> I don't think GDPR differentiates between sensitive info you asked for, and sensitive info that somebody chooses to put in a field not meant for it.

I know GDPR doesn't, my point is if, as a business, GDPR is a requirement from your ticket tracking then you might need to rethink the data you, as a business, are putting on there. Something like this is not intended for tracking customer data. It's intended for assigning work and tracking throughput.

If you need to log customer data then you need a different type of issue tracking and something that project managers et al don't all have visibility of.