Jira and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, unless switched off. On Standard, Atlassian uses metadata (always) and in-app data (on by default: work item titles, descriptions, comments) to improve its apps and AI for all customers, de-identified and aggregated. Third-party AI providers do not train on it.

Vendor's wording: “Metadata contribution: Is always contributed In-app data contribution: On”

Source: support.atlassian.comData contribution settings, Default data contribution settings (Free or Standard)Checked on 19 October 2026

You can switch the training off.

Atlassian Administration, Security, Data contribution: switch In-app data contribution to Off. The metadata contribution cannot be turned off on Standard (only on Enterprise).

Vendor's wording: “To view your settings, navigate to Atlassian Administration, then Security, and then Data contribution.”

Source: support.atlassian.comData contribution settingsChecked on 19 October 2026

Hosted on AWS. By default the data is in Atlassian's 'Global' location and can move dynamically across all AWS regions; an admin can pin it to a region such as EU (Frankfurt/Dublin) or Germany.

Vendor's wording: “By default, all Atlassian apps are hosted in the Global location, which includes all of our AWS regions.”

Source: support.atlassian.comUnderstand data residency, Global location paragraphChecked on 19 October 2026

EU hosting available.

Yes. Jira on Standard, Premium or Enterprise can be pinned to the EU (Frankfurt and Dublin) or Germany; the admin selects it under Data management, Data residency. Moving involves downtime of up to 24 hours.

Vendor's wording: “Atlassian Cloud: Jira, Jira Service Management, Jira Product Discovery, Loom, and Confluence with Enterprise, Premium, and Standard plans.”

Source: support.atlassian.comUnderstand data residency, locationsChecked on 19 October 2026

DPA in the terms.

Yes. Atlassian's Data Processing Addendum supplements the Atlassian Customer Agreement and applies to its cloud products; it includes EU/UK transfer terms.

Vendor's wording: “This Data Processing Addendum (“DPA”) supplements the Atlassian Customer Agreement, or other agreement in place between Customer and Atlassian”

Source: atlassian.comData Processing Addendum, introductionChecked on 19 October 2026

Published.

Yes, public at https://www.atlassian.com/legal/sub-processors: 29 third-party rows (25 companies) for commercial cloud, plus 15 Atlassian group entities and 5 Government Cloud sub-processors. AI providers: AWS Bedrock, Google Vertex AI, OpenAI.

Vendor's wording: “Atlassian uses the third-party entities listed below (each, a “Sub-processor”) to process Customer Personal Data on behalf of Atlassian customers”

Source: atlassian.comSub-processors listChecked on 19 October 2026

On the list.

Active (Atlassian, Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Atlassian'Checked on 19 October 2026

After the agreement ends Atlassian deletes customer personal data per its documentation, but may keep copies under backup and record-retention policies. Data contributed for AI and then opted out is removed from datasets within 30 days (content attributes 90 days); de-identified aggregates can be kept up to 7 years.

Vendor's wording: “Following expiration or termination of the Agreement, Atlassian must, in accordance with the Documentation, delete all Customer Personal Data.”

Source: atlassian.comDPA 6.2 Post TerminationChecked on 19 October 2026

At least 2 confirmed on Atlassian's own pages: ISO/IEC 27001:2022 and SOC 2 (reports via Trust Portal). The Compliance Resource Center lists 34 resources but its filter list needs a browser.

Vendor's wording: “Type Certifications / Attestations Documentation ISO/IEC 27001 Certificate”

Source: atlassian.comCompliance Resource Center, ISO/IEC 27001:2022Checked on 19 October 2026

Yes. An organisation admin can block individual apps (including Jira) from Rovo AI features under Atlassian Administration, AI and Rovo, Access; this disables current and upcoming AI features for that app.

Vendor's wording: “Blocking an app will disable all current and upcoming AI features for that app.”

Source: support.atlassian.comManage Rovo access, Block apps from Rovo featuresChecked on 19 October 2026