# Are Slack messages personal data? > Are Slack messages personal data? GDPR, UK guidance, California and Virginia treat work messages differently. What each text says. By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/are-slack-messages-personal-data Published: 2026-07-01 Updated: 2026-10-14 ## The short answer Slack messages are personal data under GDPR if tied to an identifiable person. California covers employee messages since 2023. Virginia excludes the employment context. The answer changes by location. Message text holding health or family detail is a special category under GDPR Article 9. A Slack message has an author, a channel and a timestamp. Its text can say anything. The legal tests care most about the author and the text. ## What does the EU and UK test say? [GDPR Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) defines personal data as any information about an identified or identifiable natural person. A user ID that maps to a named account is an identifier on that wording. [Slack's export](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) includes a users.json file. It lists the IDs. That link is my reading. Pseudonymised data stays inside the definition. The [UK ICO says](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) it is personal data for anyone who holds the extra information. For employees, [Article 88](https://gdpr-info.eu/art-88-gdpr/) lets member states set their own rules. The Court of Justice said in [case C-65/23 (19 Dec 2024)](https://www.dpcuria.eu/case?reference=C-65/23) that those rules must still follow Articles 5, 6 and 9. ## What does California say? The [California Attorney General says](https://oag.ca.gov/privacy/ccpa) the employment-related and business-to-business exemptions expired on 31 Dec 2022. So employee messages and business contacts in a workspace fall inside the CCPA. The law covers personal information. That means anything that could reasonably be tied to a consumer or household. ## What does Virginia say? [Virginia's consumer data law](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) defines a consumer as a resident acting in an individual or household context. It leaves out a person acting in a commercial or employment context. Personal data is information linked, or reasonably linkable, to an identifiable person. Other states word this in other ways. I didn't read them. Customer details that sit inside a workspace are a separate question from staff chat. ## What inside a message raises the stakes? [GDPR Article 9](https://gdpr-info.eu/art-9-gdpr/) lists special categories, such as health data, trade union membership and political opinions. A message about a sick day, a family matter or a union vote can fall there. That match is my reading of the list. Shared channels bring in other companies' people. See [Slack Connect and shared channels](/answers/can-i-sell-slack-connect-or-shared-channel-messages-to-ai), [the PII definitions](/answers/what-counts-as-pii-in-company-data) and [whether you can license Slack data to AI](/answers/sell-slack-data-to-ai). The [rights check](/rights-check) asks whose records these are and whether staff messages are included. Talk to a privacy or commercial lawyer in your state before you sign. Figure: comparison of How three places treat work messages: EU and UK (Any identifiable person), California (emphasized: Employee data covered, Employees covered), Virginia (Work context excluded). California is emphasized because it covers employee and business-contact data, where Virginia excludes the work context. _Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._ ## Sources - [GDPR Article 4(1)](https://gdpr-info.eu/art-4-gdpr/) - [Slack's export](https://slack.com/help/articles/220556107-How-to-read-Slack-data-exports) - [UK ICO says](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/) - [Article 88](https://gdpr-info.eu/art-88-gdpr/) - [case C-65/23 (19 Dec 2024)](https://www.dpcuria.eu/case?reference=C-65/23) - [California Attorney General says](https://oag.ca.gov/privacy/ccpa) - [Virginia's consumer data law](https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/) - [GDPR Article 9](https://gdpr-info.eu/art-9-gdpr/)