Atlassian’s CCPA Commitment

What is the CCPA?

The CCPA stands for the California Consumer Privacy Act of 2018, which went into effect on January 1, 2020. The CCPA is a California data privacy regulation that governs how certain organizations use, collect, and process personal information of California residents. The CCPA was later amended by the California Privacy Rights Acts of 2020 (CPRA), which went into effect on January 1, 2023, with enforcement starting on July 1, 2023.

Like many privacy regulations, the CCPA regulates the use, collection, and processing of personal information. Businesses (as defined by the CCPA) must provide consumers the following rights for their personal information:

1.   Right to delete;

2.   Right to correct;

3.   Right to know;

4.   Right to opt-out of sale or sharing; and

5.   Right to limit use and disclosure of sensitive personal information.

Businesses may contractually require their service providers and contractors to provide these rights to such consumers also.

Atlassian and the CCPA

Atlassian predominantly acts as a service provider of personal information on behalf of our Customers in connection with the provision of our Cloud Products. Please refer to Section 2.5.2 as well as Exhibit A, Annex 1(B), Part A of the DPA for further information. 

Atlassian commits to complying with the CCPA and any modifications to the law, as further explained below.

Data Subject Rights under the CCPA

Our tools help customers meet obligations under the CCPA as it relates to data subject requests. Additionally, we have updated our policies to address handling data subject requests sent from Authorized Agents. You can read more about our tools below.

1.   To assist customers with the right to delete:

• Atlassian organization admins can facilitate the account deletion of their managed users from controls in their admin portal
• Unmanaged end users may also request that their personal information be deleted by initiating an account deletion request from their Atlassian account profile page
• People who have provided their personal information or had their personal information provided to Atlassian, but do not have Atlassian accounts, may also initiate a request for deletion

2.   To assist users with the right to access:

• Atlassian organization admins can facilitate access of their managed users' data from Atlassian support
• Unmanaged end users may also request that their personal information be accessed by initiating a data access request from Atlassian support
• People who have provided their personal information or had their personal information provided to Atlassian, but do not have Atlassian accounts, may also initiate a request for access

Both, deletion and access requests can be serviced via telephone by leaving a message at 1 (800) 804-5281.

Sale or Share of Personal Information

Atlassian does not sell or share (as defined in the CCPA) personal information that it processes as a service provider within Atlassian’s Cloud Products (e.g. Jira, Confluence, Trello).

CCPA in our Privacy Policy

We've updated our Privacy Policy to include information specific to the CCPA.

Data Processing Agreements

Atlassian has updated its Customer data processing agreement to comply with the CCPA. The latest version of the Data Processing Agreement can be found here.