Australia (NSW) — Health Records and Information Privacy Act 2002
- Australia (NSW) — Health Records and Information Privacy Act 2002 (Regulations)
- Bangladesh — Personal Data Protection Act, Act No. 63 of 2026
- China — Network Data Security Risk Assessment Methods
- EU — Cyber Solidarity Act
- EU — Regulation 2025/327, European Health Data Space
- Gambia — Data Protection Act
- Germany — Civil Code (BGB), § 630g: Access to the Treatment File
- Kazakhstan — Digital Code of the Republic
- Turkey — Ministry of Health: Promotion and Information in Health Services Regulations on Activities
- US: Colorado — An Act Concerning the Use of Artificial Intelligence in Health Care
- US: Colorado — Psychotherapy AI Restrictions Act
- US: Connecticut — Algorithmic Pricing Act
- US: Connecticut — An Act Concerning the Electronic Surveillance of Employees, Public Act No. 26-73
- US: Connecticut — Data Broker Law
- US: Connecticut — Genetic Information Privacy Act
- US: Florida — Electronic Health Records Exchange Act
- US: Georgia — AI Chatbot Act
- US: Hawaii — An Act Relating to AI
- US: Hawaii — Artificial Intelligence Disclosure and Safety Act
- US: Illinois — Artificial Intelligence Safety Measures Act
- US: Illinois — Public Act 104-0471, Reproductive Health Records Privacy Act
- US: Louisiana — Consumer Privacy Act
- US: Maine — An Act to Regulate the Use of Artificial Intelligence in Providing Certain Mental Health Services
- US: New Jersey — An Act Concerning Price Setting and Supplementing P.L.1960, c.39
- US: New Jersey — Data Brokers Law, P.L.2026 c.25
- US: New Jersey — Privacy Protection Act A4070
- US: New York — Safe by Design Act
- US: Rhode Island — Oversight of Artificial Intelligence Technology in Mental Health Care Act
- US: South Dakota — An Act to Safeguard the Integrity, Privacy, and Security of Genetic Data and Provide a Civil Penalty
- US: Tennessee — Curbing Harmful AI Technology Act, SB1700
- US: Vermont — Act 138 Relating to Data Brokers and Personal Information
- US: Vermont — Data Broker Security Breach Notice Act
- US: Vermont — Data Brokers Registration
- US: Vermont — Data Destruction
- US: Vermont — Data Privacy and Online Surveillance Act
- US: Vermont — Neurological Rights Act
- US: Vermont — Social Security Number Protection Act
- Vietnam — Decision No. 33/2026/QD-TTg: List of High-Risk AI Systems
- Vietnam — Decree No. 142-2026-ND-CP: Principles for Classifying AI Systems
Trust Center: Easier to manage, easier to make your own
Administering your Trust Center is now faster and easier to brand.
Spend less time managing your Trust Center while delivering a more polished, on-brand experience for your visitors.
- Handle document access requests from one place, with customizable notifications and clear status tracking.
- Keep your homepage clean while still keeping subscribers informed with update emails.
- Launch new Trust Centers faster by duplicating an existing one with a single click.
- Create a more consistent, on-brand experience with expanded visual customization options.
- Make it easier for visitors to navigate and access content in their preferred language with a new navigation layout and support for native browser translation.
