Checklist: Inventory data protection
Does your company want to use Atlassian Cloud in the future and are you asking yourself: "What do we have to consider when it comes to data protection?” Then we have something for you: a checklist to help you be well-prepared for an initial meeting with your Data Protection Officer (DPO). This checklist acts as a reference framework to identify your data protection needs going forward.
What personal data will you store or use in Atlassian Cloud?
Describe all the data that could be associated with your Atlassian Cloud
Examples of typical personal data in companies:
- Name
- Username/Password
- Email address
- Key identifying a person (e.g. personnel number, customer number)
Examples of personal data requiring specialized protection:
- Contracts or contract data
- Salary data
- IT usage data or log files (with IP addresses, if applicable)
Where does this data originate from?
Based on the previous question, which group of individuals does the data belong to?
Examples of different group types are:
- Employees
- IT users (including external)
- Customers
- Suppliers
- Service providers
What is the purpose of storing or using the data?
According to the law, when companies process personal data, it must always be for a defined and legitimate purpose. For this reason, data retention is generally not permitted. From a data protection perspective, it is therefore first important to understand the purpose of the respective data and how it is being used by your company.
This is particularly important if your company plans to process and store any personal data from customers in the Atlassian Cloud. It could be possible that you have customer contracts that restrict or exclude the use of the Cloud infrastructure.
Furthermore, you should describe exactly what will happen to the data once it is in the Atlassian Cloud.
Who is involved (employees, company)?
Apart from your company employees, who is involved in the implementation and future operation of your Cloud project? The use of Cloud products or a migration to the Cloud often requires further support from specialised service providers. If they come into contact with your company data, additional contractual agreements on data protection are often required.
Is your company part of a group of companies and are employees of the subsidiary, sister or parent company involved? Or do you yourself work for a subsidiary that is implementing this Cloud project as an IT service for other companies in your corporate group? This information is also relevant for data protection.
Who is involved (IT systems, interfaces)?
Which IT systems are connected to the Atlassian Cloud via interfaces - for example, to provide a single sign-on or to automate processes? In this case, a system/interface overview or a data flow diagram can contribute to a better understanding.
Would you now like to conduct your own inventory of data protection in your companies?
Then download this free whitepaper, in which we go into more detail about all the checkpoints on our data protection checklist.
Our data protection expert Thomas Rosin
The content for this whitepaper was created in collaboration with our data protection expert, Thomas Rosin.
Thomas Rosin specializes in data and information protection. In addition to his work as a data protection officer and consultant for numerous companies, he teaches data protection in the Master's program in information systems at the RFH University of Applied Science in Cologne.
Contact: info@thomasrosin.de
Web: https://www.thomasrosin.de
The legal contents listed by Seibert Media GmbH, e.g. judgments, tips and contributions, are carefully compiled to the best of our knowledge and belief. No claim is made to the completeness and exclusivity of the content. The information provided is for informational purposes only and does not replace individual legal advice. Seibert Media GmbH does not guarantee the judgments and opinions presented here will be followed in the case of a dispute. Therefore Seibert Media GmbH does not assume liability for the published content.
The published content contains references and links to other websites, which we cannot guarantee is correct or complete. The information is outside of our area of responsibility. If any content violates applicable law or is inappropriate, please let us know.
More about Atlassian Cloud
//SEIBERT/MEDIA GmbH
Luisenstraße 37-39, 65185 Wiesbaden