The Total Economic Impact™ Of The OneTrust Platform
Cost Savings And Business Benefits Enabled By OneTrust Solutions For Privacy And Data Teams
A Forrester Total Economic Impact™ Study Commissioned By OneTrust, September 2024
Since the promulgation of the General Data Protection Regulation (GDPR), privacy regulation has been on a constant upswing worldwide, expanding both the global geographies in which privacy regulation is in effect and the amount of information that is subject to regulation. At the same time, businesses have an ever-increasing number of touchpoints with external stakeholders (e.g., customers, partners, etc.) where they are gathering regulated data. The result is that firms are facing more hurdles than ever to responsibly leverage their data for business use while maintaining privacy, governance, and compliance.
OneTrust offers a platform that helps businesses responsibly collect and use company data, leveraging trust to drive business outcomes via privacy automation, data and artificial intelligence (AI) governance, and consent and preference management. It frees teams to do higher-value work like focusing on data insights and innovation, while mitigating security, privacy, governance, and compliance risks.
OneTrust commissioned Forrester Consulting to conduct a Total Economic Impact™ (TEI) study and examine the potential return on investment (ROI) enterprises may realize by deploying the OneTrust platform.1 The purpose of this study is to provide readers with a framework to evaluate the potential financial impact of the OneTrust platform on their organizations.
Return on investment (ROI)
227%
Net present value (NPV)
$4.8 million
To better understand the benefits, costs, and risks associated with this investment, Forrester interviewed five representatives with experience using the OneTrust platform. For the purposes of this study, Forrester aggregated the interviewees’ experiences and combined the results into a single composite organization — an enterprise organization with $15 billion in annual revenue and 63,000 employees.
Interviewees said that prior to using the OneTrust platform, their organizations were using disparate, inefficient, and expensive solutions, whether they were manual processes, internal homegrown systems, or external third-party solutions. The limitations of these solutions meant that teams found it difficult to leverage data responsibly for business use, consistently falling behind the influx of new regulations, the speed of regulatory change, and the growing amount of regulated data managed by their organizations.
After the investment in the OneTrust platform, the interviewees’ organizations put more data to use in a responsible way. Key benefits from the investment include increase in income from more effective marketing campaigns, improvement in privacy team productivity and ability to focus on higher-value tasks, reduction in the risk of a fine or regulatory inquiry, and cost savings from the decommissioning of prior technologies and services.
Key Findings
Quantified benefits. Three-year, risk-adjusted present value (PV) quantified benefits for the composite organization include:
- Increased income of 3%. By leveraging the OneTrust platform’s more granular consent and preferences solution capabilities while effectively managing its customer data in line with regulations, the composite organization improves its revenue driven by digital marketing campaigns by 3%. Over three years, this leads to a risk-adjusted present value of $4 million for the composite.
- Improved privacy team time savings of 75%. OneTrust’s platform automates a number of the composite organization’s privacy management workflows, allowing it to reduce the time and cost required to conduct core privacy management activities by 75%. The composite’s privacy team members can focus on higher-value, more strategic uses of their time, rather than rote, form-based work. Over three years, this leads to a risk-adjusted present value of $2.4 million for the composite.
- Reduction in regulatory risk by 75%. Because the composite knows where all of its regulated data is stored, how this data is being used, who has access to it, and any updates to permissions regarding use of this data, it reduces its risk of a regulatory fine from mishandling regulated data by 75%. The remaining 25% of risk is always present due to the possibility of human error. Over three years, this leads to a risk-adjusted present value of $50,000 for the composite.
- Technology and services cost savings of $195,000 annually. The composite saves approximately $45,000 annually by removing data and systems it no longer needs while saving approximately $150,000 on third-party services it no longer needs. Over three years, this leads to a risk-adjusted present value of $436,000 for the composite.
Unquantified benefits. Benefits that provide value for the composite organization but are not quantified for this study include:
- Additional risk reduction. The composite’s deployment of the OneTrust platform reduces an unquantifiable amount of risk associated with private-action privacy-related lawsuits and cybersecurity incidents.
- Better decision-making. By enabling better access to consented data, OneTrust enables the composite to use data more responsibly for better decision-making.
- Data enablement. The OneTrust platform increases the amount of data available for business use, allowing the composite to build a data foundation for its AI strategy.
- Trusted partner. The composite gains the benefits of partnering with OneTrust beyond adopting its platform, meeting regularly with OneTrust to discuss privacy strategy broadly, current privacy trends, and best practices for using customer data responsibly.
Costs. Three-year, risk-adjusted PV costs for the composite organization include:
- OneTrust fees. The composite pays $292,000 annually for its use of the OneTrust platform. This pricing reflects typical spend for an enterprise B2B organization with the same usage characteristics as the composite, factoring in variables such as user count and usage limits, for example. This leads to a three-year risk-adjusted cost of $726,000.
- Implementation and deployment costs. The composite leverages three FTEs for nine months implementing and deploying the OneTrust platform, with most of the time spent on policy configuration. Additionally, it pays a one-time fee of $200,000 on external services related to implementation and deployment. This leads to a three-year risk-adjusted cost of $656,000.
- Training and ongoing management costs. The composite’s privacy professionals need to be trained for 20 hours on OneTrust. One FTE is needed to manage OneTrust on an ongoing basis. This leads to a three-year risk-adjusted cost of $736,000.
The representative interviews and financial analysis found that a composite organization experiences benefits of $6.9 million over three years versus costs of $2.1 million, adding up to a net present value (NPV) of $4.8 million and an ROI of 227%.
Key Statistics
-
Return on investment (ROI)
227%
-
Benefits PV
$6.9 million
-
Net present value (NPV)
$4.8 million
-
Payback
7 months
Benefits (Three-Year)
Increased income from imporved marketing Productivity improvements from automation Reduced risk of compliance failure and regulatory fallout Technology and third-party services cost savings
TEI Framework And Methodology
From the information provided in the interviews, Forrester constructed a Total Economic Impact™ framework for organizations considering an investment in the OneTrust platform.
The objective of the framework is to identify the cost, benefit, flexibility, and risk factors that affect the investment decision. Forrester took a multistep approach to evaluate the impact that the OneTrust platform can have on an organization.
-
Due Diligence
Interviewed OneTrust stakeholders and Forrester analysts to gather data relative to the OneTrust platform.
-
Interviews
Interviewed five representatives at organizations using the OneTrust platform to obtain data about costs, benefits, and risks.
-
Composite Organization
Designed a composite organization based on characteristics of the interviewees’ organizations.
-
Financial Model Framework
Constructed a financial model representative of the interviews using the TEI methodology and risk-adjusted the financial model based on issues and concerns of the interviewees.
-
Case Study
Employed four fundamental elements of TEI in modeling the investment impact: benefits, costs, flexibility, and risks. Given the increasing sophistication of ROI analyses related to IT investments, Forrester’s TEI methodology provides a complete picture of the total economic impact of purchase decisions. Please see Appendix A for additional information on the TEI methodology.
Disclosures
Readers should be aware of the following:
This study is commissioned by OneTrust and delivered by Forrester Consulting. It is not meant to be used as a competitive analysis.
Forrester makes no assumptions as to the potential ROI that other organizations will receive. Forrester strongly advises that readers use their own estimates within the framework provided in the study to determine the appropriateness of an investment in the OneTrust platform.
OneTrust reviewed and provided feedback to Forrester, but Forrester maintains editorial control over the study and its findings and does not accept changes to the study that contradict Forrester’s findings or obscure the meaning of the study.
OneTrust provided the customer names for the interviews but did not participate in the interviews.
Consulting Team:
Jonathan Lipsitz
Nick Mayberry
Drivers leading to the OneTrust platform investment
Interviews
| Role | Industry | Region | Revenue |
|---|---|---|---|
| Privacy and compliance officer | Consumer health | Global | $125 million |
| Senior manager of privacy and data compliance | Consumer packaged goods (CPG) | Global | $9 billion |
| Chief privacy officer | Technology | Global | $15 billion |
| Director of data governance and enablement | Telecommunications | North America | $15 billion |
| Director of digital trust | Pharmaceuticals | Global | $45 billion |
Key Challenges
Before investing in the OneTrust platform, the interviewees’ organizations were using legacy processes (e.g., spreadsheets and email), limited third-party tooling, or expensive homegrown solutions to manage privacy, consent and preferences, and enterprise data.
The interviewees noted how their organizations struggled with common challenges, including:
- Expanding digital privacy regulations. The interviewees noted that GDPR ushered in a wave of new digital privacy regulations worldwide. While it was once sufficient to follow only GDPR, the interviewees’ organizations found themselves subject to ever-increasing and varied privacy regulations across an increasing number of jurisdictions, making their prior processes for managing privacy, consent and preferences, and enterprise data insufficient.
- Increasing data touchpoints. The interviewees noted growth in the number of touchpoints with external stakeholders where regulated data was shared. The senior manager of privacy and data compliance from the CPG firm noted that their organization had undergone a digital transformation process where it chose to expand direct-to-consumer digital interactions, leading to more consented first-party customer data being received. The privacy and compliance officer from the consumer health organization noted that their business was growing dramatically and receiving more customer consent data than ever. The result for both was that prior processes and technologies could not effectively handle the growth of regulated data.
- Limitations of other solutions. Regardless of the exact nature of their prior technology and/or processes, each interviewee felt these fell short of their organization’s needs in responding to burgeoning data privacy laws. The chief privacy officer from the technology firm shared that their prior manual processes of spreadsheets and email were inefficient and could not effectively handle the growth of both data and data regulation without incurring high costs of labor and from human error. The director of digital trust from the pharmaceuticals industry said that their organization’s homegrown system was costly and slow to change, which meant necessary updates either took far too long to be completed or ended up incurring massive tech debt, which would compound with each next update. The director of data governance and enablement from the telecommunications industry described their firm’s third-party tooling as “nonintuitive,” “not dynamic,” and “not user-friendly.” Data in the tool was difficult to access and search was limited, making the responsible use of data a near impossibility.
Composite Organization
Based on the interviews, Forrester constructed a TEI framework, a composite company, and an ROI analysis that illustrates the areas financially affected. The composite organization is representative of the five interviewees, and it is used to present the aggregate financial analysis in the next section. The composite organization has the following characteristics:
Description of composite. The composite is a global organization with 63,000 total employees and $15 billion in annual revenues. It is subject to an increasing number of data privacy regulations both at home and abroad, each with its own nuances. The organization’s privacy team of 10 professionals is swiftly falling behind its projected timelines. The team’s manual privacy, consent and preferences, and enterprise data management processes, which include tools such as spreadsheets, shared drives, email, and real-time communications platforms, cannot keep pace with data privacy regulations or the increasing amount of regulated data the company is receiving.
Deployment characteristics. The composite organization investigates the possibility of developing a homegrown platform for regulated data management but quickly determines that this would be very costly to build and cost-prohibitive to update at the pace of regulatory change. It instead runs a competitive request for proposal (RFP) process, at the end of which it selects the OneTrust platform for its focus on business results from the responsible use of data, flexibility, user friendliness, and expected speed of adoption, as well as DataGuidance, OneTrust’s privacy, security, and regulatory risk research platform.
Quantified benefit data as applied to the composite
Total Benefits
| Ref. | Benefit | Year 1 | Year 2 | Year 3 | Total | Present Value |
|---|---|---|---|---|---|---|
| Atr | Increased income from improved marketing | $840,000 | $1,680,000 | $2,520,000 | $5,040,000 | $4,045,379 |
| Btr | Time savings from automation | $961,875 | $961,875 | $961,875 | $2,885,625 | $2,392,041 |
| Ctr | Reduced risk of compliance failure and regulatory fallout | $19,800 | $19,800 | $19,800 | $59,400 | $49,240 |
| Dtr | Technology and third-party services cost savings | $175,500 | $175,500 | $175,500 | $526,500 | $436,443 |
| Total benefits (risk-adjusted) | $1,997,175 | $2,837,175 | $3,677,175 | $8,511,525 | $6,923,103 | |
Increased Income From Improved Marketing
Evidence and data. The interviewees shared that the OneTrust platform enabled their organizations to leverage their customer data in more ways while doing so responsibly and building trust. This strengthened marketing strategies and campaign results. The director of digital trust at the pharmaceuticals company said this was one of the key drivers for their company to use the OneTrust platform: “One thing that drew us to OneTrust was their interest in discussing the positive business impact of their platform, not just the technology impact. They were showing value beyond ticking a box.”
Interviewees said OneTrust’s platform enables more granular customer data permissioning rather than broad opt-in or opt-out options for receiving marketing communications. This allows customers to select the exact means and forms of communication they would like to receive from an organization rather than simply choosing to hear nothing from it at all. For OneTrust users, this means fewer customers opting out completely from communications, leaving more customers in the marketing funnel and leading to higher sales.
For example, the director of digital trust from the pharmaceuticals company shared that shortly after deploying OneTrust, their organization’s sales and marketing teams developed a campaign for a new product in two important regions. Human error led to the campaign being set up incorrectly on the marketing automation platform, which resulted in more than 30,000 emails being sent to each of the almost 900 high-volume customers who had consented to receive communications. After the campaign error, it was reported that the opt-out rate was 10%, which was valued at a potential loss of about $750 million.
When the director of digital trust investigated the results, they found that thanks to the deployment of OneTrust, marketing recipients customized their opt-out options. Only 2% had opted out of all communications. The remaining 8% were still willing to hear from the organization in some capacity. Because of this, the business reorganized its sales and marketing efforts, leading to an increase of between $2 billion and $3 billion in sales in the two markets. This interviewee said, “This incident really proved to the whole organization the top-line value of investing in a customer consent strategy and user-friendly experience.” The interviewee summarized that the OneTrust platform enabled the company to build marketing campaign strategies on trust and consent, leveraging these often intangible and unquantifiable benefits into dollars and cents. The interviewee explained, “The next level of sophistication for our marketing programs is going to be weaning ourselves off third-party data and leveraging OneTrust to build out a really smart first-party data strategy, simply.”
More generally, the senior manager of privacy and data compliance at the CPG company noted that their organization received top-line benefits from deploying OneTrust. This interviewee noted that the OneTrust platform’s features like privacy automation, consent and preferences granularity, and data subject access request (DSAR) management provided the business with the context and relevance to conduct campaigns they would not have been able to previously.
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
- Before OneTrust, the composite’s annual revenue was $15 billion.
- OneTrust’s granular consent and preferences enables a marketing campaign error related to a business constituting 7% of the composite’s annual revenue to be mostly remediated.
- OneTrust enables improvements to this campaign that result in an increase of 1% of annual revenue in Year 1, 2% in Year 2, and 3% in Year 3.
- The composite’s operating margin is 10%.
Risks. The improvement in marketing campaign results from OneTrust will vary with:
- The granularity of opt-out options before OneTrust.
- The size of the business involved in the marketing campaign.
- The operating margin.
Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $4.0 million.
Increased Income From Improved Marketing
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| A1 | Total revenues | Composite | $15,000,000,000 | $15,000,000,000 | $15,000,000,000 | |
| A2 | Percentage of total revenue relevant to campaignt | Interviews | 7% | 7% | 7% | |
| A3 | Revenue improvement | Interviews | 1% | 2% | 3% | |
| A4 | Operating margin | Composite | 10% | 10% | 10% | |
| At | Increased income from improved marketing | A1*A2*A3*A4 | $1,050,000 | $2,100,000 | $3,150,000 | |
| Risk adjustment | ↓20% | |||||
| Atr | Increased income from improved marketing (risk-adjusted) | $840,000 | $1,680,000 | $2,520,000 | ||
| Three-year total: $5,040,000 | Three-year present value: $4,045,379 | |||||
Time Savings From Automation
Evidence and data. The interviewees shared that the OneTrust platform had a substantial impact on the productivity of their organizations’ privacy teams. They said OneTrust’s platform automates privacy management workflows (e.g., privacy impact assessments, data mapping, and privacy request fulfillment), enabling lean privacy teams to spend more time on higher-value work.
The senior manager of privacy and data compliance from the CPG firm shared that automation enabled their team of four to act more like a team of nine, for which the interviewee never would have gotten budget.
The director of data governance and enablement from the telecommunications firm shared: “OneTrust has enabled us to sustain quite a bit using a small team on the backend, especially given our scale and size. It has significantly increased the number of assessments we can handle, for example. The impact on efficiency and team upscaling has been equivalent to more than doubling my team size. And thanks to the rigor of OneTrust trainings, this efficiency is sustained even as team members come and go.”
The chief privacy officer from the technology organization said: “OneTrust has automated privacy incident assessments, vendor risk assessment, and data inventory management for us. To do that work, we would have needed two to three more people at least, and we would not have gotten more people at all budget-wise.”
The director of digital trust from the pharmaceuticals company shared: “OneTrust exponentially grew my team’s bandwidth. I’d estimate that we’re now operating as if we had four to five more people than we do.”
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
- The composite has a privacy team of 10 professionals.
- The composite saves 75% of time from OneTrust automations.
- The average fully burdened annual rate including benefits and taxes for a privacy professional is $190,000.
- Seventy-five percent of the recouped time is used productively.
Risks. The value of improved productivity from OneTrust automations may vary with:
- The size of the current privacy team.
- The current efficiency of this team.
- The number and type of automations leveraged.
- The fully burdened annual rate of privacy professionals.
Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.4 million.
Time Savings From Automation
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|
| B1 | Privacy management team members | Composite | 10 | 10 | 10 |
| B2 | Reduced work time from OneTrust automations | Interviews | 75% | 75% | 75% |
| B3 | Average fully burdened annual rate for a privacy management professional | TEI standard | $190,000 | $190,000 | $190,000 |
| B4 | Productivity recapture rate | Composite | 75% | 75% | 75% |
| Bt | Time savings from automation | B1*B2*B3*B4 | $1,068,750 | $1,068,750 | $1,068,750 |
| Risk adjustment | ↓10% | ||||
| Btr | Time savings from automation (risk-adjusted) | $961,875 | $961,875 | $961,875 | |
| Three-year total: $2,885,625 | Three-year present value: $2,392,041 | ||||
Reduced Risk Of Compliance Failure And Regulatory Fallout
Evidence and data. The interviewees shared that the OneTrust platform was able to meaningfully reduce a number of different risks faced by their organizations. The key risk reduced by the OneTrust platform that the interviewees could quantify was the reduced risk of a regulatory action taken against their organizations for a compliance failure. The privacy and compliance officer from the consumer health business said: “With OneTrust, our risk is greatly reduced. We know what data we have, how much we have, and where it is located. With everything fully implemented, regulatory risk is reduced by 75%. The other 25% you’ll always have because of human error mishandling data.”
Interviewees said OneTrust’s platform reduces regulatory risk by accurately tracking where data is stored, how this data is being used, and what consent and preferences apply to what data. For example, the director of digital trust from the pharmaceuticals industry said: “With OneTrust, we have a clear understanding of what a person consents to. We know what channels they want to hear from us on, what brands they are interested in, when they want to hear from us, and we have an audit trail of this, all captured in the first-party experience. We are in a more defensible position if a regulator comes knocking at our door. We can easily prove we are honoring and enforcing our audience’s consent and preferences.”
The chief privacy officer from the technology company similarly shared: “We have clear notice from our customers of their consent and how and to what they’ve opted in and out. We know where our data goes, who’s touching it, and what type of data that is. We have an easy job if a regulator asks us questions and are at less risk of being subject to any actions or inquiries.”
Finally, the ability for different users and stakeholder groups to collaborate on the singular OneTrust platform reduces risk from duplication and human error. The director of data governance and enablement from the telecommunications firm said: “With our prior third-party platform, requests had to go to and be fulfilled by multiple people, from legal to security to metadata teams, leading to duplication. This also increased the risk of human error entering the process. OneTrust avoids this duplication and risk entirely.”
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
- The average cost of a GDPR fine is $4.4 million.2
- The composite’s prior risk of a fine each year was 1%.
- The total reduction of regulatory risk is 75%.
- Twenty-five percent of this risk is reduced from prior processes.
Risks. The value of reducing regulatory risk will vary with:
- The total costs of any regulatory actions.
- The risk of experiencing such a fine before deploying the OneTrust platform.
- The additional costs beyond the fine itself (e.g., reduced sales from diminished brand reputation and the internal costs to manage the fine and update processes to remediate what went wrong).
Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $49,000.
Reduced Risk Of Compliance Failure And Regulatory Fallout
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|
| C1 | Average cost of a GDPR fine | Composite | $4,400,000 | $4,400,000 | $4,400,000 | |
| C2 | Prior risk of a fine | Composite | 1% | 1% | 1% | |
| C3 | Total reduction in risk of fines | Interviews | 75% | 75% | 75% | |
| C4 | Reduction from prior processes | Composite | 25% | 25% | 25% | |
| Ct | Reduced risk of compliance failure and regulatory fallout | C1*C2*(C3-C4) | $22,000 | $22,000 | $22,000 | |
| Risk adjustment | ↓10% | |||||
| Ctr | Reduced risk of compliance failure and regulatory fallout (risk-adjusted) | $19,800 | $19,800 | $19,800 | ||
| Three-year total: $59,400 | Three-year present value: $49,240 | |||||
Technology And Third-Party Services Cost Savings
Evidence and data. The interviewees shared that the OneTrust platform enabled their organizations to reduce costs they incurred from their prior privacy, consent and preferences, and enterprise data management solutions. For example, the senior manager of privacy and data compliance from the CPG industry shared that their organization was using manual processes before deploying OneTrust. This interviewee said: “Even though we were using manual processes, we were still able to reduce a number of internal and third-party costs. For example, we’ve saved tens of thousands of dollars each on removing millions of data records we were not using, removing duplicative systems across different brands, and removing systems that proved unacceptable to our new privacy and data management policies. On top of that, we’re saving hundreds of thousands of dollars on third-party services costs that we used to use for data mapping, privacy impact assessments, and DSAR fulfillment.”
The director of digital trust from the pharmaceuticals firm was leveraging a homegrown system before deploying OneTrust. This interviewee shared: “Of course, building out the system itself was a large but sunk cost. In terms of ongoing costs, any time we had to develop a new feature, it would cost hundreds of thousands of dollars, and we did this multiple times a year. On top of that, just operating the system each year was costing us about $350,000, and that doesn’t account for the salaries of the analysts and engineers maintaining it. All of this cost has gone away as we’ve moved to OneTrust.”
The director of data governance and enablement from the telecommunications industry shared that their organization not only decommissioned its prior third-party tool and saved on all annual costs associated with it, but that it also gets more value out of the OneTrust platform. This interviewee said: “The real value for us was not in the fact we stopped paying for our prior tool. It’s that we were paying for it and not getting any real value out of it. It was too inflexible to work with us. OneTrust has been the opposite experience.”
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
- The composite removes unused data records, duplicative systems, and systems out of compliance, resulting in a savings of $45,000 annually.
- The composite stops using third-party data mapping, privacy impact assessments, and DSAR fulfillment services valued at a total of $150,000 annually.
Risks. The value of reducing technology and services costs will vary with:
- The prior solutions used for privacy, consent and preferences, and enterprise data management.
- The total ongoing cost of these solutions.
Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $436,000.
Technology And Third-Party Services Cost Savings
| Ref. | Metric | Source | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|
| D1 | Technology cost savings | Interviews | $45,000 | $45,000 | $45,000 |
| D2 | Third-party services savings | Interviews | $150,000 | $150,000 | $150,000 |
| Dt | Technology and third-party services cost savings | D1+D2 | $195,000 | $195,000 | $195,000 |
| Risk adjustment | ↓10% | ||||
| Dtr | Technology and third-party services cost savings (risk-adjusted) | $175,500 | $175,500 | $175,500 | |
| Three-year total: $526,500 | Three-year present value: $436,443 | ||||
Unquantified Benefits
Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:
-
Additional risk reduction. In addition to reducing regulatory risk, the interviewees noted
other risk areas that OneTrust reduced but that they were unable to
quantify. The first area is legal risk outside of regulatory action. For
example, the privacy and compliance officer from the consumer health company
said: “Some regulations provide for a private right of action for a company
mishandling data. Dispute notices or letters are quite common, and I’ve been
deposed over 130 times. Oftentimes, it’s easier to just settle than to
dispute the claim and demonstrate compliance if you’re not using the right
solution. Now, if we get a notice from an auditor or a dispute notice,
OneTrust enables us to demonstrate consent and full compliance instead of
having to settle.”
One interviewee also noted that OneTrust reduced their risk of incurring a data breach by saying, “OneTrust has absolutely reduced our risk of a cybersecurity breach by identifying and remediating potential threats. We’re tracking the risks identified and remediated but have not yet quantified this value to us.” - Better decision-making. The OneTrust platform’s data governance capabilities also helped organizations improve their decision-making. By gaining visibility into their enterprise data and better understanding attributes like its location, specific regulations applied to it, and permissions and consent associated with it, users could better leverage that data in a responsible manner to drive business impact while incurring the lowest possible risk.
- Data enablement. The interviewees also shared that the OneTrust platform enables more data to be used by the business for decision-making purposes than was possible before. The director of data governance and enablement from the telecommunications firm stated: “Without OneTrust, we would have fragmented data and would not be able to scale our data operations. As such, it would be difficult if not impossible to pursue our AI strategy.”
- Trusted partner. Multiple interviewees noted that OneTrust served as a trusted partner along their journey to better privacy and data management. For example, the senior manager of privacy and data compliance from the CPG firm said: “We’ve had a really beneficial relationship with OneTrust. They sit with our leadership and help inform strategy, provide insights, and even helped to establish our center of excellence for privacy.” The director of digital trust from the pharmaceutical company shared: “OneTrust truly partnered with us. They’ve consistently shown up, and that’s part of their superpower, really. When their customer is engaged, they go all in.”
Flexibility
The value of flexibility is unique to each customer. Some customers might implement the OneTrust platform and later realize additional uses and business opportunities, including:
-
User experience (UX).
The interviewees noted that the UX of OneTrust not only helps to build trust
among customers but that it also can help with future technology adoption.
For example, the director of digital trust from the pharmaceutical industry
said: “OneTrust’s user experience regarding consent and preferences for our
customers helps to enable transparency and trust between us and them. I’m
just now starting to think of all the different strategic ways we can
further leverage the transparency and trust from OneTrust to better business
results.”
The director of data governance and enablement from the telecommunications firm focused on the internal user experience of OneTrust, noting: “Using OneTrust is not an overly technical task. It’s like tax preparation software in that it keeps asking you questions until you get the right result. The simplicity enables my team to get more done.”
Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Appendix A).
Quantified cost data as applied to the composite
Total Costs
| Ref. | Cost | Initial | Year 1 | Year 2 | Year 3 | Total | Present Value |
|---|---|---|---|---|---|---|---|
| Etr | OneTrust fees | $0 | $292,000 | $292,000 | $292,000 | $876,000 | $726,161 |
| Ftr | Implementation and deployment costs | $655,600 | $0 | $0 | $0 | $655,600 | $655,600 |
| Gtr | Training and ongoing management costs | $20,900 | $420,090 | $211,090 | $211,090 | $863,170 | $735,850 |
| Total costs (risk-adjusted) | $676,500 | $712,090 | $503,090 | $503,090 | $2,394,770 | $2,117,611 | |
OneTrust Fees
Evidence and data. The interviewees shared OneTrust fees that varied with the number of users, number of products utilized, and usage limits.
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
- The composite pays $292,000 annually for the OneTrust platform.
- Pricing may vary. Contact OneTrust for more details.
Risks. The cost of OneTrust will vary with:
- The number of solutions products implemented and deployed.
- The number of users.
- The chosen usage limits.
Results. Because OneTrust provided pricing for the composite organization, Forrester did not adjust this cost for risk, yielding a three-year, total PV (discounted at 10%) of $726,000.
OneTrust Fees
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|---|
| E1 | OneTrust fees | Composite | $0 | $292,000 | $292,000 | $292,000 | |
| Et | OneTrust fees | E1 | $0 | $292,000 | $292,000 | $292,000 | |
| Risk adjustment | 0% | ||||||
| Etr | OneTrust fees (risk-adjusted) | $0 | $292,000 | $292,000 | $292,000 | ||
| Three-year total: $876,000 | Three-year present value: $726,161 | ||||||
Implementation And Deployment Costs
Evidence and data. The interviewees detailed both internal and external implementation and deployment costs for OneTrust. The time to implement and deploy varied between nine months and 18 months, with most of this time spent on policy configuration. The number of internal employees needed for implementation varied from 1.5 FTEs to 8 FTEs. External resource costs varied from $200,000 to $250,000.
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
- The composite needs three internal employees to manage and assist with implementation and deployment.
- The composite requires external services at a cost of $200,000.
- It takes nine months to complete implementation and deployment.
Risks. The cost of implementation and deployment will vary with:
- The number and type of OneTrust solutions used.
- The size of the data estate.
- The cost of external services.
Results. To account for these risks, Forrester adjusted this cost upward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $656,000.
Implementation And Deployment Costs
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|---|
| F1 | Professionals needed for implementation | Interviews | 3 | |||
| F2 | Time needed for implementation (hours) | Interviews | 1,500 | |||
| F3 | Average fully burdened hourly rate for a professional involved in implementation | Composite | $88 | |||
| F4 | Professional services costs | Interviews | $200,000 | |||
| Ft | Implementation and deployment costs | F1*F2*F3+F4 | $596,000 | $0 | $0 | $0 |
| Risk adjustment | ↑10% | |||||
| Ftr | Implementation and deployment costs (risk-adjusted) | $655,600 | $0 | $0 | $0 | |
| Three-year total: $655,600 | Three-year present value: $655,600 | |||||
Training And Ongoing Management Costs
Evidence and data. The interviewees shared resources and time investments associated with training and ongoing management around the OneTrust platform. For training, they noted various lengths of time ranging from one week to one month with a total of about 20 hours needed regardless of the total time to completion. For ongoing management, the interviewees reported that their organizations required between 0.5 and 5 FTEs to push new templates for new regulations, changing data configurations, checking on updates, and checking the functionality of recent changes.
Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:
- The composite trains 10 privacy professionals to use the OneTrust platform.
- Each professional needs 20 hours of training.
- One new privacy professional needs to be trained each year as turnover occurs.
- Two FTEs are needed to manage OneTrust in Year 1 as policies are implemented and updated. On an ongoing basis, only 1 FTE is needed as activity switches to program management and away from the initial build-out.
Risks. The cost of training and ongoing management will vary with:
- The number of privacy professionals needing training.
- The amount of turnover on the privacy team.
- The size of the data estate associated with OneTrust and the number of policies needing to be implemented on the platform.
Results. To account for these risks, Forrester adjusted this cost upward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $736,000.
Training And Ongoing Management Costs
| Ref. | Metric | Source | Initial | Year 1 | Year 2 | Year 3 | |
|---|---|---|---|---|---|---|---|
| G1 | FTEs trained | Interviews | 10 | 1 | 1 | 1 | |
| G2 | Total training time (hours) | Interviews | 20 | 20 | 20 | 20 | |
| G3 | Fully burdened hourly rate of trained FTE | B3/2,000 | $95 | $95 | $95 | $95 | |
| G4 | FTEs managing OneTrust | Interviews | 0 | 2 | 1 | 1 | |
| G5 | Fully burdened annual rate for a FTE managing OneTrust | B3 | $190,000 | $190,000 | $190,000 | $190,000 | |
| Gt | Training and ongoing management costs | G1*G2*G3+G4*G5 | $19,000 | $381,900 | $191,900 | $191,900 | |
| Risk adjustment | ↑10% | ||||||
| Gtr | Training and ongoing management costs (risk-adjusted) | $20,900 | $420,090 | $211,090 | $211,090 | ||
| Three-year total: $863,170 | Three-year present value: $735,850 | ||||||
Consolidated Three-Year Risk-Adjusted Metrics
Cash Flow Chart (Risk-Adjusted)
Total costs Total benefits Cumulative net benefits Initial Year 1 Year 2 Year 3-
The financial results calculated in the Benefits and Costs sections can be used to determine the ROI, NPV, and payback period for the composite organization’s investment. Forrester assumes a yearly discount rate of 10% for this analysis.
These risk-adjusted ROI, NPV, and payback period values are determined by applying risk-adjustment factors to the unadjusted results in each Benefit and Cost section.
Cash Flow Analysis (Risk-Adjusted Estimates)
| Initial | Year 1 | Year 2 | Year 3 | Total | Present Value | |
|---|---|---|---|---|---|---|
| Total costs | ($676,500) | ($712,090) | ($503,090) | ($503,090) | ($2,394,770) | ($2,117,611) |
| Total benefits | $0 | $1,997,175 | $2,837,175 | $3,677,175 | $8,511,525 | $6,923,103 |
| Net benefits | ($676,500) | $1,285,085 | $2,334,085 | $3,174,085 | $6,116,755 | $4,805,492 |
| ROI | 227% | |||||
| Payback | 7 months | |||||
Appendix A: Total Economic Impact
Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders.
Total Economic Impact Approach
-
Benefits represent the value delivered to the business by the product. The TEI methodology places equal weight on the measure of benefits and the measure of costs, allowing for a full examination of the effect of the technology on the entire organization.
-
Costs consider all expenses necessary to deliver the proposed value, or benefits, of the product. The cost category within TEI captures incremental costs over the existing environment for ongoing costs associated with the solution.
-
Flexibility represents the strategic value that can be obtained for some future additional investment building on top of the initial investment already made. Having the ability to capture that benefit has a PV that can be estimated.
-
Risks measure the uncertainty of benefit and cost estimates given: 1) the likelihood that estimates will meet original projections and 2) the likelihood that estimates will be tracked over time. TEI risk factors are based on “triangular distribution.”
The initial investment column contains costs incurred at “time 0” or at the beginning of Year 1 that are not discounted. All other cash flows are discounted using the discount rate at the end of the year. PV calculations are calculated for each total cost and benefit estimate. NPV calculations in the summary tables are the sum of the initial investment and the discounted cash flows in each year. Sums and present value calculations of the Total Benefits, Total Costs, and Cash Flow tables may not exactly add up, as some rounding may occur.
Appendix B: Endnotes
1 Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists vendors in communicating the value proposition of their products and services to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of IT initiatives to both senior management and other key business stakeholders.
2 Source: GDPR Enforcement Tracker Report, CMS Legal.
PDF 