Loading…
Links last opened 29 October 2026. Record confirmed by a person on 28 October 2026. 15 recorded changes, listed below.
Atlassian contracts through Atlassian Pty Ltd, registered in Australia. Transfers of personal data out of the EEA are covered by EU-US Data Privacy Framework (DPF). Its trust center is published at https://www.atlassian.com/trust. Its customer data processing agreement, also called a data processing addendum, is published by Atlassian itself; the link is below. Its sub-processor list is published by Atlassian itself; the link is below. We open those pages every day — last on 29 October 2026 — and a person last went through this record on 28 October 2026.
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
A ready row. Replace the purpose with what your client actually uses Atlassian for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Atlassian | Atlassian Pty Ltd | AU | Workplace tools | DPF | https://www.atlassian.com/legal/data-processing-addendum |
Changes we noticed on Atlassian's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.
29 October 2026
Atlassian added Close as a new subprocessor for cloud hosting and Atlassian support across multiple products. This subprocessor operates in Australia, India, and Singapore, which lack EU adequacy decisions, so transfers of personal data to these locations will require additional safeguards under data protection laws.
29 October 2026
Atlassian's Data Processing Addendum was reformatted to add language selection options and restructure the document layout, but the substantive terms regarding EU Standard Contractual Clauses, UK Addendum, security measures, sub-processor notification procedures, and data transfer mechanisms remain the same.
Seen on https://www.atlassian.com/legal/data-processing-addendum
28 October 2026
Atlassian's DPA was updated with reformatted content and added FAQ sections addressing DPA scope, sub-processor usage, security measures, and data transfer mechanisms, though the substantive legal terms regarding roles, security obligations, EU Standard Contractual Clauses, and UK transfer requirements remain substantially the same.
Seen on https://www.atlassian.com/legal/data-processing-addendum
27 October 2026
Atlassian added subprocessors operating in Australia, India, and Singapore—countries without EU adequacy decisions—across multiple cloud products including Jira Cloud, Confluence Cloud, and Bitbucket Cloud, requiring organizations to assess whether additional safeguards are needed for personal data transfers to these locations.
26 October 2026
Atlassian added Close as a subprocessor for cloud hosting and support provision across multiple products. The subprocessor operates in countries including Australia, India, and Singapore, which lack EU adequacy decisions, requiring additional safeguards for personal data transfers from the EEA.
26 October 2026
Atlassian's Data Processing Addendum was reformatted to add language options and reorganize the structure, but the substantive terms regarding EU Standard Contractual Clauses, UK Addendum application, security measures, customer instructions, and sub-processor procedures remain unchanged. This change affects documentation in records of processing and DPA files but does not alter the actual data processing obligations or subprocessor notification requirements.
Seen on https://www.atlassian.com/legal/data-processing-addendum
25 October 2026
Atlassian added subprocessors operating in Australia, India, and Singapore—countries without EU adequacy decisions—which means personal data transfers to these locations now require additional safeguards such as standard contractual clauses. The vendor expanded its subprocessor list to include multiple new cloud hosting providers, content delivery networks, and AI services providers supporting various Atlassian products across these additional regions.
25 October 2026
Atlassian's Data Processing Addendum was updated with restructured content that removed navigation elements and language selection options while preserving the core legal provisions on security measures, customer instructions for personal data processing, EU Standard Contractual Clauses (including Module Two and Module Three applications), UK Addendum terms, and sub-processor notification procedures. The material terms governing data transfers from Europe, the United Kingdom, and Switzerland, as well as security obligations and sub-processor management, remain substantively the same.
Seen on https://www.atlassian.com/legal/data-processing-addendum
24 October 2026
Atlassian added a subprocessor for cloud hosting and support services with operations in Australia, India, and Singapore—countries without EU adequacy decisions—which means personal data transfers to these locations now require appropriate safeguards documented in your data processing agreement.
24 October 2026
Atlassian's Data Processing Addendum was reformatted to display language selection options and FAQ sections at the top of the document, with the substantive legal terms on data processing roles, security measures, and transfer mechanisms remaining unchanged. This update affects how the DPA is presented to users but does not alter the actual processing obligations, security commitments, or legal frameworks governing data transfers to Ireland.
Seen on https://www.atlassian.com/legal/data-processing-addendum
23 October 2026
Atlassian added multiple subprocessors that operate in Australia, India, and Singapore—countries without EU adequacy decisions—for cloud hosting, content delivery, and AI services across their product portfolio. This requires organizations to verify appropriate transfer mechanisms are in place for personal data processed in these locations.
23 October 2026
Atlassian's Data Processing Addendum was updated with structural reorganization and clarification of terms. The changes consolidate and reformat sections on scope, security measures, and regional transfer mechanisms for Europe, UK, and Switzerland, including explicit incorporation of EU Standard Contractual Clauses and the UK Addendum, which affects how customer data transfers are documented and governed.
Seen on https://www.atlassian.com/legal/data-processing-addendum
22 October 2026
Atlassian's Data Processing Agreement was updated to add 27 lines of content that now explicitly include sections on scope, term, security, sub-processing, assistance obligations, data deletion, audit rights, international provisions, authorized affiliates, and region-specific terms for Europe, the United Kingdom, Switzerland, the United States, South Korea, and Brazil. This expansion provides more detailed contractual framework for how personal data is processed and managed across different jurisdictions, which is important for maintaining an accurate record of processing activities and subpr
Seen on https://www.atlassian.com/legal/data-processing-addendum
13 October 2026
Atlassian removed 27 lines from their data processing agreement, including sections on scope, term, processing, security, sub-processing, assistance obligations, deletion procedures, audit rights, international provisions, affiliated entities, definitions, and region-specific terms for Europe, United Kingdom, Switzerland, United States, South Korea, and Brazil. The removed content also included a cookies and tracking notice with details on cookie categories and consent management.
Seen on https://www.atlassian.com/legal/data-processing-addendum
12 October 2026
Atlassian's Data Processing Agreement was updated to add 27 lines of content covering key DPA sections including scope, sub-processing, security, and assistance obligations, along with region-specific terms for Europe, UK, Switzerland, US, South Korea, and Brazil. The addition of these structured sections and regional provisions clarifies Atlassian's data processing commitments and may affect how the agreement applies to different jurisdictions in your records of processing.
Seen on https://www.atlassian.com/legal/data-processing-addendum
Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.
Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.
Six of them. All workplace tools in the registry · others that transfer the same way.