Atlassian Data Processing Addendum
Atlassian Data Processing Addendum
Download the DPA
Effective starting: August 17, 2026
This Data Processing Addendum (“DPA”) supplements the Atlassian Customer Agreement, or other agreement in place between Customer and Atlassian covering Customer’s use of Atlassian’s Products and related Support and Advisory Services (the “Agreement”). Unless otherwise defined in this DPA or in the Agreement, all capitalized terms used in this DPA will have the meanings given to them in Section 9 of this DPA. Customer enters into this DPA on behalf of itself and in the name and on behalf of its Authorised Affiliates permitted to use the Products and related Support and Advisory Services under the Agreement. For the purposes of this DPA only, the term “Customer” includes Customer and such Authorised Affiliates.
1. Scope and Term
1.1 Roles of the Parties. For the purposes of the Agreement, the parties agree that:
(a) Customer is either a Controller of Customer Data, or a Processor of Customer Data acting on another Controller’s behalf (e.g. Customer’s Affiliate) while passing down relevant processing instructions to Atlassian. Processing details are stated in Schedule 1 (Description of Processing).
(b) Atlassian is a Processor (or respectively, a Sub-processor) of Customer Data. Processing details are stated in Schedule 1 (Description of Processing).
1.2 Term of the DPA. The term of this DPA coincides with the term of the Agreement and terminates upon expiration or earlier termination of the Agreement (or, if later, the date on which Atlassian ceases all Processing of Customer Personal Data).
1.3 Order of Precedence. If there is any conflict or inconsistency among the following documents, the order of precedence from highest to lowest will be: (1) the applicable terms stated in Schedule 2 (Region-Specific Terms including any transfer provisions); (2) Schedule 1 (Description of Processing); (3) the main body of this DPA; and (4) the Agreement.
2. Processing of Personal Data
2.1 Customer Instructions.
(a) This DPA, the Agreement, applicable Orders and Customer’s use of the Products (including relevant configurations and settings) and related Support and Advisory Services constitute Customer’s documented instructions regarding Atlassian’s Processing of Customer Data (“Documented Instructions”).
(b) Atlassian must Process Customer Data solely in accordance with the Documented Instructions, as further stated in Section 6.1 of Schedule 1 (Description of Processing). Customer:
(i) must ensure its Documented Instructions comply with Applicable Data Protection Law. Atlassian is not responsible for monitoring Customer's compliance with Applicable Data Protection Law; and
(ii) is responsible for determining whether the Products and related Support and Advisory Services are appropriate for the Processing of Customer Data under Applicable Data Protection Law.
2.2 Confidentiality. Atlassian must treat Customer Personal Data as Customer’s Confidential Information under the Agreement. Atlassian must ensure personnel authorized to Process Personal Data are bound by written or statutory obligations of confidentiality.
3. Security
3.1 Security Measures. Atlassian has implemented and will maintain appropriate technical and organizational measures designed to protect the security, confidentiality, integrity and availability of Customer Data and protect against Security Incidents. Customer is responsible for configuring the Products and using features and functionalities made available by Atlassian to maintain appropriate security in light of the nature of Customer Data. Atlassian’s current technical and organizational measures are described here. Customer acknowledges that the Security Measures are subject to technical progress and development and that Atlassian may update or modify the Security Measures from time to time, provided that such updates and modifications do not materially decrease the overall security of the Cloud Products during a Subscription Term.