Data Protection Toolkit: GDPR, PII & DLP for Jira

Data Protection Toolkit is an Atlassian Marketplace app that finds, redacts and anonymizes personal data inside Jira, on both Atlassian Cloud and Data Center. It scans issue summaries and descriptions, comments, custom fields, attachments and issue history against a built-in library of 62 detection patterns covering 27 countries, or against your own regular expressions, then redacts, replaces or anonymizes what it finds, in bulk and on a schedule. It also handles user and project anonymization for right-to-erasure and data subject access requests, and includes consent forms with acceptance tracking so you can prove consent rather than assume it.

Formerly known as Data Protection and Security Toolkit for Jira, and previously as GDPR (DSGVO) and Security for Jira. Published on the Atlassian Marketplace by Actonic Products GmbH.

It is built for the people who are accountable when personal data turns up somewhere it should not be: Data Protection Officers, IT security managers, compliance teams and Jira administrators. The common trigger is a right-to-erasure or data subject access request that cannot be answered by deactivating an account, because the person is named in issues, comments, custom fields and attachments as well. It works on a single project and on enterprise-scale instances.

Free on Atlassian Cloud for up to 10 users. Above that it is priced per user: USD 120 per month for 100 users, USD 420 for 500, falling to about USD 0.72 per user at 1,000. Jira Data Center is an annual subscription from USD 1,300 for up to 50 users. Every module is included at every tier, there is no feature-gated edition. See the full pricing breakdown.

GDPR applies to any organisation that processes the personal data of people in the EU, whether or not it has an establishment there. If your Jira holds customer names, reporter email addresses, ticket contents from EU users or employee records, it is in scope. The practical Jira consequences are the right to erasure, which means finding and removing that data from issues, comments, custom fields, attachments and issue history, and being able to show that you did it. For the wider picture, see our orientation guide to data privacy laws worldwide.

The California Consumer Privacy Act, in force since 1 January 2020 and expanded by the CPRA, covers for-profit businesses handling the personal information of California residents above set revenue or volume thresholds. In Jira terms it produces deletion and disclosure requests with a response deadline, which means you need to search a whole instance for one person’s data rather than guess which projects it sits in. Compare CCPA with the other major privacy laws.

HIPAA covers US healthcare providers, health plans, clearing houses and the business associates that process protected health information on their behalf. If a Jira Service Management project takes patient-related requests, that content is PHI and needs the same treatment as any other clinical system: restricted access, detection of anything that lands in the clear, and removal on request. See how HIPAA sits alongside GDPR and CCPA.

The Server and Data Center versions are identical. However, only a few modules are implemented in the Cloud version due to the limitations of the Cloud API.

The Jira and Confluence versions are similar, all modules are the same, but new features appear first in the Jira version and then in the Confluence version. Want to make sure your Jira Cloud version is data privacy compliant? Then feel free to contact our Data Protection compliance service.

No. The app allows you to automate common data protection tasks, such as obtaining consent, anonymizing personal data, or investigating security breaches.

We advise you to consult your legal team about the data security requirements in your specific situation, refine the processes and then configure the app to automate most of your activities and cover all your needs.

We are happy to help you with the configuration, just contact us!

Sure! Just take a look at our Data Protection Toolkit for Confluence.

Jira’s own anonymization changes the user account, not the content. The person’s name stays in issue summaries and descriptions, in comments, in mentions that have been rendered as plain text, in custom fields and in issue history, and it does not touch attachments at all. The Data Cleaner module finds those remaining instances by pattern, anonymizes users who were already deactivated, and logs what it changed so you can evidence that the request was completed.

Yes. Every question a security or procurement review normally asks is answered on our security and technical FAQ: what data the app accesses, what it stores and does not store, tenant isolation, encryption, security testing cadence, incident contact, browser support and licence tiering. The short version: on Cloud, scanning happens in the user’s browser and no personal data is stored by us. Actonic Products GmbH is ISO 27001 certified. Note that the app does not currently support Atlassian data residency.

No personal data is stored or passed on to third parties in our Cloud apps. We keep only meta and configuration data under an anonymized user ID. The apps fetch all relevant data from the Cloud and calculate all data directly in the user’s browser.

For more information, please refer to our Privacy Policy.

Both versions of Data Protection Toolkit (Jira and Confluence) are available over SSL only. We use a valid (not a self-signed) browser-trusted certificate without any human intervention. All the communications between “Client ↔︎ Jira (or Confluence) application ↔︎ Our app” are encrypted.

 As a part of our internal audit process, once per quarter.