When someone asks for a copy of their data, or asks you to delete it, these are the tools. Both are site-administrator only and both are recorded.
What the app does is described here. Whether you must act on a particular request, and within what deadline, is a decision for your organisation — see Privacy & Data Handling.
1. Before you start
- Confirm the request is genuine and comes from the person it concerns.
- Have the Atlassian account ID, not just a name. Two people can share a name.
- Remember erasure is irreversible. There is no undo and no backup restore inside the app.
2. Previewing an erasure
Always preview first. The preview counts exactly what would be deleted, replaced and kept, table by table, and changes nothing.
This is the only chance to notice that a request names the wrong person while noticing is still useful.
3. Running an erasure
Confirm explicitly to proceed — a typed confirmation rather than a checkbox, because this is the one action in the app with no undo at all.
Running it twice for the same person is safe: the second run reports that the account was already erased and does nothing.
4. What is deleted, replaced and kept
| Kind of record | Treatment |
|---|---|
| Their own timesheets, leave, preferences, dashboard, status | Deleted |
| Decisions they made about other people's records | Identity replaced, record kept — deleting it would break someone else's audit trail |
| Work on an issued invoice | Identity replaced, every amount untouched |
| Free text anywhere — reasons, descriptions, comments | Cleared, including on records that are otherwise kept |
Where an identity is replaced it becomes a stable label such as Former member #a1b2c3d4, the same everywhere, so one person still reads as one person across a document.
5. Exporting one person's data
The export produces a JSON document of everything held about one account. Each section says what erasure would do to those rows, so the person can see in advance what would go and what would be kept.
It is built from the same list of tables erasure uses, so the two can never disagree. If it hits its size limit it says so rather than presenting a partial answer as complete.
6. The erasure log
Every erasure is recorded: when, by whom, and how many rows in each category. The account itself is stored as a one-way hash — a record saying *we erased this person* that named the person would defeat the point.
The log is enough to prove an erasure happened and to match it to a request. It is not enough to reverse.
7. Data retention windows
Erasure handles one person on request. Retention handles everybody, on a schedule. They are separate controls and you probably want both — see Admin Settings.