GDPR - Storing data on Trello.

Hi all,

Does anyone know what Trello's regulations are regarding storing data?

In short, we want to look at using Trello as a replacement on Excel, and be able to store bloggers details on here, but with the upcoming GDPR, we want to make sure that this is okay.

Reference: https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/getting-ready-for-the-gdpr/

Thank you for your help.

George

2 answers

0 votes

Hi George,

Marta here, from Trello Support.

We definitely want to make sure that you’re comfortable with our data policies. The most comprehensive overview of our security policies and procedures (covering things like how we back up our data, what servers we use, and how we encrypt information) can be found here: https://trello.com/trello-operations-and-security-guide.pdf

Though intended for our Business Class users, the info in that document which covers our overall data practices is applicable to all Trello users.

We’d recommend reviewing that file or passing it on to the person managing security policy for your company—typically, it’s a great starting point and often will answer all of the questions that users have about our security. 

Additionally, you can find our privacy policy at https://trello.com/privacy and our Terms of Service at https://trello.com/legal. They have more information about how Trello uses and doesn’t use your data.

I hope that helps!

Cheers,

Marta

Hi Marta,

 

I think you aren't quite understanding the question here. GDPR is a new data privacy regulation in effect in the EU. It requires that all data about EU citizens be stored on servers physically within the EU, and that it be possible to completely purge all user records if needed. 

I think that trello would need to offer an option for what datacenter to create a board in for instance.

This also means things like soft deletes and data backups are subject to extended requirements. 

It's not just company data policy, it's a regulatory level regulation with ultra-high penalties for non-compliance... 

Does trello know about this?

We are also need to know about Trello's GDPR compliance. We have Trello business class and use it across the company, and need to know if we can continue to use it after GDPR is in force in May. 

Hi Ryan, Siobhan,

Thanks for your reply and sorry for the confusion.

We are aware of GDPR and have a compliance plan to put in place ahead of the May '18 deadline, though we're not ready to share that yet. We will not be hosting data in the UK or EU at that time. At this point, all of our data is stored on Amazon's AWS Infrastructure in US regions. 

If you have further questions about this, don't hesitate to reach out to us at trello.com/contact.

Cheers,

Marta

Marta -

So, despite your comment "We are aware of GDPR and have a compliance plan to put in place ahead of the May '18 deadline", your comment "We will not be hosting data in the ... EU" makes it clear that Trello will NOT be GDPR compliant, so business users in the UK and EU will need to find a compliant alternative.  That's a shame, but at least we know.

 - Justin

Justin -

I came here looking for the Trello take on GDPR and found that they have no public plans yet, which is a bit disconcerting. However GDPR does allow for storage of data outside of EU as long as Standard Clauses or similar agreements are in place.

Thanks, Jens. I think the GDPR requires "informed consent" - I'm not sure a standard clause buttoned in a set of Ts&Cs (terms and conditions) would satisfy this.

 - Justin

That's part of it, but there is more, it's pretty complex. You have to have legal ground for storing and handling personal information. Consent is one legal ground, but there are others (such as legal obligations to store it, contractual reasons, business reasons or even the fuzzy "interest to store and handle outweighs the privacy interest of the individual").

In general however, Trello isn't the processor of the information you store on their Trello boards, you are, it's your information. They are sub-processors and are only storing it on your behalf. You are the entity needing a legal ground for storing and handling the information. You also need a sub-processing agreement with Trello with details of exactly what information they are storing on your behalf, why they are storing it and where they are storing it.

The last part, where the data is stored, is where the Standard Clauses (and Safe Harbor Agreements such as Privacy Shield) come in. Typically, EU doesn't allow personal data to leave the union, the exception being if the entity handling the data can guarantee that the data is as safe in the 3rd country as it would be in EU. The Pricvacy Shield between EU and the US is a blanket agreement that, together with Standard Clauses in the agreement between you and Trello (the Data Processing Agreement or DPA), guarantees this.

For this to be in effect, however, a DPA must be in effect and from what I can read from Marta's answer this is not ready yet, but will be before May 18th.

Hi Marta,

 

What is the plan of sharring the DPA? When do you think it's ready to show?

 

- Jonas

Hi Marta,

Things are really starting to speed up in our (EU) part of the world in this area since there's only a month away for the GDPR legislation to take full effect. According to our lawyers we cannot use Trello for our business anymore due to the fact that Atalassian have not been certified according to Privacy Shield (you need a valid certification). So in order to make use of Trello services after May 25th 2018 we need to put some special agreement in place. But I guess that wont be the solution you are aiming for, given the huge amount of Trello business users residing within EU borders. So what is the plan for managing this?

- Linda

Hi Linda,

Trello is privacy shield certified with Atlassian (Trello is listed in the other covered entities): https://www.privacyshield.gov/participant?id=a2zt00000004FK0AAM&status=Active

You can find out more about our GDPR compliance and commitment to data privacy here: https://help.trello.com/article/1118-trello-and-gdpr-our-commitment-to-data-privacy

If you require a DPA, reach out to our support team, they'll be happy to provide one.

Thanks! I appreciate the quick response :)

So if I use Trello with customers, are we both, my company and the customers' company, GDPR compliant in using Trello? Or do I need to shut down all my Trello boards by May 25? 

Hi Torben,

Can you please provide us your DPO? According to the GDPR you are an organization that is transferring a large amount of data that contains personal data as well. In that case, you are obligated to have a DPO also know as Data Protection Officer. 

Kindly provide in your online documentation the DPO.

Hi Torben,

thanks for all the documents that you are sharing.

Can you provide us also information about how Trello is maximizing it's effort to secure access to the boards on the internet?

Kind regards,

Wouter

0 votes

Hi,

I believe that there are two components to this question.

1) Trello acting as a Data Controller for data e.g. my login data to the platform

2) Trello acting as a Data Processor for my company (as the Data Controller) where I am at risk of processing Personal Data by how I use the platform and data entered or uploaded.

Trellos's responsibility here is to ensure suitable Info security etc but what I put into the platform, access to it and how its used is mine.

One thing I noted is that the Privacy Shield link above and in the privacy policy is that the link at time of posting is incorrect.

It should be https://www.privacyshield.gov/participant?id=a2zt00000008RdQAAU&status=Active 

Cheers

Stef

  

 

    

Suggest an answer

Log in or Sign up to answer
Community showcase
Published Sep 11, 2018 in Trello

There’s a Power-up for That!

So you’re using Trello at work, at home and to track your new DIY crafts. The family and co-workers are all on board and everything is organized, color coded and has a due date. But still, there’s so...

616 views 2 5
Read article

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you