GDPR delete personal data

[Robert Talbot]

We are evaluating the use of JIRA Service Management, in combination with Atlassian Access, for enquiries in our university library.

For GDPR purposes a requirement is that personal data, and enquiries, be deleted after a predefined period. For example, enquiries more than 2 years old are deleted. Users registered for more than 4 years are deleted (most students are on 3 year degrees).

I've looked through the documentation and I can't find how to do this, i.e. automatically delete enquiries or users after a predefined period. Any advice will be gratefully received.

[Jack Brickey · Accepted solution]

You could leverage Automation for the issue piece. A rule could run daily and search for issues and then they could be removed. The users is more of a manual action, at least OOTB. However, I don’t use Access so maybe there is something there that would allow you to achieve your goal. If not there are addons that might be able to assist with managing your users and would suggest looking at the Marketplace.

[Robert Talbot]

Thanks I've looked into your two suggestions and found solutions. I can create an automation rule that runs periodically  using JQL to search for issues more than 730 days old, then delete them. In case anyone else comes across this the JQL is 

created <= -730d

 I found the BulkOps app in the market place which should deal with bulk user deletion.

[Jack Brickey]

Would you not want to only delete issues that were closed by adding ...AND statuscategory != done? TBH I don’t understand how this addresses GDPR and IMO deleting issues is a bad idea altogether but then I don’t live in your world 😜

[Robert Talbot]

We need to satisfy Principle (e): Storage limitation.

Basically the principle is don't store personal data longer than you need it. In practice library enquiries are closed within a few weeks anyway.

[Jack Brickey]

thanks for sharing Robert. That is interesting. Given Atlassian is GDPR compliant I would like to get their perspective on this. If this is a requirement I would think they would build in easy methods (configuration) to take care of this.