Are there legal risks to consider when allowing a client to export JIRA instance

[Amber Scott]

We have a client who is wanting to export our JIRA instance, 3k+ tickets, comments, attachments, Screen shots, workflows, epics etc. from our Private Instance into theirs. Before doing so, I want to consider any legal risks in allowing them access beyond the CSV export file. 

Thoughts?

[Nic Brough -Adaptavist- · Accepted solution]

This isn't really a Jira question at its heart!

Quite simply, there's a chunk of data that you "own".  Your client is asking for a copy of it.

You will need to ask your own lawyers what you can and cannot share with the client, given the regime that the data is hosted in.  If, for example, the data is in Germany, it would be illegal to share any form of personal details without the permission of the person it identified.  GDPR across the EU and several associated or ex-EU states would mean similar but slightly less stringent rules.  The US has incredibly weak privacy laws and you could share all sorts of stuff without a problem.

TLDR: you need to ask your lawyers.  If in doubt, share nothing.

[Amber Scott]

Thank you!