Slack updates privacy policy to comply with GDPR, says customers with certain premium services can download all data, including DMs, without informing members
Slack just updated its privacy policy and tools, and one of the changes may give some users pause.
Context & Ripple Effects
Slack built its early reputation on message confidentiality — coverage in 2015 detailed how it kept the work conversations of hundreds of thousands of users private (how Slack keeps work conversations private). The GDPR-driven policy update cuts against that positioning: under the new terms, customers on certain premium plans can export all workspace data, including direct messages, without ever notifying the people who wrote them.
The move matters because it formalizes a split between who pays for Slack and whose messages are in it. That same split resurfaces years later when Slack confirms it trains some AI features on user content with everyone opted in by default (Slack's default-opt-in AI training), making this 2018 change an early marker of how the platform treats member-level privacy.
First-order effects
- Paying customers on eligible premium plans gain a one-click export of every DM and channel message in their workspace, while the members who wrote those messages get no notice — the practical expectation of DM confidentiality inside Slack ends for those workspaces.
- Compliance and legal teams at those customers gain GDPR-aligned tooling to satisfy data-access requests, which is the stated purpose of the change.
Second-order effects
- Enterprise buyers evaluating Slack now have to weigh member trust against administrative control, and Slack's own track record — including the 2019 password resets tied to the 2015 breach (password resets after the 2015 breach) — becomes part of that procurement conversation.
- The silent-export capability sets a precedent rivals in workplace messaging must match or explicitly reject, since any competitor advertising stronger member-level privacy now has a concrete Slack policy to point at.
Third-order effects
- If the pattern holds, workplace chat converges on a model where message content is an asset owned by the paying organization rather than private correspondence between colleagues — a structure that later made default-opt-in uses like AI feature training possible.
- GDPR compliance becomes the mechanism through which platform operators normalize broad administrative access to user-generated content, shifting the privacy debate from whether employers can read messages to whether they must tell employees they did.
The trend: Workplace messaging platforms are reframing direct messages from private correspondence into employer-controlled data, with GDPR compliance and later AI training both pulling in the same direction.