Bamboo: Right to rectification
Under Article 16 of the GDPR, you have the right to have inaccurate personal data rectified. The GDPR requires that you take reasonable steps to rectify the individual's personal data where requested. An example of such a request may be an individual requesting their display name be updated to reflect a name change. Whether or not modifying personal data stored within the product is within the scope of reasonable steps required to honor the individual's request will vary on a case-by-case basis, and is determination you should always make with the assistance of legal counsel. Once you have determined you have an obligation to rectify personal data, we have provided the following instructions on how to do so within certain Atlassian products.
Personal data stored within the product can be divided into one of two areas: 1) account-level personal data; and 2) free-form text. Account-level personal data are data fields that exist within the product for the sole purpose of identifying an individual throughout the product. Examples of account-level personal data include the user's display name, profile picture or avatar and email address. These data elements are generally visible from the user's profile and are used throughout the product to point back to the user's profile when the user is @mentioned or tagged on in certain spaces or content. Changing account-level personal data elements will automatically populate that change throughout the product where the relevant account-level data elements appear.
If you have included personal data in free-form text, either typed into content spaces or as a custom field label, you will need to use the product's global search feature to surface this personal data and recitfy it on a case-by-case basis.
Description
Users can view and edit their personal data through the Bamboo user interface, subject to limitations of product configurations set by the administrator.
Version compatibility
All workarounds are compatible with Bamboo 6.5 and later.
Workaround
Personal data in "structured" data
User profile data in an Internal Directory
Each individual can view and edit their personal data where Bamboo users are managed and stored within an Internal Directory. Read Managing your user profile for information on how to do this.
A user profile can also be edited by Bamboo administrators. Read Bamboo: Right to Erasure for information on how to do this
Update data in user profile - external user directory
Bamboo can be integrated with an external directory (LDAP/Crowd/Active directory) and users can be fetched from there. That integration is in read-only mode so Bamboo users can only view their personal data from their user profile page. To modify this information, you will need to contact the administrator.
Limitations
- a username can be changed only by the administrator
Personal data in "free-text" data fields
Bamboo can store free-text data in various locations like plans, results, deployment projects, releases and entities associated with them. Personal data can also be stored in the descriptions of globally available entities (for example project descriptions, variables, repositories, shared credentials, other configuration).
Limitations
There is personal data stored in places within Bamboo that cannot be modified.
Application logs
Bamboo server stores information in log files, which is useful in case of an error or a problem occurs at the application level.
Any personal data stored in the logs cannot be modified. Read more in Bamboo: Right to Erasure
Agent logs
Bamboo agents store information in log files, which is useful in case of an error or a problem occurs at the agent level.
Any personal data stored in the logs cannot be modified. Read more in Bamboo: Right to Erasure
Artifacts
Bamboo results may generate artifacts that can contain personal data. You can read more about this in the guide: Bamboo: Right to Erasure
Backups
Administrators can create backups of all data stored in Bamboo (including personal data) and this can be used to restore Bamboo on another instance. This data is non-modifiable because the significant effort would have to be made to unpack archive and update/remove all data in the exported XML files.
- To learn more, read Backing up data
Additional notes
There may be limitations based on your product version.
Note, the above-related GDPR workaround has been optimized for the latest version of this product. If you are running on a legacy version of the product, the efficacy of the workaround may be limited. Please consider upgrading to the latest product version to optimize the workarounds available under this article.
Third-party add-ons may store personal data in their own database tables or on the filesystem.
The above article in support of your GDPR compliance efforts applies only to personal data stored within the Atlassian server and data center products. To the extent you have installed third-party add-ons within your server or data center environment, you will need to contact that third-party add-on provider to understand what personal data from your server or data center environment they may access, transfer or otherwise process and how they will support your GDPR compliance efforts.
If you are a server or data center customer, Atlassian does not access, store, or otherwise process the personal data you choose to store within the products. For information about personal data Atlassian processes, see our Privacy Policy.