Introduction to Data Protection

Data Protection is the protection of personal data against unauthorized access, misuse, processing, or publication. Personal data is data that relates to a natural, identifiable person (for example, name, address, telephone number).

There are several worldwide data privacy laws, such as the European Union's General Data Protection Regulation (GDPR) and California's Consumer Privacy Act (CCPA), or Health Insurance Portability and Accountability Act (HIPAA), which are designed to safeguard individuals' privacy rights. These laws dictate that companies must obtain consent from individuals before collecting their personal information and must take measures to secure that information.

Penalties for non-compliance with data privacy laws can be severe, including heavy fines and damage to a company's reputation.

By implementing strong data privacy practices, you not only meet legal requirements but also gain the trust of your customers, employees, and other stakeholders. This can result in increased customer loyalty, improved brand reputation, and enhanced overall business success.

Typical uses cases when you might be affected by a data protection guideline:

You are facing the challenge of managing thousands of tickets containing sensitive information, such as credit card numbers.
You are facing the challenge of personal information being written in user profiles, potentially making it accessible to other users.
You are looking to export users from specific groups within specific projects. This may be used for various purposes, such as creating a report, transferring data to another system, or analyzing user activity.
You want to ensure that users have the correct access levels to perform their duties, audit user activity, or ensure compliance with organizational policies and regulations.
You want to create and manage tasks that repeat on a regular schedule, such as daily, weekly, monthly, or annually.
A customer contacts a company and wants to know what personal data is being processed about him or her and who has access to it.
As your company's data protection officer, you are asked to obtain employees' consent to an operational change and manage it so that statistics can be viewed.
You want to send a reminder to all employees who have not yet submitted their vacation plans for this year.
Easily create a cookie banner that can be customized to your liking.
Someone has quit and demands that all their data in Jira be deleted immediately.
Migration from server to cloud is pending. Before that, you need to perform a security audit and clean up sensitive and personal data to do so.
You want to restrict access to user profiles for temporary employees.
A new employee was hired a few weeks ago, and you want to check whether she has the necessary rights in the relevant projects.
Your data protection officer has set company-specific requirements how a data protection app should perform.
After a certain period of time, the content of individual tasks or entire projects/pages should be anonymized for all users. A tool that allows such a large operation with just a few clicks and automatically is an immense-added value.

And if you’re still not sure whether you should comply to certain guidelines, this might help:

Many companies are under the misconception that GDPR/DSGVO only applies to them if they have physical establishments in the EU. In reality, GDPR/DSGVO applies to any company operating in the EU, regardless of its physical presence, and companies processing personal data of individuals in the EU, irrespective of their nationality. You can also read our article that explains and compares Data Privacy Laws.

The California Consumer Privacy Act (CCPA) was enacted on January 1, 2020, to protect any personal information that could be linked to California residents. So if you rule an entity that is in California or collects, shares or sells personal data of Californian residents, AND if these apply to your company:

Annual revenues of more than $25 million
Data processing of greater than 50,000 users
Gains at least 50% of revenue from selling personal data,

you must be CCPA-compliant.

Explicitly for healthcare, the U.S. has passed a law called HIPAA (Health Insurance Portability and Accountability) in 1996. Companies working in healthcare, healthcare providers such as hospitals, doctors, or even government programs such as Medicare, should check if their Jira and Confluence instance is HIPAA-compliant. You can do the HIPAA-compliance check here.

You can also read our article that explains and compares Data Privacy Laws all over the world.

And if you’re still not sure whether you should comply to certain guidelines, this might help:

What is PII in general?
Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.

Data protection and security has been an ongoing topic in business operations for years. But as soon as you seem to have a clear picture of what’s going on, there are new regulations and updates. So, is this a Sisyphean task? Not at all!

Compliance for Jira

Every user in Jira leaves a lot of personal data. Also, depending on the use of Jira, there can be a lot of personal data from customers. With the built-in modules of our Data Protection and Security Toolkit, you can be sure that you have full access to these data, provide information and change data.

Jira offers some built-in features for data protection: For example, it is possible to anonymize users’ names, but this process does not affect user mentions, simple text usage with usernames, or other personally identifiable information (PII).

All our modules are built for different scenarios that are possible to happen in relation to personal data. Our experience with banks and insurance companies led us to development of this solution for Jira.

So, if you want to rely on risk-free, data protection, find any PII types and also archived users and projects, this app is the one and only solution for you.

Discover more information about Data Security, Data Residency and more in simple terms in our knowledge base!

Also have a look at our regularly updated articles about Data Security, compliance in Jira, CCPA updates, GDPR requirements, comparisons, guides and more: Data Security Articles.

Currently, we have 8 main modules for different Data protection needs:

Policies, Agreements, Notifications & Announcements	Data cleanup and anonymization	Security breach investigation

Policies, Agreements, Notifications & Announcements	Data cleanup and anonymization	Security breach investigation
Notifications & Announcements	Data Cleaner User Anonymizer Recurring tasks Profile Visibility	Permission Monitoring Access Statistics User export

Very first step – App configuration

It is strictly required to configure the app before first use. Read about app’s configuration and required data App configuration