nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Questions around Proforma and GDPR (or other data retention laws)

SS_on2j0v · 2026-07-15T08:03:24+00:00

Assumptions * we need to collect 'necessary personal data' and must delete that data once it is no longer required. * collecting the data directly into a Jira issue would mean we have to delete the whole issue, since old field values are retained in the issue history (is there a way around this limitation?). * our fallback…

SS_on2j0v

Assumptions

we need to collect 'necessary personal data' and must delete that data once it is no longer required.
collecting the data directly into a Jira issue would mean we have to delete the whole issue, since old field values are retained in the issue history (is there a way around this limitation?).
our fallback would be to use attachments, which can be deleted with an Automation rule. But a proforma option is more elegant.
we are using data-center

1. If we delete a populated proforma form from an issue, (assuming that none of the form fields pushed data into linked Jira fields) does the database retain any information from the form?

2. Is there a way to automatically delete attached forms from Jira issues?
I can't find an API function for this, and they don't include an Automation action, but maybe the community knows some magic tricks.
There is a manual delete option, but to ensure compliance, we would want to automate the deletion (XX days after resolution).

Accepted answers

Marc -Devoteam-

Hi @SS

Unfortunate for DC there is no other option then manual on issues.

I don't expect that there will be any functional update on DC for this, as DC is being phased out.

There is an open feature request for this, see JSDSERVER-15847

All comments

Germán Morales

Hi @SS , taking your two points in order.

On whether deletion leaves a trace: Atlassian's own documentation doesn't confirm one way or the other whether the underlying form record is fully purged from the database or retained in some form. For something this compliance sensitive, that's worth getting in writing from Atlassian Support rather than assuming either way.
On automating the deletion: there's no native Automation action for it, but Atlassian documents a workaround for exactly this: an Automation rule using Send Web Request to call the Forms REST API, GET the list of forms on the issue, then DELETE each one by ID. Trigger it on a scheduled rule counting days since resolution. It exists specifically because the native action is still an open, unresolved request.

SS_on2j0v

Thanks for trying, but that API doc is for Cloud, we are still on DC for a few years more at least.

In the DC API, I cannot find a delete function at all.

Given that the linked CR for cloud functionality is nearly 4 years old, I think it unlikely that they will add the functionality to DC proforma.

Marc -Devoteam-

Hi @SS

Unfortunate for DC there is no other option then manual on issues.

I don't expect that there will be any functional update on DC for this, as DC is being phased out.

There is an open feature request for this, see JSDSERVER-15847

Mahima_miniOrange

Hi SS_on2j0v

This is a common challenge for teams handling personal data in Jira Data Center under GDPR or similar privacy requirements. The principle of "collect only what is necessary and delete it when it is no longer needed" sounds straightforward, but Jira can make this more complicated because change history retains previous field values even after the current field is cleared.

On your ProForma questions

I can't say with certainty what ProForma retains in the database after a form is deleted, as that depends on how the form data is stored internally. I'd recommend confirming this with Atlassian Support before relying on form deletion for compliance purposes.

As you mentioned, there currently isn't a built-in Automation action specifically for deleting forms. Automating this would likely require a custom script or app, which adds another component to maintain.

On the underlying question: working around the change-history limitation

If the main concern is removing personal data from Jira while retaining the issue itself, you may not necessarily need to rely on ProForma or an attachments-based workaround. One approach is to collect the required information in standard Jira fields and then remove or redact it when it is no longer required.

For this type of requirement, our DLP – Sensitive Data (PII, GDPR) Scanner & Cleaner for Jira and Confluence can help identify personal data in both current issue fields and change history.

Change History Cleanup

The scanner can check both current issue fields and change history for configured types of personal data. When a match is found, the value can be redacted, including values stored in the old and new values of the change history.

This allows personal data in the change history to be redacted or deleted, rather than simply clearing the current issue field.

Configurable Detection Rules

Detection can be configured using regex-based rules for data such as email addresses, phone numbers, national identification numbers, or financial information. You can enable only the rules relevant to your use case to reduce unnecessary matches and false positives.

Redaction, Encryption and Deletion Options

Detected data can be handled in three ways, depending on the requirement:

Redaction: The detected value is replaced with a redacted value, preventing the original data from being displayed.

Encryption: The detected value is encrypted using a configured key, allowing authorised users to recover the original data when needed.

Delete: The detected value is removed from the selected location when personal data needs to be deleted.

You can also configure the cleanup to target specific matched values rather than removing every match from an issue.

Scheduled and Real-Time Scanning

Scheduled scans can run automatically at configured intervals to identify and clean up data without manual intervention, including personal data that has exceeded a defined retention period.

Real-time scanning can check newly created content and notify the relevant team when configured types of personal data are detected.

Explore Our DLP & PII Scanner Apps

Jira Data Center: DLP – Sensitive Data Scanner & Cleaner for Jira

Confluence Data Center: DLP – Sensitive Data Scanner for Confluence

Jira Cloud: Data – PII Scanner (DLP) for Jira

Confluence Cloud: Data – PII Scanner (DLP) for Confluence

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

addon-com.thinktilt.proforma.add-on

data-center

jira-service-management

jira-service-management-data-center