Atlassian does not respect the General Data Protection Regulation (GDPR)

[Shroomy]

In Jira, there is no way to delete users or anonymize users in bulk. In fact, there is no function at all that allows deleting of more than one user at a time.

You can delete users one by one, but even if you do you will still have to go through the tedious process of removing all associations for the user. That is; remove all comments made by the user, re-assign all issues assigned to the user, and remove all reported issues by the user. Imagine doing this for 4000+ service desk customers...

For large amounts of users, it is so tedious to delete them that I would argue it is unrealistic to imagine that any company at all would actually do this. If Jira has such limited user management it kind of beats the purpose of using the software, unless you don't care about GDPR.

Sure, there are probably ways to go about this using third-party apps or API scripting, but as a main product, Jira is by far from ready for GDPR, even though the regulation came into effect 5 years ago.

One can argue that it is theoretically possible to delete large amounts of users. But if the effort it takes is so demanding that it is unrealistic to expect any company to do so, then one can hardly argue that Jira is built with "Privacy by Design" as stated here.

This leads me to the statement "Atlassian does not respect the General Data Protection Regulation (GDPR)". If they did, deleting (or anonymizing) users would be of main concern. Instead, Atlassian spends time developing whiteboards, dark mode, and other features. Atlassian can obviously prioritize this, but they choose not to do so.

Because of this, I am compelled to report the software as "at risk of violating GDPR" in our internal risk assessment. It doesn't reflect well on Atlassian and I really hope they will make this a priority soon.

To be honest, over the years I have come to love Atlassian products. I am not writing this because I have nothing against Atlassian. On the contrary, it is because I love working with them that I genuinely care about this issue.

[Dan Breyen]

I found these articles on Atlassian's site regarding GDPR and Anonymizing users.  I hope it helps address your concerns: Anonymizing Users GDPR europe-and-gdpr +

Hope that helps.  I would suggest raising your concerns directly to Support (support.atlassian.com/contact), so they can be addressed directly.