It provides a right to privacy if the company allows personal messaging services on the device, but I don't think it provides a right to having personal messaging apps on the device(s).

Personally I think it's much cleaner to keep work stuff on your work device(s) and personal stuff on personal devices. The only place that gets sticky is where companies don't provide the device but want you to have work information on it (e.g. mobile phones)

It is a right in EU to have some level of personal activity on work-supplied devices. This does not come from the GDPR but some other legislation. We had a call with HR about that only recently when some leader again suggested "just block xyz on work devices".

And if you don't want to use BYOD we are required to supply a phone if we require employees to use one (which we do, for MFA).