Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

GDPR - compliance - do we store personal data?

Tom Lister
Community Leader
Community Leader
Community Leaders are connectors, ambassadors, and mentors. On the online community, they serve as thought leaders, product experts, and moderators.
Jan 09, 2020


I'd like some feedback on GDPR issues.

Our Jira has many business related projects but we do not capture personal data. That is we have user data email/name/username in our directories. (emails are company emails)  But the issue data does not require any personal data.

My understanding so far is that this is not personal data is not a GDPR risk.

It does seem that there could be a situation where a user could ask us what we have stored and ask to 'remove' it. I think the former could be a report is user activity stored. And for the latter we could obfuscate the email/name/username to avoid any the work involved in deleting a user from Jira.

Does anyone have experiences to share?


1 answer

1 accepted

1 vote
Answer accepted
Earl McCutcheon
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Jan 10, 2020

HI @Tom Lister ,

If you have any users that fall under the GDPR definition of originating in a location inside the EU, the the names or email of those individuals are viewable to others, the Short answer is Yes.

The longer detailed explanation can be found looking at the EU GDPR definition of Personally Identifiable Information it does note that an email or the users name will fall into one of the items covered by GDPR compliance if the email relates to the users actual name and is not anonymized

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.

Personal data that has been de-identified, encrypted or pseudonymised but can be used to re-identify a person remains personal data and falls within the scope of the GDPR.

Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.

The GDPR protects personal data regardless of the technology used for processing that data – it’s technology neutral and applies to both automated and manual processing, provided the data is organised in accordance with pre-defined criteria (for example alphabetical order). It also doesn’t matter how the data is stored – in an IT system, through video surveillance, or on paper; in all cases, personal data is subject to the protection requirements set out in the GDPR.


 I recomend checking out the Server & Data Center GDPR Support GuideServer & Data Center GDPR FAQ we have put together to help out in understanding how certain product features and functionality can support your GDPR compliance requirements.


Suggest an answer

Log in or Sign up to answer
AUG Leaders

Atlassian Community Events