Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Consistent with Atlassian's DPA, this list represents the mechanism through which Atlassian discloses subprocessor additions and replacements, with customers entitled to receive advance notice and to exercise objection rights as specified in the DPA.
This analysis describes what Atlassian's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational mechanism for GDPR Article 28(2) compliance, requiring Atlassian to provide prior notice of subprocessor changes and permitting customers to object to new subprocessors before they begin processing customer data.
Interpretive note: The specific notice period, objection mechanism, and consequences of objection are governed by each customer's individual DPA with Atlassian and are not stated in this public subprocessor list.
This provision establishes that customers are entitled to advance notice when Atlassian adds or replaces a subprocessor, and may object to such changes under the terms of their DPA. The agreement requires customers to monitor this list or subscribe to change notifications to exercise this right in practice.
Cross-platform context
See how other platforms handle Subprocessor Change Notification and similar clauses.
Compare across platforms →Monitoring
Atlassian has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Atlassian subprocessors who process customer data.Excerpt from Atlassian's Sub-Processors
1) REGULATORY LANDSCAPE: GDPR Article 28(2) requires that data processors obtain prior specific or general written authorization from the data controller before engaging subprocessors, and requires notification of intended changes. Failure to provide adequate notice could constitute a breach of the processor's Article 28 obligations, triggering supervisory authority scrutiny. UK GDPR imposes equivalent requirements. 2) GOVERNANCE EXPOSURE: Medium. The practical enforceability of the objection right depends on the notice period specified in the DPA and whether Atlassian's notice mechanism (email notification, public webpage update) constitutes adequate prior notice under applicable law. Customers with short objection windows may have limited practical ability to object before a new subprocessor begins processing. 3) JURISDICTION FLAGS: EU and UK customers have the strongest statutory basis for exercising objection rights under their respective data protection laws. Australian and US customers' objection rights depend entirely on their contractual DPA terms, as no equivalent statutory right applies in those jurisdictions. 4) CONTRACT AND VENDOR IMPLICATIONS: DPAs should specify a minimum advance notice period for subprocessor changes (commonly 30 days), the mechanism for delivering notice (email to a designated contact), and the process and consequences for exercising an objection. Procurement teams should confirm that the designated notification contact is actively monitored. Where the DPA permits Atlassian to continue using a new subprocessor absent an objection within the notice period, the practical consequence of not monitoring the list is that new subprocessors will be deemed approved. 5) COMPLIANCE CONSIDERATIONS: Legal teams should establish an internal process for reviewing subprocessor change notifications, including a defined review timeline and escalation path. Changes affecting AI subprocessors or subprocessors in new jurisdictions may require updated Transfer Impact Assessments. Records of processing activities should be updated to reflect any subprocessor changes.
This provision establishes the operational mechanism for GDPR Article 28(2) compliance, requiring Atlassian to provide prior notice of subprocessor changes and permitting customers to object to new subprocessors before they begin processing customer data.
This provision establishes that customers are entitled to advance notice when Atlassian adds or replaces a subprocessor, and may object to such changes under the terms of their DPA. The agreement requires customers to monitor this list or subscribe to change notifications to exercise this right in practice.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Atlassian.