DPC TikTok Fine: Ireland Imposes €530 Million Over Data Transfers to China

What the DPC found

According to the DPC's announcement, TikTok's transfers to China, made through remote access by staff in China, infringed Article 46(1) GDPR. TikTok failed to verify, guarantee and demonstrate that the standard contractual clauses and supplementary measures it relied on ensured a level of protection essentially equivalent to that in the EU. The DPC noted that TikTok's own assessment of Chinese law identified laws that materially diverge from EU standards, including the Anti-Terrorism Law, the Counter-Espionage Law, the Cybersecurity Law and the National Intelligence Law, and that TikTok did not address potential access by Chinese authorities.

The DPC also found that TikTok's 2021 EEA privacy policy infringed Article 13(1)(f) GDPR because it did not name the third countries, including China, to which data was transferred, or explain the nature of the processing.

The penalty and orders

• A fine of EUR 485 million for the infringement of Article 46(1) GDPR.
• A fine of EUR 45 million for the infringement of Article 13(1)(f) GDPR.
• An order to bring processing into compliance within six months.
• An order suspending TikTok's transfers to China if processing is not brought into compliance in that period.

The DPC submitted its draft decision to the GDPR cooperation mechanism on 21 February 2025 and no objections were raised by other supervisory authorities.

Further regulatory action possible

The DPC disclosed that, throughout the inquiry, TikTok had said it did not store EEA user data on servers in China. In April 2025 TikTok informed the DPC of an issue discovered in February 2025 under which limited EEA user data had in fact been stored on Chinese servers. TikTok told the DPC that the data has been deleted. The DPC said it is considering what further regulatory action may be warranted, in consultation with its peer authorities.

Why it matters

The decision confirms that remote access from a third country is treated as a transfer and that companies must carry out, and act on, a genuine assessment of the destination country's laws. Any business that allows staff or service providers outside the EEA to access EU personal data should review its transfer impact assessments in light of it.

Sources

• Data Protection Commission: Irish Data Protection Commission fines TikTok EUR 530 million (2 May 2025)
• EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)