DPT vs native Jira and Confluence user anonymization.
Quick answer: Jira and Confluence can anonymize a user account, but that person’s data stays in the content: names remain in summaries, descriptions, comments, plain-text mentions, custom fields and history, and attachments are not touched. Data Protection Toolkit finds that remaining data by pattern, redacts it in bulk after a dry run, and logs what it changed.
| Capability | Data Protection Toolkit | Built-in anonymization | Manual cleanup |
|---|---|---|---|
| Anonymizes the user account | Yes, including users who were already deactivated | Yes | No |
| Removes the name from summaries, descriptions and comments | Yes, in bulk with Data Cleaner | No | One item at a time |
| Finds plain-text mentions and custom field values | Yes, by pattern | No | Only what you think to search for |
| Attachments | Scanned in Jira Data Center. On Cloud, attachment names are scanned; in Jira Cloud our Attachment Scanner app scans the contents | Not touched | By hand |
| Detects PII by pattern: emails, IBANs, credit cards, national IDs | 62 built-in patterns for 27 countries, plus your own RegEx | No | No |
| Dry run before anything changes | Yes | n/a | n/a |
| Recurring scans | Scheduled scans | No | No |
| Consent forms and policy banners | Yes, with acceptance and rejection tracking | No | No |
| Exportable log of what was found and changed | CSV and JSON export | n/a | Your own notes |
“Built-in anonymization” means the user anonymization in Jira and Confluence themselves. Separate Atlassian products, such as Atlassian Guard, are not covered here.
Why isn’t built-in anonymization enough for GDPR?
A right-to-be-forgotten request (Article 17 GDPR) or a DSAR covers a person’s data, not just their account. After a native anonymization, the person’s name can still appear in issues and pages other people wrote about them, in comments, in @mentions typed as plain text, in custom fields and in history. Those are the places Data Cleaner searches.
When is built-in anonymization enough?
If the person never appears in content, for example a service account or a user who never created or was never mentioned in issues and pages, anonymizing the account may be all you need. Your legal team should make that call.
How does DPT handle a right-to-be-forgotten request?
- Anonymize the user account, including users who were already deactivated.
- Run Data Cleaner with a rule for the person’s name plus the built-in templates, scoped with JQL in Jira or CQL in Confluence.
- Review the dry run, then redact or replace the findings in bulk.
- Export the execution history to CSV or JSON as evidence that the request was completed.
On Data Center, project anonymization (space anonymization in Confluence) goes further: it anonymizes everything a user or project touched before a retention deadline, instance merge or Cloud migration.