Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document discloses the identity, location, and processing activity of each third party that Atlassian authorizes to process customer data in connection with its cloud products, fulfilling the transparency requirement under GDPR Article 28(2).
This analysis describes what Atlassian's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the formal subprocessor register that Atlassian is contractually and regulatorily required to maintain under its DPA and GDPR Article 28. Enterprise customers rely on this list to fulfill their own downstream subprocessor due diligence obligations and to maintain accurate records of processing activities.
This provision establishes that customer data flowing through Atlassian cloud products is processed by named third-party vendors covering infrastructure, analytics, support, and AI functions. Under these terms, customers can identify which vendors have access to their data and in which countries those vendors operate.
Cross-platform context
See how other platforms handle Subprocessor Disclosure Obligation and similar clauses.
Compare across platforms →Monitoring
Atlassian has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Atlassian subprocessors who process customer data.Excerpt from Atlassian's Sub-Processors
1) REGULATORY LANDSCAPE: GDPR Article 28(2) requires data processors to obtain prior written authorization before engaging subprocessors and to impose equivalent data protection obligations on them by contract. This document serves as Atlassian's public discharge of the transparency element of that obligation. UK GDPR imposes parallel requirements. The Australian Privacy Act APP 8 addresses cross-border disclosure obligations. EU supervisory authorities and the UK ICO are the primary enforcement authorities. 2) GOVERNANCE EXPOSURE: Medium. The list discloses subprocessors in the United States and other non-EEA jurisdictions, creating an ongoing obligation for EU and UK customers to verify that valid transfer mechanisms (Standard Contractual Clauses or equivalent) are in place for each. Failure by Atlassian to maintain adequate transfer safeguards could create indirect liability exposure for enterprise customers who rely on Atlassian as a processor. 3) JURISDICTION FLAGS: EU and EEA customers face heightened exposure due to GDPR Chapter V cross-border transfer requirements. UK customers are subject to UK GDPR and the UK International Data Transfer Agreement framework. Australian customers should evaluate App 8 compliance for transfers to US-based subprocessors. California-based enterprises should assess CCPA service provider obligations. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that Atlassian's DPA references this subprocessor list and incorporates current SCCs for non-EEA transfers. The DPA should specify the mechanism by which Atlassian imposes equivalent obligations on each subprocessor. Customers should verify audit rights provisions in the DPA extend to subprocessors or require Atlassian to obtain equivalent assurances. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should integrate this list into their Records of Processing Activities (RoPA) under GDPR Article 30. Data mapping updates are required whenever the subprocessor list changes. Legal teams should confirm that Atlassian's subprocessor change notification mechanism satisfies the advance notice period specified in the customer's DPA, and that the objection right is operationally exercisable.
This provision establishes the formal subprocessor register that Atlassian is contractually and regulatorily required to maintain under its DPA and GDPR Article 28. Enterprise customers rely on this list to fulfill their own downstream subprocessor due diligence obligations and to maintain accurate records of processing activities.
This provision establishes that customer data flowing through Atlassian cloud products is processed by named third-party vendors covering infrastructure, analytics, support, and AI functions. Under these terms, customers can identify which vendors have access to their data and in which countries those vendors operate.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Atlassian.