Is Slack one-on-one direct message private ?

Nothing is private on a device you don't own.

Rat their user to their client

Assuming you actually mean “Can the client review messages sent on the platform they pay for, so their employees can use it”, yes, they can. Same for MS Teams.

Why do you think that is “ratting”?

If you are concerned about what you are messaging a colleague, it probably shouldn’t be messaged on your employer’s chat platform.

Nothing you do at work, on their network and software, is private

HR showed me screenshots of a private chat during a harassment suit, so no, it is not private.

Yes, slack makes private messages available to admins, though it can vary by country laws

You should assume that they're not private since E2EE is not an advertised feature.

Data exports start with their business+ plan If they're running that or Enterprise the admins can pull whatever they need.

You can obviously pull stuff through legal request without any difficulty for any plan.

For a company, it's essential to be able to monitor/review employee communications for legal/compliance reasons. That said, while you should assume that any communication made with your official email/slack/teams/whatever can be seen by the company if it needs to be (e.g. somebody sues for something, even something potentially unrelated to you, that creates a need to search for relevant records), it's unlikely that Slack is actively reporting your conversations to your boss.

As others have said, if you don't want your company to see something you're saying, don't say it at work or on their platforms. In the U.S. at least, you have no expectation of privacy at work. If you're worried about something you've already said, you might just be screwed. ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯

The company paying for the slack workspace would have some employees who can see direct messages and private channels.

But let's be clear, nothing proactive happens. Workspace admins have more important things to do than look at DMs between employees.

The only time a review should happen is when HR requests data for something.

Rule 5. Locking.

I heard at an old company that being able to read DMs was an extra feature which needed to be paid for, and that my particular company didn't have it.

That didn't sound right to me. Especially if the employees could be misusing company property by bullying or selling drugs to each other or something. Surely there would be some legal liability they'd need to cover themselves for?

Depends, for companies on a Pro plan or below they have to request it and slack will only approve said request if required to by law or other legal requirement (or consent of user in question)

Above that plan, only Workspace Owner admins specifically can access it. A workspace owner is the one who originally signed up for the plan and users directly designated to be a Workspace Owner from the original one.

Frankly, if it's something that can get you in trouble DON'T use a work thing for it whatsoever! Be it slack, your work computer or work email.

If you want to talk about such things with a coworker, ask for their damn phone number or find them on SM, seriously, keep it off work stuff. There's always a way to access even supposedly private stuff if done on a work device or service.

Source: IT head