Atlassian Enables Default Customer Data Collection to Train AI

[Jason M_]

Why are there reports in the last 2 days indicating Atlassian is suddenly changing it's stance on customer data to use for training starting in August 2026? Unless of course we move the the most expensive tier, Enterprise. And no word from Atlassian on the matter. 

• https://honeypot.net/2026/04/20/atlassian-enables-default-data-collection.html 
• https://www.theregister.com/2026/04/18/atlassians_new_data_collection_policy/
• https://letsdatascience.com/news/atlassian-enables-default-data-collection-to-train-ai-f71343d8

Here's the surruptitiously tacked-on official Addendum: https://www.atlassian.com/legal/data-processing-addendum#security

These incremental bait & switches are despicable.

[Jason M_]

For everyone's awareness, here's what the Addendum fails to clarify:

The DPA does not explicitly address AI training data usage - which is a significant gap given Atlassian's Rovo AI product rollout.

What the DPA Actually Says

Section 6.1(a) allows Atlassian to process customer data to:

"provide and improve the Products and related Support and Advisory Services"

That's dangerously broad language that could theoretically be stretched to include ML/AI model training.

Section 6.2 explicitly carves out their Controller activities:

"Atlassian is a Controller of Personal Data as specified in Atlassian's Privacy Policy. This DPA does not limit or prohibit Atlassian from acting in that capacity."

Translation: They reserve the right to use data as a Controller for purposes outlined in their Privacy Policy, separate from this DPA.

Critical Gaps

What's NOT in the DPA:

• No explicit prohibition on using customer data for AI/ML training
• No specific language about LLM training exclusions
• No restrictions on sub-processors using data for their own AI model development
• No mention of Rovo-specific data handling

The sub-processor risk:

• Section 4.1 requires sub-processors to "protect Customer Personal Data to the standard required by Applicable Data Protection Law"
• But it doesn't prohibit sub-processors from using anonymized/aggregated data for their own purposes
• If AWS, Google, or other sub-processors ingest your data for service delivery, what happens to anonymized derivatives?

[Bill Sheboy]

Hi @Jason M_ 

First thing: I am just a customer, not an Atlassian employee, vendor, etc.  With that out of the way...

Last week, Atlassian apparently sent a email about this change to Org / Product Admins for customer sites, including information about what could / could not be configured by license level, org type, etc.  Please check with your admins to get a copy of that information; it has the email subject: "Upcoming changes to how Atlassian uses your data".

And...you may search this community for the several other recent questions on this topic, following them for updates, and read these knowledgebase articles Atlassian added:

https://support.atlassian.com/security-and-access-policies/docs/manage-data-contribution-for-your-atlassian-organization/

Kind regards,
Bill

[Jason M_]

Thanks for the info & addt'l resources @Bill Sheboy