Slack: DPA, subprocessors and data location

Where to find the Slack DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: team messaging. The table is the short version; the sections below add detail.

Slack at a glance

Notes on Slack

Slack's DPA is Salesforce's Data Processing Addendum, and it is not automatic. Slack's page asks an authorized person to execute it, and the PDF says it binds once Salesforce receives your signed copy by email. The PDF header says August 2026 and its footer says April 2026.

Notice of a new sub-processor reaches you only if you subscribe in Salesforce's documentation, with no number of days (section 5.2). You then have 30 days to object, and if Salesforce cannot offer a workaround within 60 days you can terminate with a refund of prepaid fees (section 5.3).

Salesforce's document says Slack customers may select a data region, while some Customer Data can be stored outside it and backups can sit in another country.

Slack DPA: where to find it and how it is accepted

Read the DPA on slack.com. Slack's page says an authorized individual should execute the DPA using the link on the page. That link opens Salesforce's Data Processing Addendum, pre-signed by Salesforce. You complete the signature box, sign on page 6 and email it to dataprocessingaddendum@salesforce.com with your account number. It becomes legally binding once Salesforce receives the completed form, unless the Agreement says otherwise. The PDF header reads "Revision August 2026" and its page footer reads "April 2026"..

Not stated in the source we checked (2026-10-17).

Slack's DPA page and the Salesforce DPA do not list plans. The DPA applies to the Services under the Agreement.

Slack subprocessors: the list and how change notices reach you

Slack's subprocessor list.

How changes are announced: Subscription mechanism in Salesforce's Infrastructure and Sub-processor Documentation (section 5.2).

Not stated in the source we checked (2026-10-17).

Section 5.2: the documentation has a mechanism to subscribe to notifications, and if you subscribe Salesforce notifies you before authorizing a new sub-processor. No number of days is stated.

You can object within 30 days. Salesforce tries to offer a change in the Services or a configuration change to avoid the new sub-processor. If it cannot within sixty (60) days, you may terminate the affected Order Form(s) for those Services and get a refund of prepaid fees without penalty (section 5.3).

Section 5.3: object in writing within thirty (30) days of Salesforce sending the notice under section 5.2.

Where Slack stores data

• United States
• Australia
• Brazil
• Canada
• France
• Germany
• India
• Japan
• Singapore
• South Korea
• Sweden
• Switzerland
• United Arab Emirates
• United Kingdom

You can choose the region.

The Slack section of Salesforce's sub-processor document lists these locations for Amazon Web Services hosting and says customers may select a data region, but certain Customer Data may be stored outside that region. Backups can sit in another country (Germany-region data is backed up in France and the reverse; Sweden-region and Switzerland-region data are backed up in Germany), and data may be transmitted through any Edge region. The document does not say which plans can select a region.

How Slack moves data outside the EU and UK

• DPF (where the importing entity participates)
• Salesforce Processor BCR (listed services)
• SCCs (Modules 2 and 3)
• UK and Swiss terms

Section 12 (the PDF's sub-numbering is garbled): transfers to US entities that take part in the EU-US Data Privacy Framework are not treated as Third-Country Transfers. Otherwise the Salesforce Processor BCR apply to the services listed in its appendix, and SCC Modules 2 and 3 apply, with UK and Swiss provisions in Schedule 1. The appendix of Salesforce's EU and UK Processor BCR (May 2026) lists "Slack (paid subscriptions and associated workspaces)", so the BCR cover paid Slack; the free plan is not named there. The DPA itself does not say which mechanism covers Slack.

Is Slack a processor or a controller?

Processor: it handles your customers' data on your instructions.

Section 2.2: as Processor, Salesforce processes Personal Data on behalf of the customer under documented instructions.

Is Slack GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Slack's own documents say:

• A DPA is published: Slack's page says an authorized individual should execute the DPA using the link on the page. That link opens Salesforce's Data Processing Addendum, pre-signed by Salesforce. You complete the signature box, sign on page 6 and email it to dataprocessingaddendum@salesforce.com with your account number. It becomes legally binding once Salesforce receives the completed form, unless the Agreement says otherwise. The PDF header reads "Revision August 2026" and its page footer reads "April 2026".
• A subprocessor list is published.
• Transfer mechanisms named: DPF (where the importing entity participates), Salesforce Processor BCR (listed services), SCCs (Modules 2 and 3), UK and Swiss terms.
• Data locations named: United States, Australia, Brazil, Canada, France, Germany, India, Japan, Singapore, South Korea, Sweden, Switzerland, United Arab Emirates, United Kingdom.

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add Slack to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use Slack, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Slack | Team messaging | United States; Australia; Brazil; Canada; France; Germany; India; Japan; Singapore; South Korea; Sweden; Switzerland; United Arab Emirates; United Kingdom | DPF (where the importing entity participates); Salesforce Processor BCR (listed services); SCCs (Modules 2 and 3); UK and Swiss terms | [DPA](https://slack.com/terms-of-service/data-processing) | [Subprocessors](https://slack.com/slack-subprocessors) |

Add to my list

If you add or replace Slack: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

In the source we checked, Slack doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from Slack's DPA page, Salesforce's Data Processing Addendum and the Salesforce infrastructure and sub-processors document (published October 2, 2026).

2026-10-17

Re-checked DPA sections 5.2, 5.3 and 12 against the PDF text, the Slack section of the sub-processor PDF (14 locations and the backup notes confirmed) and the Salesforce EU and UK Processor BCR appendices. Corrected: the BCR appendix does list Slack, but only "Slack (paid subscriptions and associated workspaces)". Section 12's sub-numbering is garbled in the PDF, so notes cite the section only.

Related vendors

• Team messaging and collaboration
• PostHog Product analytics
• Sentry Error and performance monitoring
• All vendors

Sources and method

• https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/data-processing-addendum.pdf checked 2026-10-17
• https://slack.com/terms-of-service/data-processing checked 2026-10-17
• https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf checked 2026-10-17

Facts come from Slack's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: slack.com.