Data Transfer Impact Assessment

Countries without Adequacy Decisions

Direct transfers: Atlassian has offices in Australia where our employees may access personal data for the purposes of the provision of Services and Forge Platform.

Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. Atlassian also offers data residency in accordance with this page.

The frequency of  the transfer

Direct transfers: Continuous.

Onward transfers: Continuous.

Categories of personal data transferred

Direct transfers: As detailed in Atlassian DPA and Forge DPA respectively.

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Sensitive data transferred (if applicable)

Direct transfers: Determined at the sole discretion of the data exporter.

Onward transfers: Determined at the sole discretion of the data exporter.

Length of processing  chain

Onward transfers: Please refer to Atlassian's sub-processor page.

Applicable transfer mechanism

Direct transfers: Standard Contractual Clauses between Atlassian and its customers, or Forge developers, respectively.

Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws.

Identifying laws and practices relevant in light of all circumstances of the transfer

Australia has various laws, legislation and executive powers that could be used to compel companies to disclose personal data, or that provides for investigation and enforcement agencies to obtain data where there is a suspected contravention. A high-level summary of several of the key laws is provided below:

• Crimes Act 1914 (Cth) and the Criminal Code Act 1995 (Cth), which permits government agencies to collect both electronic and physical data where there are reasonable grounds to believe there is a criminal offense.

• Surveillance Devices Act 2004 (Cth) and equivalent state and territory laws that grant authorities covert access to electronic and physical data.

• Telecommunications (Interception and Access) Act 1979 (Cth) and Part 15 of the Telecommunications Act 1997 (Cth) grants government bodies powers to oblige telecommunications carriers, carriage service providers, and other communications providers to assist law enforcement and intelligence agencies.

For aspects of each of the above laws, there are potential extra-territorial powers that could theoretically compel those outside of Australia to assist in the investigative process. However, in practice, it is highly unlikely that law enforcement and surveillance authorities will be able to do so without operating through existing bilateral processes, such as mutual legal assistance treaties. In practice, it can be difficult to determine how governmental authorities use all of their powers to conduct surveillance and collect data (and therefore whether it involves unnecessary or disproportionate data access in any circumstances) because in several cases, government authorities are not required to publicly report on when and how they use these powers (although independent oversight and review, including reporting to independent statutory authorities, is embedded throughout the surveillance legislation framework). In addition, not all requests for access to data and surveillance are currently subject to prior independent judicial authorization, although a process for review and reform of Australia’s surveillance laws has commenced and this may change in the future.

Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data.

Direct transfers: Not applicable.

Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. 

The frequency of  the transfer

Direct transfers: Not applicable.

Onward transfers: Continuous.

Categories of personal data transferred

Direct transfers: Not applicable.

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Sensitive data transferred (if applicable)

Direct transfers: Not applicable.

Onward transfers: Determined at the sole discretion of the data exporter.

Length of processing  chain

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Applicable transfer mechanism

Direct transfers: Not applicable.

Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws.

Identifying laws and practices relevant in light of all circumstances of the transfer

The Brazilian government can only access/intercept personal data for certain specified purposes including, but not limited to, criminal law enforcement and surveillance, as further described below, and after authorization of a court. 

A high-level summary of the key laws is provided below:

• Wiretapping and Information Systems Surveillance Law - allows interception of Brazilian telephone lines and information systems. All interception must be approved through court order and not be longer than 15 days. 

• Brazilian Intelligence Agency (Agência Brasileira de Inteligência - ABIN) - establishes that ABIN can only request data from other government agencies/authorities which are part of the Brazilian System of Intelligence. 

• The Brazilian Internet Civil Rights Framework (Law No 12,965) – establishes a) where a non-Brazilian company has a data center in Brazil, the Brazilian law applies, b) requires internet connection and application providers to keep connection and access logs (IP, date and time of use) for 12 months (internet connection) and 6 months (application access) and c) if a company violates the Brazilian Internet Civil Rights Framework sanctions may apply such as warnings, fines, suspension and prohibition.

• Encryption - The Federal Supreme Court has on hold two trials that may decide if a court can apply sanctions for noncompliance with a court order to reverse/access encrypted data.

The Brazilian General Data Protection Law ("LGPD") is mostly aligned with the GDPR, therefore it provides a similar level of protection, but it does not apply to national security or criminal matters. However, the country has not yet been evaluated in order to obtain an adequacy decision from the European Data Protection Board.

Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data.

Direct transfers: Not applicable.

Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. 

The frequency of  the transfer

Direct transfers: Not applicable.

Onward transfers: Continuous.

Categories of personal data transferred

Direct transfers: Not applicable.

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Sensitive data transferred (if applicable)

Direct transfers: Not applicable.

Onward transfers: Determined at the sole discretion of the data exporter.

Length of processing  chain

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Applicable transfer mechanism

Direct transfers: Not applicable.

Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws.

Identifying laws and practices relevant in light of all circumstances of the transfer

India has various surveillance, criminal, and security laws which allow government agencies to intercept and access "personal information" and "sensitive personal data or information" without obtaining their prior consent if relevant factors apply.

A high-level summary of the key laws is provided below. Note that these laws are often applied together, so criminal laws cannot be distinguished from surveillance specific laws.

• Information Technology Act, 2000 - empowers government agencies to intercept any information generated, transmitted, received, or stored in any computer resource. This can be in the interest of the sovereignty, integrity of India, security, and defense of India, etc. A subsection of the act grants the central government power to authorize any government agency to monitor and collect traffic data to enhance cybersecurity, identification, analysis, and prevention of intrusion or spread of a computer containment. 

• Indian Telegraph Act, 1885 - confers upon the Indian government the right to conduct surveillance over telegraph lines but only upon the occurrence of a public emergency or the interest of public safety.

• Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (SPDI Rules) - sensitive personal data or information may be shared without obtaining the prior consent of the data subject with a government agency if such activity is mandated under law for verification of identity, prevention, detection and investigation purposes, including cyber incidents, prosecution and punishment of offenses. 

• Criminal Laws and Code of Criminal Procedure, 1973 (CrPC) - grants courts and investigating officers, by way of a written order,  to require any person in whose possession or power a document or thing lies to produce the same where necessary or desirable for the purposes of an investigation, inquiry, trial or other proceedings. 

Since the scope of the surveillance and interception powers of Indian authorities extends to investigations carried out in respect of any persons, companies, and entities operating within India (including those doing business in India from offshore), any data recipient is potentially within the scope of such criminal law enforcement and shall be obligated to share data available with it if called upon by a government authority. The CrPC applies to the territory of India and accordingly, an offshore entity is not under an obligation to comply with the request, however, if the offshore entity has a presence in India, the CrPC would extend to such operations within India.

Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data.

Direct transfers: Not applicable.

Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. 

The frequency of  the transfer

Direct transfers: Not applicable.

Onward transfers: Continuous.

Categories of personal data transferred

Direct transfers: Not applicable.

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Sensitive data transferred (if applicable)

Direct transfers: Not applicable.

Onward transfers: Determined at the sole discretion of the data exporter.

Length of processing  chain

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Applicable transfer mechanism

Direct transfers: Not applicable.

Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws.

Identifying laws and practices relevant in light of all circumstances of the transfer

Private entities that are obligated to comply with the Protection of Personal Data held by Private Parties ('LFPDPPP') legislation must process data in some manner in connection with Mexico and therefore have to respond to demands by Mexican authorities to disclose those personal data (assuming the demand is otherwise lawful). 

Atlassian is potentially within the scope of the importing territory's governmental security and surveillance powers if the data importer obtains personal data that falls under the definition of “data processing” in the LFPDPPP. Under Mexican Data Protection Laws, the transfer of data turns the receiver into a data controller. The scope of application of LFPDPPP and its Regulations is when the processing:

1. is carried out in an establishment of the data controller located in Mexico; 
2. is carried out by a data processor, regardless of its location, on behalf of a data controller established in Mexico; 
3. the data controller is not established in Mexico but is subject to Mexican laws as a consequence of entering into a contract that is governed by Mexican law or to which Mexican jurisdiction extends under international law; or 
4. the data controller is not established in Mexico but uses equipment/media located in Mexico, unless such media are used only for transit purposes that do not involve processing. For this case, the data controller shall provide the media necessary to comply with the obligations imposed by the referred laws.

Mexican Authorities will argue that the data importer has the data and they may exercise their powers.

Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data.

Direct transfers: Not applicable.

Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. 

The frequency of  the transfer

Direct transfers: Not applicable.

Onward transfers: Continuous.

Categories of personal data transferred

Direct transfers: Not applicable.

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Sensitive data transferred (if applicable)

Direct transfers: Not applicable.

Onward transfers: Determined at the sole discretion of the data exporter.

Length of processing  chain

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Applicable transfer mechanism

Direct transfers: Not applicable.

Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws.

Identifying laws and practices relevant in light of all circumstances of the transfer

The Philippines has enacted specific laws that enable law enforcement authorities and military personnel to obtain access to data, including personal data being processed in the Philippines and held by private organizations. In addition, the powers of government authorities enable them to request / access data stored in Europe but which are accessed by individuals located in the Philippines, as long as the person or entity sought to be enjoined is subject to the jurisdiction of the Philippine government. 

A high-level summary of the key laws is provided below:

• The Philippine Constitution of 1987 – this allows exceptions to the right to privacy, which means that data (including personal data) can be accessed however law enforcers must first obtain a warrant with the proper court.
• Republic Act (R.A.) No. 11479 or the “The Anti-Terrorism Act of 2020” (ATA) – this allows law enforcers or military personnel to have access to, read, collect, or record, any private communication, conversation, discussion, data, information, or messages in whatever form, kind or nature, when it takes place between terrorists / terrorist organizations.
• Anti-Wiretapping Act (R.A. 4200) - while it is generally prohibited for any person to secretly tap, intercept, or record private communications between individuals, the law provides for an exception when any police officer has obtained a court order.
• Cybercrime Prevention Act (R.A. No. 10175) - authorizes law enforcement authorities, upon securing a court warrant, may require any person or telecommunications service providers to preserve, disclose, or submit subscriber information, traffic data, or relevant data in its possession or control in relation to the prosecution of a crime committed through a computer network or the use of electronic communications devices. Service providers are required to preserve the integrity of traffic data and subscriber information for a minimum period of six months from the date of the transaction.

Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data.

Direct transfers: Not applicable.

Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. 

The frequency of  the transfer

Direct transfers: Not applicable.

Onward transfers: Continuous.

Categories of personal data transferred

Direct transfers: Not applicable.

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Sensitive data transferred (if applicable)

Direct transfers: Not applicable.

Onward transfers: Determined at the sole discretion of the data exporter.

Length of processing  chain

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Applicable transfer mechanism

Direct transfers: Not applicable.

Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws.

Identifying laws and practices relevant in light of all circumstances of the transfer

Singapore has enacted laws that enable the government to obtain access to data, including personal data being processed in Singapore.

A high-level summary of the key laws relevant in Singapore is provided below:

• The Cybersecurity Act (CSA) - authorizes the government to obtain access to data to prevent, manage, and respond to cybersecurity threats and incidents.

• The Protection from Harassment Act – prohibits any individual or entity (excluding public agencies) from surveilling individuals. 

• The Computer Misuse Act - prohibits unauthorized use or interception of a computer service.

• The Personal Data Protection Act (PDPA) – requires organizations who collect, use, or disclose personal data in Singapore to adhere to GDPR-like requirements. This law complements sectoral laws like the Singapore Banking Act. Requirements include obtaining consent or relying on other specific legitimate interests to process personal data, and ensuring the same level of data protection is imposed on any extraterritorial personal data recipients. However, these requirements do not apply to investigations related to civil, criminal, or administrative proceedings.

Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data.

Direct transfers: Not applicable.

Onward transfers: Atlassian transfers Customer Personal Data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. 

The frequency of  the transfer

Direct transfers: Not applicable.

Onward transfers: Continuous.

Categories of personal data transferred

Direct transfers: Not applicable.

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Sensitive data transferred (if applicable)

Direct transfers: Not applicable.

Onward transfers: Determined at the sole discretion of the data exporter.

Length of processing  chain

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Applicable transfer mechanism

Direct transfers: Not applicable.

Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws.

Identifying laws and practices relevant in light of all circumstances of the transfer

A high-level summary of the key laws relevant in Turkey is provided below:

• Constitution of the Republic of Turkey - establishes that any interference with fundamental rights and freedoms must be proportionate and in compliance with the essence of the Constitution and the requirements of the democratic and secular system. However, under extreme circumstances (e.g., war, mobilization, or state of emergency), the exercise of fundamental rights and freedoms may be partially or entirely suspended to the extent required by the requirements of the situation, as long as this does not violate any obligations under international law
• Criminal Procedural Code No. 5271 (CPC) – permits communications that are at a post office to be seized, if there is probable cause that they constitute evidence of a crime. Evidence can also be obtained by interception of correspondence through telecommunications, provided certain conditions are met (such as lack of alternative methods, relation to specific crimes, etc.). 
• Electronic Communications Law No. 5809 (ECL) – grants, in the context of its duties, the relevant authority the power to request any type of document or information from individuals, private and public entities.
• Protection of Competition Law No. 4054 (only available in Turkish) – establishes the Competition Authority's right to supervise and inspect all information, documents, and ledger of any organization.
• State Intelligence Services and National Intelligence Organisation Law No. 2937 (only available in Turkish) ("State Intelligence Services Law") – Turkish intelligence services are entitled to request any type of document or information from individuals, private or public entities. They may also intercept communications provided a judge authorizes it, or a written order issued by the relevant authority's senior official in cases of disclosure of state secrets or the activities of terrorism.

Extraterritorial effect:  the governmental or state authorities’ powers to request documents from organizations are not limited to information located in Turkey (if servers are located in Europe). The same principle applies to tapping into the communication of individuals by judicial decision. In a two-ended conversation, if one of the persons is located in Europe or is a European citizen, the National Intelligence Organisation will still be able to collect the necessary information.

Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data.

Direct transfers: Atlassian has offices in the United States where our employees may access personal data for the purposes of the provision of Services and Forge.

Onward transfers: Atlassian transfers personal data to its sub-processors for the purposes of assisting in the provision of Services as well as Forge as further outlined in our sub-processor page. 

The frequency of  the transfer

Direct transfers: Continuous.

Onward transfers: Continuous.

Categories of personal data transferred

Direct transfers: As detailed in Atlassian DPA and Forge DPA respectively.

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Sensitive data transferred (if applicable)

Direct transfers: None.

Onward transfers: Determined at the sole discretion of the data exporter.

Length of processing  chain

Onward transfers: Please refer to Atlassian's sub-processor page for more information.

Applicable transfer mechanism

Direct transfers: Atlassian’s DPF Certification for the contractual relationship between Atlassian and its customers, or Forge developers, respectively.

Onward transfers: Standard Contractual Clauses between Atlassian and its sub-processors. Atlassian imposes obligations on its sub-processors to implement appropriate technical and organizational measures ensuring that the sub-processing of personal data is protected to the standards required by applicable data protection laws.

Identifying laws and practices relevant in light of all circumstances of the transfer

The following US laws were identified by the Court of Justice of the European Union in Schrems II as being potential obstacles to ensuring essentially equivalent protection for personal data in the US:

• FISA Section 702 (“FISA 702”) – allows US government authorities to compel disclosure of information about non-US persons located outside the US for the purposes of foreign intelligence information gathering. 
• Executive Order 12333 ("EO 12333") - authorizes intelligence agencies (like the US National Security Agency) to conduct surveillance outside of the US. In particular, it provides authority for US intelligence agencies to collect foreign "signals intelligence" information, being information collected from communications and other data passed or accessible by radio, wire, and other electromagnetic means.

Further information about these U.S. surveillance laws can be found in the U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S.Data Transfers after Schrems II whitepaper from September 2020. As for the CLOUD Act, please refer to What is the CLOUD Act? by BSA Software Alliance outlining the scope of the CLOUD Act.

With the Data Privacy Framework, Europe introduced the adequacy framework for US companies that self-certify under the DPF. An essential element of the adequacy decision was the updated US legal framework, e.g. Executive Order on “Enhancing Safeguards for United States Signals Intelligence Activities”, which was signed by President Biden on 7 October and is accompanied by regulations adopted by the Attorney General. These instruments were adopted to address the issues raised by the Court of Justice in its Schrems II judgment.

For Europeans whose personal data is transferred to the US, the Executive Order provides for:

• Binding safeguards that limit access to data by US intelligence authorities to what is necessary and proportionate to protect national security;
• Enhanced oversight of activities by US intelligence services to ensure compliance with limitations on surveillance activities; and
• The establishment of an independent and impartial redress mechanism, which includes a new Data Protection Review Court to investigate and resolve complaints regarding access to their data by US national security authorities.

Atlassian US, Inc. and its US affiliates participate in and certify compliance with the Data Privacy Framework Principles. Our US entities are now able to rely on the adequacy decision to receive EU personal data. You can find more information in our Privacy Notice under the Section “Data Privacy Framework Notice.”

Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. Atlassian also publishes an annual Transparency Report with information about government requests to access data.

Atlassian provides the following technical measures to provide additional security for personal data:

• Data residency: Atlassian allows customers to pin in-scope product content at rest to a location. Planned expansions to our data residency program (including data residency for apps and additional locations) are highlighted in Atlassian’s cloud roadmap
• Encryption: Atlassian offers data encryption at rest and in transit, as well as BYOK encryption.
• Security and certifications: We have a formal security management program and we review our Information Security Management Program (ISMP) on an annual basis. Additional information about Atlassian’s security practices and certifications are available in the Atlassian DPA and the Forge DPA, as well as on our Trust Center.

Contractual Measures

Atlassian’s contractual measures are set out in our Data Processing Addendum which incorporates the SCCs, as well as UK Addendum and Swiss modifications for SCCs. In particular, we are subject to the following requirements:

• Technical measures: Atlassian is contractually obligated to have in place appropriate technical and organizational measures to safeguard personal data (both under the Customer and Forge DPAs as well as the SCCs we enter into with customers, service providers, and between entities with the Atlassian group).
• Transparency: Atlassian is obligated under the SCCs to notify its customers and Forge developers in the event it is made subject to a request for government access to customer personal data from a government authority. In the event that Atlassian is legally prohibited from making such a disclosure, Atlassian is contractually obligated to challenge such prohibition and seek a waiver.
• Actions to challenge access: Under the SCCs, Atlassian is obligated to review the legality of government authority access requests and challenge such requests where they are considered to be unlawful.

Organizational Measures

Atlassian’s organizational measures to secure data include:

• Policy for government access: Atlassian publishes and follows Atlassian Guidelines for Law Enforcement Requests in responding to any government requests for data. To obtain data from Atlassian, law enforcement officials must provide legal process appropriate for the type of information sought, such as a subpoena, court order, or a warrant.
• Atlassian publishes its annual Transparency Report with information about government requests to access data.
• Onward transfers: Whenever we share your data with Atlassian service providers, we remain accountable to you for how it is used. We require all service providers to undergo a thorough cross-functional diligence process by subject matter experts in our Security, Privacy, and Risk & Compliance Teams to ensure our customers and Forge developers' personal data receives adequate protection. This process includes a review of the data Atlassian plans to share with the service provider and the associated level of risk, the supplier’s security policies, measures, and third-party audits, and whether the supplier has a mature privacy program that respects the rights of data subjects. We provide a list of our sub-processors on our sub-processors page.
• Privacy by design: Atlassian’s Privacy Principles outline Atlassian’s approach to privacy, and more detailed information on privacy in our machine learning intelligent experiences is available here.
• Employee training: Atlassian provides data protection training to all Atlassian staff globally.