Data Transfer Impact Assessment
Last updated on: December 7, 2023
Einführung
This Data Transfer Impact Assessment (“DTIA”) assists Atlassian customers and Forge developers in conducting a risk assessment for the transfer of personal data in connection with Atlassian’s provision of its services (including cloud products and Forge platform). This DTIA addresses the processing (including transfer) of such personal data by Atlassian, its affiliates and sub-processors in light of the “Schrems II” ruling of the Court of Justice for the European Union and the recommendations from the European Data Protection Board. It provides information necessary to comply with personal data transfer rules under European data protection law.
Under the European data protection laws, personal data may not be transferred outside of Europe unless (i) the importing country has been deemed adequate by the relevant governmental body; or (ii) the data exporter has appropriate safeguards in place to ensure that personal data transferred is subject to an adequate level of protection. Those safeguards are referred to as “transfer mechanisms.” The information below details the transfers and transfer mechanisms applicable to Atlassian customers.
Scope of the Data Transfer Impact Assessment
Please note, that the processing locations depend on which Cloud Products you as a customer may have purchased, e.g. if you have purchased Jira Align, the relevant sub-processors and processing locations may be different (as listed under our sub-processor page) from the sub-processors and locations applicable for Trello, or Confluence. Additionally, you may also configure data residency for certain data in those Cloud Products which could further reduce the scope of transfers indicated on this page. Therefore, please review the sub-processor page and the data residency page in connection with the Cloud Products you have purchased in order to draw relevant information from this document.
The Atlassian DTIA covers direct and onward data transfers in connection with Atlassian’s provision of the services.
Atlassian transfers personal data out of the EEA, UK, and Switzerland (together, "Europe") to both countries holding adequacy status under the European data protection law and countries without adequacy decisions, as outlined below.
Europe/EEA and Adequate Countries | Bulgaria, Canada, France, Germany, Ireland, Japan, New Zealand, Netherlands, Poland, Sweden, United Kingdom, United States (only for commercial organizations participating in the Data Privacy Framework) |
---|---|
Countries without Adequacy Decisions | Australia, Brazil, India, Mexico, Philippines, Singapore, Turkey |
Where adequacy does not apply, we continue to rely on the Standard Contractual Clauses (SCCs) as a transfer mechanism, see contractual measures below for more details.
Please note that the scope of your transfer may be limited depending on 1) which services you use, e.g. Jira Align sub-processors and applicable locations may differ from those for Confluence, and 2) whether you configure data residency in those services. Please review the sub-processor page and the data residency page in connection with the services you use in order to draw the relevant information from this document.
Our analysis of transfers to the United States and countries without adequacy decisions is described below for the services.
Australien
Step 2: Identify the transfer tool relied upon
Purpose for transfer and any further processing | Direct transfers: Atlassian has offices in Australia where our employees may access personal data for the purposes of the provision of Services and Forge Platform. Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. Atlassian also offers data residency in accordance with this page. |
---|---|
The frequency of the transfer | Direct transfers: Continuous. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: As detailed in Atlassian DPA and Forge DPA respectively. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: Determined at the sole discretion of the data exporter. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page. |
Applicable transfer mechanism
| Direct transfers: Standard Contractual Clauses between Atlassian and its customers, or Forge developers, respectively. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | Australia has various laws, legislation and executive powers that could be used to compel companies to disclose personal data, or that provides for investigation and enforcement agencies to obtain data where there is a suspected contravention. A high-level summary of several of the key laws is provided below:
For aspects of each of the above laws, there are potential extra-territorial powers that could theoretically compel those outside of Australia to assist in the investigative process. However, in practice, it is highly unlikely that law enforcement and surveillance authorities will be able to do so without operating through existing bilateral processes, such as mutual legal assistance treaties. In practice, it can be difficult to determine how governmental authorities use all of their powers to conduct surveillance and collect data (and therefore whether it involves unnecessary or disproportionate data access in any circumstances) because in several cases, government authorities are not required to publicly report on when and how they use these powers (although independent oversight and review, including reporting to independent statutory authorities, is embedded throughout the surveillance legislation framework). In addition, not all requests for access to data and surveillance are currently subject to prior independent judicial authorization, although a process for review and reform of Australia’s surveillance laws has commenced and this may change in the future. Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
Brazil
Purpose for transfer and any further processing | Direct transfers: Not applicable. Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. |
---|---|
The frequency of the transfer | Direct transfers: Not applicable. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: Not applicable. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: Not applicable. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Applicable transfer mechanism
| Direct transfers: Not applicable. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | The Brazilian government can only access/intercept personal data for certain specified purposes including, but not limited to, criminal law enforcement and surveillance, as further described below, and after authorization of a court. A high-level summary of the key laws is provided below:
The Brazilian General Data Protection Law ("LGPD") is mostly aligned with the GDPR, therefore it provides a similar level of protection, but it does not apply to national security or criminal matters. However, the country has not yet been evaluated in order to obtain an adequacy decision from the European Data Protection Board. Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
Indien
Purpose for transfer and any further processing | Direct transfers: Not applicable. Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. |
---|---|
The frequency of the transfer | Direct transfers: Not applicable. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: Not applicable. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: Not applicable. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Applicable transfer mechanism
| Direct transfers: Not applicable. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | India has various surveillance, criminal, and security laws which allow government agencies to intercept and access "personal information" and "sensitive personal data or information" without obtaining their prior consent if relevant factors apply. A high-level summary of the key laws is provided below. Note that these laws are often applied together, so criminal laws cannot be distinguished from surveillance specific laws.
Since the scope of the surveillance and interception powers of Indian authorities extends to investigations carried out in respect of any persons, companies, and entities operating within India (including those doing business in India from offshore), any data recipient is potentially within the scope of such criminal law enforcement and shall be obligated to share data available with it if called upon by a government authority. The CrPC applies to the territory of India and accordingly, an offshore entity is not under an obligation to comply with the request, however, if the offshore entity has a presence in India, the CrPC would extend to such operations within India. Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
Mexiko
Purpose for transfer and any further processing | Direct transfers: Not applicable. Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. |
---|---|
The frequency of the transfer | Direct transfers: Not applicable. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: Not applicable. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: Not applicable. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Applicable transfer mechanism
| Direct transfers: Not applicable. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | Private entities that are obligated to comply with the Protection of Personal Data held by Private Parties ('LFPDPPP') legislation must process data in some manner in connection with Mexico and therefore have to respond to demands by Mexican authorities to disclose those personal data (assuming the demand is otherwise lawful). Atlassian is potentially within the scope of the importing territory's governmental security and surveillance powers if the data importer obtains personal data that falls under the definition of “data processing” in the LFPDPPP. Under Mexican Data Protection Laws, the transfer of data turns the receiver into a data controller. The scope of application of LFPDPPP and its Regulations is when the processing:
Mexican Authorities will argue that the data importer has the data and they may exercise their powers. Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
Philippines
Purpose for transfer and any further processing | Direct transfers: Not applicable. Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. |
---|---|
The frequency of the transfer | Direct transfers: Not applicable. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: Not applicable. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: Not applicable. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Applicable transfer mechanism
| Direct transfers: Not applicable. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | The Philippines has enacted specific laws that enable law enforcement authorities and military personnel to obtain access to data, including personal data being processed in the Philippines and held by private organizations. In addition, the powers of government authorities enable them to request / access data stored in Europe but which are accessed by individuals located in the Philippines, as long as the person or entity sought to be enjoined is subject to the jurisdiction of the Philippine government. A high-level summary of the key laws is provided below:
Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
Singapur
Purpose for transfer and any further processing | Direct transfers: Not applicable. Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. |
---|---|
The frequency of the transfer | Direct transfers: Not applicable. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: Not applicable. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: Not applicable. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Applicable transfer mechanism
| Direct transfers: Not applicable. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | Singapore has enacted laws that enable the government to obtain access to data, including personal data being processed in Singapore. A high-level summary of the key laws relevant in Singapore is provided below:
Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
Singapur
Purpose for transfer and any further processing | Direct transfers: Not applicable. Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. |
---|---|
The frequency of the transfer | Direct transfers: Not applicable. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: Not applicable. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: Not applicable. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Applicable transfer mechanism
| Direct transfers: Not applicable. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | Singapore has enacted laws that enable the government to obtain access to data, including personal data being processed in Singapore. A high-level summary of the key laws relevant in Singapore is provided below:
Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
Türkei
Purpose for transfer and any further processing | Direct transfers: Not applicable. Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. |
---|---|
The frequency of the transfer | Direct transfers: Not applicable. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: Not applicable. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: Not applicable. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Applicable transfer mechanism
| Direct transfers: Not applicable. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | A high-level summary of the key laws relevant in Turkey is provided below:
Extraterritorial effect: the governmental or state authorities’ powers to request documents from organizations are not limited to information located in Turkey (if servers are located in Europe). The same principle applies to tapping into the communication of individuals by judicial decision. In a two-ended conversation, if one of the persons is located in Europe or is a European citizen, the National Intelligence Organisation will still be able to collect the necessary information. Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
United States*
Purpose for transfer and any further processing | Direct transfers: Atlassian has offices in the United States where our employees may access personal data for the purposes of the provision of Services and Forge. Onward transfers: Atlassian transfers personal data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. |
---|---|
The frequency of the transfer | Direct transfers: Continuous. Onward transfers: Continuous. |
Categories of personal data transferred | Direct transfers: As detailed in Atlassian DPA and Forge DPA respectively. Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Sensitive data transferred (if applicable) | Direct transfers: None. Onward transfers: Determined at the sole discretion of the data exporter. |
Length of processing chain
| Onward transfers: Please refer to Atlassian's sub-processor page for more information. |
Applicable transfer mechanism
| Direct transfers: Atlassian’s DPF Certification for the contractual relationship between Atlassian and its customers, or Forge developers, respectively. Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws. |
Identifying laws and practices relevant in light of all circumstances of the transfer | The following US laws were identified by the Court of Justice of the European Union in Schrems II as being potential obstacles to ensuring essentially equivalent protection for personal data in the US:
Further information about these U.S. surveillance laws can be found in the U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S.Data Transfers after Schrems II whitepaper from September 2020. As for the CLOUD Act, please refer to What is the CLOUD Act? by BSA Software Alliance outlining the scope of the CLOUD Act. With the Data Privacy Framework, Europe introduced the adequacy framework for US companies that self-certify under the DPF. An essential element of the adequacy decision was the updated US legal framework, e.g. Executive Order on “Enhancing Safeguards for United States Signals Intelligence Activities”, which was signed by President Biden on 7 October and is accompanied by regulations adopted by the Attorney General. These instruments were adopted to address the issues raised by the Court of Justice in its Schrems II judgment. For Europeans whose personal data is transferred to the US, the Executive Order provides for:
Atlassian US, Inc. and its US affiliates participate in and certify compliance with the Data Privacy Framework Principles. Our US entities are now able to rely on the adequacy decision to receive EU personal data. You can find more information in our Privacy Notice under the Section “Data Privacy Framework Notice.” Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data. |
Supplemental Measures
In order to protect personal data in accordance with Applicable Data Protection Laws, Atlassian implements the following supplemental technical, contractual, and organizational measures:
Technical Measures | Atlassian provides the following technical measures to provide additional security for personal data:
|
---|---|
Contractual Measures | Atlassian’s contractual measures are set out in our Data Processing Addendum which incorporates the SCCs, as well as UK Addendum and Swiss modifications for SCCs. In particular, we are subject to the following requirements:
|
Organizational Measures | Atlassian’s organizational measures to secure data include:
|
Re-evaluating at appropriate intervals
Atlassian will review and, if necessary, reconsider the risks involved and the measures it has implemented to address changing data privacy regulations and risk environments associated with transfers of personal data outside of Europe.
Legal Notice: Customers and Forge developers are responsible for making their own independent assessment of the information in this document. This document: (a) is for informational purposes only, (b) represents current Atlassian product offerings, services, and practices, which are subject to change without notice, and (c) does not create any commitments or assurances from Atlassian and its affiliates, suppliers, or licensors. The responsibilities and liabilities of Atlassian to its customers are controlled by Atlassian agreements, and this document is not part of, nor does it modify, any agreement between Atlassian and its customers, or Atlassian and Forge developers.
Zugehörige Inhalte
Stay informed
Subscribe to receive notifications from us about updates to our legal terms (including our legal policies) and our list of sub-processors.