nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Where are our data stored?

Jonas Mølgaard

We are using JIRA Cloud, and GDPR rules state that personal data should be stored on datacenters within EU (may be inaccurately phrased).. However. To my understanding that's not possible to guarantee with JIRA Cloud or is it?

Specifically we sometimes have accidentially write ie. a key into a JIRA issue in ie. a description field or part of a comment, which just in some circumstances happen to be a social security number. Other times we find ourselves having entered a full name.

The current process is (obviously not optimal), is to delete the issue and recreate it, because editing the comment does not purge it from the history.

Accepted answers

All comments

M Amine

Hi @Jonas Mølgaard

Here is a good article about this : https://www.atlassian.com/trust/privacy

Sanmat Jhanjhari

@Jonas Mølgaard

You can check here https://admin.atlassian.com/o for your instance. Then go to Security ~> Data residency

Regards,

Sanmat

Jonas Mølgaard

Thanks for the info, this is however not what i asked about specifically.

Jonas Mølgaard

Thanks. This is a bit too general for me to decipher. I don't see any indications in that article, that there's a way for us to specifically force our storage of JIRA data to be kept physically in EU servers.

Stephen Addis

Surely its no different to the NHS where you sign to consent to your data going outside the EU if they offer you the services being done by a private company so as to relieve the que.

Had to do that for an MRI that was done by private company on behalf of the NHS, but they were processing the scans in South Africa.

I have read the GDPR, and ICO stuff as we also have to be compliant. But if its a case of services only available via non-EU providers, its offering the Clients that or we cant take your business. The key thing with GDPR is responsibility and transparancy, and informing them why you need their data, what you are going to do with it, who you might also send it to etc. I'm no lawyer, but I do know a bit about the GDPR to the extent of what I need to know.

We've left the EU, but are in a transition stage, so until January, all's up for debate lol.

Nic Brough -Adaptavist-

Argh, argh, argh, no.

I do not know where to start on how wrong most of that is.

If you are working in a field where the GDPR matters, please seek out some decent training on it before doing any more. It doesn't take long, and you're not expected to be a lawyer, just know enough to know when you need to ask more questions.

One of the things you've implied you believe landed me in a GDPR refresher course when I suggested it, and a lot of the other stuff you've said are red-flags I've had to haul up colleagues on more than once.

Please, stop. On two levels.

The point of the original question is that Jonas absolutely needs to know where the data is stored, and be able to guarantee that it will not be moved outside an area covered by the regulations. You don't seem to be grasping that.

Stephen Addis

There are instances, as I noted, where there is no option but to store data outside the EU.

This is compliant with the GDPR, and the assessment of if it is necessary and can be done is outlined on the ICO's website. It is subject to the necessary "safe guards", and other stuff like a BCR, ACM etc being in place, but can be done.

Even if the transfer is not covered by an adequacy decision, nor an appropriate safeguard, then you can only make that transfer if it is covered by one of the ‘exceptions’ set out in Article 49 of the GDPR.

This exception tells the person who's data it is all about what you need to transfer and why.

You tell them stuff like:

the identity of the receiver, or the categories of receiver;
the country or countries to which the data is to be transferred;
why you need to make a restricted transfer;
the type of data;
the individual’s right to withdraw consent; and
the possible risks involved in making a transfer to a country which does not provide adequate protection for personal data and without any other appropriate safeguards in place. For example, you might explain that there will be no local supervisory authority, and no (or only limited) individual data protection or privacy rights.

There are also instances where you do not need consent, although these are a little more uncommon, but still possible. Such as there must be an EU or UK law which states or implies that this type of transfer is allowed for important reasons of public interest, which may be in the spirit of reciprocity for international co-operation.

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/

It also notes things about "after transition", so my reference to us being in the process of leaving the EU was correct. The ICO state that they are monitoring how any transition change may apply to data stored, or crossing between UK and EU, but that things might be subject to change.

So yes, you can store data outside EU.

But also, the provider you are using, should tell you similar, as there is an equal obligation to you as a user/provider and they will be bound by same rules.

Stephen Addis

As GDPR is about personal data, you might find just using Client numbers, then on a EU or UK based system have the "other details" such as Social Security number, name, address. All the non-EU system has is an Client ID number/reference so that data is useless without the key data to unlock, which is stored elsewhere.

Its about minimisation, so if you dont need to transfer, dont. Your also not supposed to keep the data for any longer than necessary, so have a data destruction protocol too for when the info is no longer relevant. may be that its a two part, as some info will be not relevant and other bits may still be. So yoru supposed to remove the bits that are not, whilst retaining what is.

It is a bit of an admin nightmare afraid, but its a set of rules, which sets out the game plan, and its just a case of implementing.

Nic Brough -Adaptavist-

So you do understand that what you were saying earlier is wrong? Good.

Daniel Ebers

Several topics of explanation are available from a sub-page, specifically here:
https://www.atlassian.com/trust/reliability/infrastructure

For example it reads:

Can I choose the location of where my Jira or Confluence cloud site data resides?
Atlassian will optimize where customer data is located based on how it is accessed around the world. As an example, if the majority of the users access Jira or Confluence cloud instances from Europe, then their data will be migrated to one of our European regions.

But as Nic said later here in this thread, there is a specific question to the data location and I understand that you, Jonas, say you would need to decipher the given information as no specific region is written to the docs.

Have you already had a support request open on this with Trust team? The page linked above suggests to contact them in case of further questions and I'd see no reason to do it and ask for the specific data storage region.

Cheers,
Daniel

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

jira-software

jira-software-cloud