Data residency

Question

Hello, our system contains confidential and private health related data which under Queensland and National Privacy Principles must be resided in Australia and must not be exported to data centres overseas.  How can I ensure the new AI model training does not breach these legal requirements?

Gabriela - LeanZero · Answer

Hi @Dermot Tiernan, the residency pin and the AI training opt-out are two different switches. The second one is in Atlassian Administration, then Security, then Data contribution, and Atlassian starts using data according to whatever it says there on 17 August 2026.

Your post is tagged Standard. The default follows the highest active plan across the whole org, so check that first if anything in there sits on Premium or Enterprise. On Standard, in-app data, meaning the ticket content itself, defaults to On, and an org admin can set it to Off or exclude particular apps and spaces. Metadata is the half you can't reach. It's contributed on Free, Standard and Premium regardless, and Enterprise is the only plan with a switch for it.

On the export question, the FAQ says data residency settings remain in effect for contributed in-app data and that this change doesn't alter how residency is applied.

If the metadata half won't pass your legal review, the exclusions are org-wide rather than a toggle. CMK or BYOK encryption, Atlassian Government Cloud, Isolated Cloud, or HIPAA compliance configured. Those contribute nothing at all.

https://support.atlassian.com/security-and-access-policies/docs/data-contribution-settings/
https://www.atlassian.com/trust/ai/data-contribution/faqs

Ajay _view26_ · Answer

Hi @Dermot Tiernan

First, Atlassian does offer data residency for Cloud products (Jira, Confluence, JSM) in the Australia realm. If you haven't already, make sure your org is pinned to the Australian realm via admin.atlassian.com under "Data residency." That covers in-scope product data at rest.

That said, given you're dealing with health data under strict privacy legislation, I'd also recommend raising a support ticket directly with Atlassian and asking for their latest Data Processing Addendum (DPA) which covers the specifics of data processing locations. They've been pretty responsive on compliance-related queries.