Data Protection Toolkit: GDPR, PII & DLP for Confluence

Data Protection Toolkit is an Atlassian Marketplace app that finds, redacts and anonymizes personal data inside Confluence, on both Atlassian Cloud and Data Center. It scans pages, blog posts, comments, tables, page history and attachments against a built-in library of 62 detection patterns covering 27 countries, or against your own regular expressions, then redacts, replaces or anonymizes what it finds, in bulk and on a schedule. It also handles user and space anonymization for right-to-erasure and data subject access requests, and includes consent forms with acceptance tracking so you can prove consent rather than assume it.

Formerly known as Data Protection and Security Toolkit for Confluence, and previously as GDPR (DSGVO) and Security for Confluence. Published on the Atlassian Marketplace by Actonic Products GmbH.

It is built for the people who are accountable when personal data turns up somewhere it should not be: Data Protection Officers, IT security managers, compliance teams and Confluence administrators. Confluence is a common blind spot because personal data arrives informally, in meeting notes, HR and onboarding spaces, customer tables, and CVs or contracts attached to a page, and it stays in page history after the page itself is cleaned. It works on a single space and on enterprise-scale instances.

Free on Atlassian Cloud for up to 10 users. Above that it is priced per user: USD 100 per month for 100 users and USD 395 for 500. Confluence Data Center is an annual subscription starting at the 500-user tier. Every module is included at every tier, there is no feature-gated edition. See the full pricing breakdown.

GDPR applies to any organisation that processes the personal data of people in the EU, whether or not it has an establishment there. Confluence is usually in scope because it accumulates personal data quietly: meeting notes with attendee names, HR and onboarding spaces, customer lists in tables, CVs and contracts as attachments. The obligations that bite are the right to erasure and being able to demonstrate you carried it out, including in page history. For the wider picture, see our orientation guide to data privacy laws worldwide.

The California Consumer Privacy Act, in force since 1 January 2020 and expanded by the CPRA, covers for-profit businesses handling the personal information of California residents above set revenue or volume thresholds. For Confluence the hard part is disclosure: answering what personal information you hold about one person means searching every space, including personal spaces and archived content, not just the ones you remember. Compare CCPA with the other major privacy laws.

HIPAA covers US healthcare providers, health plans, clearing houses and the business associates that process protected health information on their behalf. Confluence pages documenting clinical processes, incident write-ups or anything carrying patient identifiers in a table or an attached file count as PHI, and need restricted access, detection of anything that lands in the clear, and removal on request. See how HIPAA sits alongside GDPR and CCPA.

The Server and Data Center versions are identical. However, only a few modules are implemented in the Cloud version due to the limitations of the Cloud API.

The Jira and Confluence versions are similar, all modules are the same, but new features appear first in the Jira version and then in the Confluence version. Want to make sure your Confluence Cloud version is data privacy compliant? Then feel free to contact our Data Protection compliance service.

No. The app allows you to automate common data protection tasks, such as obtaining consent, anonymizing personal data, or investigating security breaches.

We advise you to consult your legal team about the data security requirements in your specific situation, refine the processes and then configure the app to automate most of your activities and cover all your needs.

We are happy to help you with the configuration, just contact us!

Sure! Just take a look at our Data Protection Toolkit for Jira.

Confluence’s own anonymization changes the user account, not the content. The person’s name stays in page titles and bodies, in comments, in mentions that have been rendered as plain text, in tables, in blog posts and in page history, and it does not touch attachments at all. The Data Cleaner module finds those remaining instances by pattern, anonymizes users who were already deactivated, and logs what it changed so you can evidence that the request was completed.

Yes. Every question a security or procurement review normally asks is answered on our security and technical FAQ: what data the app accesses, what it stores and does not store, tenant isolation, encryption, security testing cadence, incident contact, browser support and licence tiering. The short version: on Cloud, scanning happens in the user’s browser and no personal data is stored by us. Actonic Products GmbH is ISO 27001 certified. Note that the app does not currently support Atlassian data residency.

No personal data is stored or passed on to third parties in our Cloud apps. We keep only meta and configuration data under an anonymized user ID. The apps fetch all relevant data from the Cloud and calculate all data directly in the user’s browser.

For more information, please refer to our Privacy Policy.

Both versions of Data Protection Toolkit (Jira and Confluence) are available over SSL only. We use a valid (not a self-signed) browser-trusted certificate without any human intervention. All the communications between “Client ↔︎ Jira (or Confluence) application ↔︎ Our app” are encrypted.

 As a part of our internal audit process, once per quarter.