Atlassian Cloud: Right to erasure

Still need help?

The Atlassian Community is here for you.

Ask the community

This page describes how to have your Atlassian account deleted after anonymizing your contributions and activity. Read on for more information about how to have your structured personal data removed from (and forgotten by) all Atlassian products and services you have used.

Under Article 17 of the GDPR, you have the right to have your personal data deleted. This is also known as the "right to be forgotten" or "right to erasure." It isn't an absolute right, and it only applies in certain circumstances and will vary on a case-by-case basis. These instructions show individual end-users and administrators how to remove personal data from certain Atlassian products. In some cases, you may need to consult your administrator to have certain personal data deleted.    

Personal data stored within the product can be divided into structured personal data and personal data in free-form text. Structured personal data is personal data that's entered into a profile or other data fields, that exists within the product for the sole purpose of identifying an individual throughout the product. Examples of structured personal data include your display name, profile picture or avatar, and email address. These data elements are generally visible from your profile and are used throughout the product to point back to your profile when you're @mentioned or tagged in certain spaces or content. Deleting structured personal data elements will automatically remove those data elements throughout the product where the relevant structured data elements appear and in the database (subject to some limitations discussed below).

If you or other end-users have included personal data in free-form text, either typed into content spaces or as a custom field label, you'll need to use the product's global search feature to surface this personal data and delete it on a case-by-case basis.

Your Atlassian account is what allows you to log in to various Atlassian Cloud products, including Jira, Confluence, Stride, and Bitbucket. It's also what you use to log in to Support and the Atlassian Community. Your structured personal data may be stored in multiple places, including your Atlassian account and your individual product profiles:

  • Your product profile stores personal data specific to the products you use within a site. If you have access to multiple sites with one or more Atlassian Cloud products, you may have more than one profile.
  • The third-party apps that may be installed for each Cloud product may also process or store your personal data in the third-party vendor's own databases. These apps and stored data are not managed by Atlassian.

The instructions below explain how you can remove your personal data for each of these components.

Before you begin

Note that you, your site admin, your organization admin, and Atlassian Support may all be involved in fulfilling your request for erasure: 

  • A site admin is responsible for G Suite managed accounts
  • An organization admin is responsible for SAML single sign-on and all other managed account except for G Suite managed accounts

Is your Atlassian account managed?

Before you begin, you should be clear about the following:

  • Whether your Atlassian account is managed by your company, and whether you log in using Google G Suite or SAML single sign-on.

    Click here to see how...

    You can tell how your Atlassian account is managed by logging in to your Atlassian account at id.atlassian.com. Click Account settings and look under your name.

    • If you see "Your account is managed by Google", your account is managed by a site admin, and you log in through Google G Suite using either your Google credentials or your Atlassian account credentials.
    • If you see "Your account is managed by your organization", your account is managed by an organization admin at your company, and you log in with your Atlassian account credentials.
    • If you see "Your account uses single sign-on", your account is managed by an organization admin at your company, and you log in with SAML single sign-on using a third-party identity provider such as Okta or Onelogin.
    • If you don't see any of the above you're account is unmanaged, and you log in with your Atlassian account credentials.
  • How to contact your site admin, if your Atlassian account is unmanaged, or you log in using Google.

    Click here to see how...

    When you raise the request with Atlassian Support in Step 1 below you can ask to be told the name and email address of your site admin, in case you don't have that anymore.

  • How to contact your organization admin, if your Atlassian account is managed by your company.

    Click here to see how...

    When you raise the request with Atlassian Support in Step 1 below you can ask to be told the name and email address of your organization admin, in case you don't have that anymore.

Step 1: Get a list of locations where Atlassian holds personal data about you 

The first step in exercising your right to erasure is to review the list of locations where Atlassian holds personal data about you. You can request this list by contacting Support (or in the case of managed users, requesting your organization admin to contact support). These locations can include Atlassian Cloud products and other Atlassian systems.

Please note that Atlassian Support will require the ticket to be raised from the account for which you are requesting the right to erasure, or in the case of managed users, from an organization admin who manages your domain. Atlassian Support will help find an organization admin if you don't know who that is.

Once you have received your list of personal data Atlassian systems hold about you and you decide to exercise your right to be forgotten, you can proceed with the next steps. We will at this stage require your confirmation that you wish to be forgotten from all Atlassian systems.

Exercising your right to erasure is an irreversible procedure. Once your accounts and your personal data have been deleted from our systems, they cannot be restored.

Step 2: Remove personal data in your Atlassian account and disconnect managed user

You should remove or obfuscate personal data in your Atlassian account. This needs to be done to prevent that information being re-synced with Atlassian Cloud product profiles later.

Bitbucket Cloud customers should complete the following procedure before you delete your Atlassian account.

  • If your Atlassian account is unmanaged, or is managed but you don't use Google G Suite or SAML single sign-on to log in, you should remove or change the Full name, Job titleOrganizationTimezone, and avatar in your Atlassian account yourself to pseudonyms of your choice.

    Click here to see how...

    To edit details of your Atlassian account, log in to id.atlassian.com and click Account settings.

    For more information on managing your Atlassian account details as a user, see Atlassian account for users.

  • If your Atlassian account is managed with Google G Suite, you should ask a site admin to change your Full name in G Suite to a pseudonym of your choice.   

    Click here to see how...
    1. The site admin should go to their G Suite settings and anonymize the user's name. See https://support.google.com/a/answer/182084?hl=en. They can then either wait for up to 4 hours for this to sync to Atlassian, or return to site administration and select to run a sync immediately, which will update the user's account.
    2. The site admin should remove the user from any groups that they're syncing to Atlassian from G Suite.

    For more information on G Suite sync, see Security with G Suite.

    You should remove or obfuscate the Job titleOrganizationTimezone, and avatar in your Atlassian account yourself.

  • If your Atlassian account is managed with SAML single sign-on, you should ask an organization admin to change your Full name to a pseudonym of your choice.

    Click here to see how...

    The organization admin should:

    1. Log in to admin.atlassian.com.
    2. Choose Managed accounts and search for your user account.
    3. Click Edit account for the account.
    4. Change the Name for the account to a pseudonym of your choice.

    For more information on managing the organization, see Organization administration.

    You should remove or obfuscate the Job titleOrganizationTimezone, and avatar in your Atlassian account yourself. 

Step 3: Remove personal data in your Atlassian Cloud product profiles

The changes to your Atlassian account personal data will synchronize, so that they're reflected in the Atlassian Cloud products you have access to. Next, you'll need to remove your personal data from the profiles you have for each of the Atlassian Cloud products you use, as well as any third-party apps you've installed with those products.

For Bitbucket, you can remove your product-specific personal data on your own. For Hipchat, you'll need to work with your group admin to remove your personal data. Your Jira, Confluence, and Stride profiles are tied to the site you use to access those products. If you have access to more than one Atlassian site, you'll need to work with a site admin to delete your personal data from your Jira, Confluence, and Stride profiles for each site that you wish to be forgotten from before they can delete your account from that site.

The guides below outline the process for deleting product-specific personal data from each product in the Atlassian Cloud suite:

Ask your site admin to delete you from your sites

If you have access to a site containing Jira, Confluence, or Stride, you'll need to ask the site admin to delete your access before Atlassian Support deletes your Atlassian account. If you use more than one Atlassian site, you'll need to contact the site admin for each site you use to have them delete your access.

Click here to see how (for site admins)...

Deleting a user from your site will remove their access to all Atlassian products available on the site. Don't delete the user until you've verified that they've removed their personal data from all the Atlassian products they wish to be forgotten from.

To delete a user from your site:

  1. Click in the bottom left and select Site administration.
  2. Enter the username of the person you wish to delete in the search box.
  3. Click on their name (which may be a pseudonym) to open the user record.
  4. Click the menu next to the Deactivate button in the top right, then choose Delete.

Request removal of remaining data for Jira and Confluence Cloud

Some personal data will still appear in product profiles and can only be removed by Atlassian Support:

  • Your email address
  • Your username
  • Your Confluence profile picture

In other words, your Jira Cloud user profile, which shows your email address, will still be accessible after your access to the site has been deleted. For Confluence Cloud, your email address, username, and Confluence profile picture may remain in the Atlassian Cloud database, even if your user profile is not visible anymore.

If you'd like to have this information removed from the Jira / Confluence product profiles, you should mention that in your support request you raised above as well.

Step 4: Removal of personal data from other Atlassian systems

Once Atlassian Support has confirmed that the steps above have been completed, they will go ahead and remove your personal data from the other Atlassian systems identified in Step 1, such as  jira.atlassian.com and Atlassian Community.

Step 5: Deletion of your Atlassian account

Finally, Atlassian Support will finalize this procedure by permanently deleting your Atlassian account. 


Last modified on May 25, 2018

Was this helpful?

Yes
No
Provide feedback about this article
Powered by Confluence and Scroll Viewport.