TikTok

TikTok fined €530m for breach of GDPR

Social network admits transferring data to China
Life
Image: cottonbro via Pexels

2 May 2025

The Irish Data Protection Commission (DPC) has fined TikTok €530 million for breaches of the General Data Protection Regulation (GDPR) relating to the social network’s transfer of EU citizens’ personal data to servers in China.

On top of the fine, the DPC issued an order giving the social network six months to bring its processing into line with GDPR. The decision also includes an order suspending TikTok’s transfers to China if processing is not brought into compliance within this timeframe.

TikTok informed the DPC that it did not store EEA (European Economic Area) user data on servers located in China. However, in April 2025, TikTok informed the DPC of an issue that it had discovered in February 2025 where limited EEA user data had in fact been stored on servers in China, contrary to TikTok’s evidence to the Inquiry. TikTok informed the DPC that this discovery meant that TikTok had provided inaccurate information to the Inquiry.

DPC Deputy Commissioner Graham Doyle said: “The GDPR requires that the high level of protection provided within the European Union continues where personal data is transferred to other countries. TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU.

“As a result of TikTok’s failure to undertake the necessary assessments, TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage and other laws identified by TikTok as materially diverging from EU standards.”

Deputy Commissioner Doyle added: “The DPC is taking these recent developments regarding the storage of EEA user data on servers in China very seriously. Whilst TikTok has informed the DPC that the data has now been deleted, we are considering what further regulatory action may be warranted, in consultation with our peer EU data protection authorities.”

TechCentral Reporters

Read More:


Back to Top ↑

TechCentral.ie