Source: https://dataprotection.tools/compare/
Updated: 2026-10-29

# DPT vs native Jira and Confluence user anonymization.

By [Nikoloz Surmanidze](https://dataprotection.tools/about/#product-manager), product manager for Data Protection Toolkit

**Quick answer:** Jira and Confluence can anonymize a user account, but that person’s data stays in the content: names remain in summaries, descriptions, comments, plain-text mentions, custom fields and history, and attachments are not touched. Data Protection Toolkit finds that remaining data by pattern, redacts it in bulk after a dry run, and logs what it changed.

What each approach covers

| Capability | Data Protection Toolkit | Built-in anonymization | Manual cleanup |
|---|---|---|---|
| Anonymizes the user account | Yes, including users who were already deactivated | Yes | No |
| Removes the name from summaries, descriptions and comments | Yes, in bulk with Data Cleaner | No | One item at a time |
| Finds plain-text mentions and custom field values | Yes, by pattern | No | Only what you think to search for |
| Attachments | Scanned in Jira Data Center. On Cloud, attachment names are scanned; in Jira Cloud our Attachment Scanner app scans the contents | Not touched | By hand |
| Detects PII by pattern: emails, IBANs, credit cards, national IDs | 62 built-in patterns for 27 countries, plus your own RegEx | No | No |
| Dry run before anything changes | Yes | n/a | n/a |
| Recurring scans | Scheduled scans | No | No |
| Consent forms and policy banners | Yes, with acceptance and rejection tracking | No | No |
| Exportable log of what was found and changed | CSV and JSON export | n/a | Your own notes |

“Built-in anonymization” means the user anonymization in Jira and Confluence themselves. Separate Atlassian products, such as Atlassian Guard, are not covered here.

## Why isn’t built-in anonymization enough for GDPR?

A right-to-be-forgotten request (Article 17 GDPR) or a DSAR covers a person’s data, not just their account. After a native anonymization, the person’s name can still appear in issues and pages other people wrote about them, in comments, in @mentions typed as plain text, in custom fields and in history. Those are the places Data Cleaner searches.

## When is built-in anonymization enough?

If the person never appears in content, for example a service account or a user who never created or was never mentioned in issues and pages, anonymizing the account may be all you need. Your legal team should make that call.

## How does DPT handle a right-to-be-forgotten request?

1. Anonymize the user account, including users who were already deactivated.

2. Run Data Cleaner with a rule for the person’s name plus the built-in templates, scoped with JQL in Jira or CQL in Confluence.

3. Review the dry run, then redact or replace the findings in bulk.

4. Export the execution history to CSV or JSON as evidence that the request was completed.

On Data Center, project anonymization (space anonymization in Confluence) goes further: it anonymizes everything a user or project touched before a retention deadline, instance merge or Cloud migration.

FAQ

## Native anonymization, answered.

Ready to try it? [Run your first scan in four steps](https://dataprotection.tools/get-started/) or [book a 1:1 demo](https://calendly.com/nikoloz-surmanidze/30min).

### Does Jira’s built-in anonymization remove names from comments?

No. Native anonymization changes the user account, not the content. Names stay in summaries, descriptions, comments, plain-text mentions, custom fields and history.

### Does Confluence’s built-in anonymization remove personal data from pages?

No. It changes the account, not page and blog post content or comments. Data Cleaner scans page and blog post titles, content bodies and comments for the personal data that remains.

### Can Data Protection Toolkit anonymize users who are already deactivated?

Yes. User anonymization handles right-to-be-forgotten and DSAR requests across content and history, including users who were already deactivated.

### Does the app replace a legal review?

No. It automates common tasks such as obtaining consent, anonymizing personal data and investigating breaches. Agree requirements with your legal team, then configure the app to cover them.

## Related

- [Features All 11 modules, on Cloud and Data Center](https://dataprotection.tools/features/)

- [Security & FAQ How the app handles your data](https://dataprotection.tools/security/)

- [Get started Free trial, demo, sandbox and your first scan](https://dataprotection.tools/get-started/)