Organizations subject to GDPR or CCPA must ensure they have an executed DPA with Slack; without it, their use of Slack for personal data processing may not comply with applicable privacy law.
If you use Slack through your employer, your organization — not you — controls your workspace data, including messages and files, and can access or delete them. Slack retains rights to use aggregated and de-identified data derived from your usage to improve its services. You can review Slack's Privacy Policy at https://slack.com/privacy-policy to understand what personal data Slack collects and how it is used.