nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

GDPR, European "General Data Protection Regulation"

GeertWeijsGEA

Our company plans to use Atlassian software as standard support tools for software development.

We prefer the cloud-based option but according to the European and German laws we have to comply with DPD (Data Protection Directive), and as of May 25th 2018 to GDPR. (General Data Protection Regulation)
All implementations that do not comply are illegal. As of May next year violations can be fined with a maximum of 4% of the violators turn-over!
Yet I don’t see any discussion about this matter. Atlassian still states it does store customer’s data in a location it chooses. Also in the US, with is a violation of both DPD and GDPR.
Please inform me if Atlassian is complying with DPD, and if it is going to comply with GDPR. And how it is done.

Best regards,

Geert Weijs

Accepted answers

RJ Gazarek

Hi everyone!

We still get quite a bit of traffic on this question and page, so wanted to make sure that everyone visiting has the latest information. Sorry for responding to a very old post, but just in case anyone comes across it, here you go!

The long and short of it is, we are currently meeting all legal obligations laid out in GDPR, and continue to do so as we've interpreted in the most recent Schrems II court case ruling last year.

GDPR

You can always find our latest stance on GDPR at this link just like my colleague Lauren listed: https://www.atlassian.com/trust/privacy/gdpr

This is something we take very seriously, and protecting our customer's data is an utmost priority for us.

Schrems II

After the Schrems II court case decision last summer of 2020, we released our statement on it, which you can find here: https://www.atlassian.com/trust/privacy/latest-updates/international-data-transfers

Atlassian is actively monitoring this space, to see how interpretations are being handled, and as courts set precedence against this decision. We are also actively participating in the privacy community.

Data Residency

Atlassian is committed to offering Data Residency in those countries where our customers need it the most. You can find information on our current Data Residency offering here: https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency-and-realms/

Cloud Roadmap

I also encourage everyone to follow our cloud roadmap here, I've highlighted the Data Residency parts specifically with this link: https://www.atlassian.com/roadmap/cloud?category=dataManagement&

In addition to data residency, you will also find our plans for BYOK and meeting additional regulated industry requirements.

Data Management and Security Practices

I would also ask everyone to take a good read through all of our information on our Trust site: https://www.atlassian.com/trust

Here you can find a ton of information on all of the practices in place that help exemplify how seriously we take protecting your data.

Customer Feedback

We also are engaging actively with our customers and partners on our Data Residency plans, and ensuring we fully understand your needs, so we can work to address them in the future. Please feel free to join our discussion here: https://community.atlassian.com/t5/Cloud-Security-Compliance/gh-p/cloud-security-compliance

This is a great forum to join if you have any questions around compliance, regulated industries, data management, and/or data residency.

All comments

Aron Gombas _Midori_

Some months ago Atlassian suggested that they are opening their first data center located in Europe. I don't know what happened after, but it may worth some Googling...

OK, I looked this up for you: https://www.atlassian.com/trust/infrastructure

As it says it is "CURRENTLY IN PRIVATE BETA" and:

Atlassian has extended its cloud hosting infrastructure to Ireland. European customers of JIRA or Confluence cloud will benefit from improved performance and other advantages of local data storage.

Thomas Wrobel_lz91pc

We have the same problem. If there is no answer and/or solution soon, we will have to switch to a self hosted Gitlab solution.

GeertWeijsGEA

This step is mainly meant for "user experience improvement"

Storing data in Europe is one condition comply with GDPR, but not the only one.
Atlassian still states it will store all data in a location of their choice.

Meanwhile I got an answer from Atlassians legal office stating: "We are relying on our Privacy Shield certification to satisfy the onward transfer requirements under GDPR”

Our legal department estimates it is not enough to comply.

Nic Brough -Adaptavist-

Same here, I'm told Privacy Shield won't be enough. We need the option to host inside the EU.

The Beta in Europe is in Ireland, so that would solve it, if I understand correctly. But only if Atlassian will guarantee that if you ask for EU data, it will only be held and processed in the Irish centre.

Thomas Wrobel_lz91pc

We are by now looking for an alternative. It is a pity because we like the Atlassian products. The way Atlassian behaves seems to show that they do not care about their European business. Maybe to them, it is neglectable, otherwise, they will wake up to customers changing to competitors.

Jen Phillips

I'd also like an answer on this. We're currently looking at various ticketing solutions and Jira is winning on most points, but lack of GDPR compliance may be the sticking point.

Barry Kaplan

This is quite critical. Atalssian needs to be very clear here or a lot of JSD customers will have to jump ship.

Søren Riis Mønsted

Atlassian needs to make a Data Processing Agreement with their customers in addition to Privacy Shield. This is a must-have if customers should be able to comply with GDPR.

Søren Riis Mønsted

The requirement of having a Data Processing Agreement applies even if they open a EU data center.

Effie Bagourdi [Nimaworks]

Have a look at this recent announcement (published Dec 01st, 2017). Although it does not give any additional info regarding the EU data storage it starts with "Atlassian is committed to compliance with the General Data Protection Regulation (GDPR), which will go into effect May 25, 2018. "

Søren Riis Mønsted

They say they are Privacy Shield certified, which is good in terms of transferring data outside EU, also under the new GDPR. But they still need to enter Data Processing Agreements with their customers, regardless of all other efforts they do.

rcole

And the penalty is 4% of annual revenue or €10 million, whichever is greater. Just to underline to Atlassian that people will not be fucking around with non-compliance.

Celik Vedat

It's 20 Million euros :P

Boas Enkler

Why isn't here any official statement of atlassian ?

Thomas Wrobel_lz91pc

https://www.atlassian.com/blog/announcements/atlassian-and-gdpr-our-commitment-to-data-privacy

Boas Enkler

thx for the link at least a commitment. hopefully they will be intime...

unknown

Thanks - still no mention of Data Processing Agreement being available. When are we going to get it? Other companies - AWS, Salesforce, CA, etc already published their self-signed agreement. We need one from Atlassian.

Christoph Roll

Dear Atlassian team,

as you wrote in the announcement from the 1. December, you are committed and preparing for the GDPR, which comes in into force in Europe on the 25. May this year.
Unfortunately, this date is approaching and there is still some information missing, not only for me. The following questions need to be answered urgently in order to continue using your software:
- Will there be a Data Processing Agreement? (or should we send ours? ) This is a general requirement!
- Can we make sure or OnDemand instance is hosted in your data center in Ireland?
- What about privacy requirements as described for example in CONFCLOUD-7837 ?

I know/hope you guys are probably busy tackeling these challenges but our data protection officer is asking when we can expect information regarding the GDPR from Atlassian as our data processor.
Please be reminded that there will be severe penalties. Without clarification of the points, the further operation of the software after the 25. May is not possible for us and actually all your customers in Europe.

if I should overlook something, I ask for a pointer

Best regards

Paul Cartwright

I too am looking for a contact to sign our DPA contract.

Andreas Illmer

Same here. It's getting urgent.

Christoph Roll

Update:

https://www.atlassian.com/licensing/purchase-licensing?utm_source=alert-email&utm_medium=email&utm_campaign=privacy-change-notification_EML-3113#gdpr

tl;dr

Request your Data Processing Addendum (DPA) via privacy@atlassian.com

Amadeus UK Marketing Ltd

Dear Atlassian team,

We are trawling through old Jira issues manually removing GDPR data. We find however that if we are updating the original issue log that the original description is kept in the comments.

Please urgently advise how I can remove those from the comments.

Kind regards

Dorthe

Fabrizio Galletti _Getconnected_

Any news?

olivier.beaujean@bisnode.com

Hello, same question on our side. Is there a Processor Agreement available? Should we send you ours?

David Toussaint [Communardo]

Hey all,

I just wanted to let you now that there will be a new Jira app for anonymization by next week. An app for Confluence will be following shortly after. All the details are available already in the Atlassian Marketplace as well as in our Blog and website.

Disclaimer: I'm the product manager at the vendors company and am only posting this as the app does exactly what the initial question is all about.

Cheers, David

Technical Support-R4L

so this is solved? JSD and all Atlassian products conform to GDPR? Please confirm.

Andreas Springer _Seibert Group_

Hi everybody,

I'm the Head of Marketing at Actonic and if you need a complete GDPR/DSGVO solution for Jira, please have a look at our app „GDPR (DSGVO) and Security for Jira“. It provides all the tools you need to become fully compliant quickly and easily. There's also a version for Confluence. Both can be found in the Atlassian Marketplace.

I hope this will be useful for some people here. Thank you!

lauren_10b7cy

Hi everyone,

I just wanted to share an update. Atlassian now has a GDPR page that includes a full description of our GDPR practices: https://www.atlassian.com/trust/privacy/gdpr

Hopefully this helps answer some of your questions!

unknown

Can Atlassian update it's description and practices regarding the invalidation of Privacy Shield and the consequences for EU Customers?

RJ Gazarek

Hi everyone!

The long and short of it is, we are currently meeting all legal obligations laid out in GDPR, and continue to do so as we've interpreted in the most recent Schrems II court case ruling last year.

GDPR

You can always find our latest stance on GDPR at this link just like my colleague Lauren listed: https://www.atlassian.com/trust/privacy/gdpr

This is something we take very seriously, and protecting our customer's data is an utmost priority for us.

Schrems II

Data Residency

Cloud Roadmap

I also encourage everyone to follow our cloud roadmap here, I've highlighted the Data Residency parts specifically with this link: https://www.atlassian.com/roadmap/cloud?category=dataManagement&

In addition to data residency, you will also find our plans for BYOK and meeting additional regulated industry requirements.

Data Management and Security Practices

I would also ask everyone to take a good read through all of our information on our Trust site: https://www.atlassian.com/trust

Here you can find a ton of information on all of the practices in place that help exemplify how seriously we take protecting your data.

Customer Feedback

This is a great forum to join if you have any questions around compliance, regulated industries, data management, and/or data residency.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

jira

bitbucket

jira-service-desk

gdpr

compliance