configure them correctly, but that's a very edgy and headache prone for the CPO, CTO etc

I've of the reasons it's that as a typical is company Atlasian treats the GDPR (make no mistake the GDPR is very incompatible with us style surveillance capitalism) as an afterthought. Which causes exactly that kind of fuck ups. As a minimum the CPO will spend days updating legal documentation, spending quality time with legal, all the things that we love to do.
@nixCraft @neil_h