Skip to main content

October 2026

This page documents all customer-facing changes to the DataGrail application made in October 2026. Additional entries will be added every week on Friday.

Week of October 19​

🚀 Features Added​

  • RoPA templates can now be customized. Admins can select Edit Template at the bottom of any RoPA to add a Custom Questions section with their own questions, answer types, and options. Changes apply to every Processing Activity, while the standard Article 30 fields stay locked so your RoPA stays compliant and consistent.
  • Risk Assessments can now be downloaded as a PDF or ZIP before they're approved, so you can share a draft with legal, security, or business owners without waiting for sign-off. A confirmation shows the assessment's current status first, and the PDF is labeled with that status so everyone knows it isn't final.
  • Phone Intake is now powered by Vera. Vera reviews incoming voicemails to identify the request type and flag calls that aren't privacy-related, and you can choose to close those automatically. A new Phone Intake settings page shows your toll-free number and voicemail message, and voicemail transcripts and audio now appear in the Request Wizard and on the Request Details page.
  • Branding lets Super Admins upload and replace your company logo under Settings → Branding, without contacting support. If you use a Privacy Request Center, you can also add a separate logo just for it.
  • Okta Universal Logout can now be turned on by admins under Settings → Security. When an Okta admin ends a user's sessions, that user is signed out of DataGrail right away. It works with both SAML and OIDC Okta apps.
  • Inbound Assessments now work with any sign-in method when you have an Okta or OneLogin integration. Turn on the new User Detection option on the integration to sync your directory as contacts, and the Generate Assessment Link button now explains what to do when it's unavailable.
  • Ashby is now available as a Request Manager integration, so you can automate Access and Deletion requests against Ashby instead of handling them by hand.
  • Universal Consent now emails admins when your monthly usage reaches 1.5x and 2x your contracted volume.

🛠 Changes Made​

  • Vera suggestions on assessments now link to their sources. A new Document Sources list shows the documents Vera used, with page numbers, and you can select one to download it. Linked assessments are clickable too.
  • Vera has been upgraded to a faster, more capable model.
  • Google Tag Manager and Adobe containers now link to and from their integrations, and you can add or remove GTM containers without connecting your Google account again.
  • Google Consent Mode Auditor now shows a Could Not Verify result for inconclusive scans. These scans no longer show up as failures or trigger alert emails.
  • Email Templates now have product tabs, a searchable Reason dropdown, and a before-and-after view in Review and Publish.
  • Oracle OPERA Cloud connections now use a single Gateway URL field.
  • The Request Velocity chart is now turned off for accounts with more than 10,000 requests.
  • Request Manager Agent 1.4.0 and 1.4.1 — routine maintenance and a security patch for a dependency vulnerability.

🐛 Bugs Squashed​

  • Resolved issues with consent where:
    • The audit details didn't show your actual Consent Mode states, and the weekly Consent Mode email reported the wrong scan duration.
    • Unmanaged and Archived cookie lists could time out on large accounts.
    • Turning off a language removed its translations from published versions.
    • Scan results could stay stuck at Pending after a scan failed.
  • Resolved issues where Marketo opt-outs could fail, some Greenhouse candidate attachments weren't collected, and Segment requests could loop through results without finishing.
  • Resolved an issue where the Portal Queue didn't remember your filters and sort.
  • Resolved an issue where duplicate custom taxonomy options could appear. Duplicates are now merged.

Week of October 12​

🚀 Features Added​

  • Superwall is now available as a Request Manager integration, so you can automate Access and Deletion requests against Superwall instead of handling them by hand.
  • Assessments can now require answers before submission. Admins and Risk Monitor Admins can turn on Required Questions under Settings → Risk Management → Assessments, so you no longer have to chase missing answers after an assessment is submitted. When several people contribute, only those assigned to an unanswered required question are blocked; everyone else gets a warning and can still submit.

🛠 Changes Made​

  • Assessment Creators, Assessment Requesters, and Inventory Managers can now select systems and processing activities on assessments. Assessment Contributors can no longer edit assessment details.
  • Consent banner cookies: DataGrail's own banner and TCF cookies now appear as locked, built-in rows in Cookie Rules and in your banner's tracking details, instead of showing up as Unmanaged.
  • IAB TCF and GPP signals now report DataGrail's registered IAB CMP ID (470). Republish your consent configuration to apply it.
  • Discovered Integrations loads up to 90% faster. The Assessments list and large-volume opt-out submissions are also faster.

🐛 Bugs Squashed​

  • Resolved an issue where visitors couldn't click anything on your site until they made a consent choice on a bottom-bar or side-panel consent banner. Only the modal layout now blocks the page behind it.
  • Resolved issues with consent banners where:
    • Publishing one SRI-enabled container could break TCF, GPP, and plugin scripts on your other SRI-enabled containers.
    • Enabling a new language overwrote tracking-details link translations.
    • Unmanaged and Archived cookie filters failed on high-volume accounts.
  • Resolved issues where Discovered Integrations filters failed past the first page, and finished Data Discovery scans could still show "In Progress".
  • Resolved an issue where Request Manager Agent API keys stopped working for accounts with multibrand permissions.
  • Resolved issues where pasted edits to email templates weren't saved as changes, and weekly detection notification emails could be sent more than once.

Week of October 5​

🚀 Features Added​

  • System Data Reports can now be customized. Admins can select Edit Template to add a Custom Questions section with their own questions, answer types, and options. Changes apply to every system in your inventory, while the standard fields stay locked so your core data map stays consistent.
  • Security Audit Logs give Super Admins a searchable, 12-month record of every sign-in attempt and every allowed or denied access decision in your account. Find it under Settings → Security → Audit Log, or pull the logs into your own tools through the public API.
  • Dixa is now available as a Request Manager integration, so you can automate Access and Deletion requests against Dixa instead of handling them by hand.
  • Vera MCP can now assign, change, or remove system owners and contacts, including in bulk, and inventory searches now show who is assigned.

🛠 Changes Made​

  • Sensitive personal information (SPI) data categories are now highlighted in yellow in assessments and processing activities, matching the Systems page, so sensitive data stands out during review.
  • Greenhouse Access requests now return jobs, rejection reasons, current stage, and offers.
  • Salesforce can now find and anonymize Nonprofit Success Pack (NPSP) address records.
  • Inbound phone requests now start processing after 1 minute instead of 5.

🐛 Bugs Squashed​

  • Resolved issues with privacy requests where closing a request didn't record the reason you chose, editing several request policies in a row could disable the Save button, requests could get stuck in Extracting Identifiers, and inbound emails with non-UTF-8 characters were dropped.
  • Resolved issues where Email Intake left clear deletion emails unclassified, verification emails could fail to send, and Resend Download Link could time out.
  • Resolved issues with assessments where rule pickers mislabeled nested questions, starting from an inbound link didn't show the Submit button, external contributor actions were missing from Change History, and Risk Monitor Admins couldn't open notification settings.
  • Resolved issues where consent banner headings could produce invalid HTML and cookie rule patterns couldn't include $.
  • Resolved an issue where Arity always created both request types. You can now choose Disclosure or Law Enforcement.
  • Resolved an issue where accounts could be blocked from connecting new MCP clients.
  • Resolved an issue where Explain with Vera on a workflow didn't answer from your actual workflow.
  • Resolved issues where data broker status uploads could report unfinished records as "not found" or fail on temporary processing errors.

Week of September 28​

🚀 Features Added​

  • Vera can now read images you upload to an assessment — screenshots, data flow diagrams, architecture docs, and more. Vera uses them when suggesting answers and generating "Analyze with Vera" insights, cites each image by file name, and adds an attachment summary describing what it found in the image.
  • Forethought is now available as a Request Manager integration, so you can automate Deletion requests against Forethought instead of handling them by hand.

🛠 Changes Made​

  • Consent log exports are now dramatically faster, so your exports stay reliable and up to date.
  • Detected Risks now show which Vera Skill found each risk, and the Skill Library now separates interactive skills from detection skills.
  • Data broker compliance — select any row in the DROP Status table to see its details, including why a CSV upload failed and step-by-step instructions to fix it. Manual uploads now also accept CalPrivacy removal lists, which withdraw earlier deletion requests.
  • Zoom now supports additional fields for Field Level Controls.
  • Klaviyo now uses Klaviyo's latest API version.
  • Salesforce Service Cloud OAuth connections now support PKCE for added security.

🐛 Bugs Squashed​

  • Resolved an issue where Zendesk field detection could miss newer custom fields on large accounts.
  • Resolved an issue where renaming the custom section in a System Data Report template didn't update the System Overview page, and where newly inserted questions could appear out of order.
  • Resolved an issue where Adobe Tags stopped syncing daily and Adobe rules weren't gated by their consent category when published. Disabled Adobe rules are now also clearly labeled.
  • Resolved an issue where archived request policies could appear in the GTM template and consent interface. Regenerate and republish your GTM template to apply the fix.
  • Resolved an issue where Banner Preview with a simulated location didn't apply that location's GTM consent defaults.
  • Resolved an issue where saving a cookie rule could fail, and where deleted cookies still appeared under their domains.
  • Resolved an issue where a stuck Data Discovery scan could block scheduled scans from running.
  • Resolved an issue where request queue deadlines could show as due one day early in US timezones, and where the Data Subject Relationship filter was missing for some customers.
  • Resolved an issue where long queries in the Agent query configuration box didn't wrap.
  • Resolved an issue where resending a download link didn't reset identity verification, and where Verify Identity could stall when its email was suppressed.
  • Resolved an issue where emails for unsupported locales didn't fall back to English.