TikTok hit with €530 million GDPR fine for transferring EU data to China

Introduction

The Irish Data Protection Commission (DPC) has slapped TikTok with a massive €530 million fine for illegally transferring European users' personal data to China and failing to be transparent about these transfers. This landmark decision, announced in May 2025, represents one of the largest penalties ever imposed under the General Data Protection Regulation (GDPR) and signals growing regulatory scrutiny of data flows between Europe and China.

The fine against TikTok Technology Limited breaks down into €485 million for violations related to data transfers and €45 million for transparency failures. Beyond the financial penalty, the Irish regulator has ordered TikTok to bring its processing operations into compliance within six months or face suspension of all data transfers to China.

This case highlights the increasing tensions between global tech platforms and European data protection laws, particularly when it comes to data transfers to countries with surveillance regimes that conflict with EU privacy standards.

Table of contents

1. Background of the TikTok investigation
2. Key findings from the Irish DPC
3. Data transfer violations explained
4. Transparency breaches detailed
5. TikTok's response to the fine
6. Project Clover and TikTok's compliance efforts
7. Misleading information provided during investigation
8. Data transfers under GDPR
9. Chinese surveillance laws and EU data protection
10. Implications for other companies transferring data to China
11. The €530 million fine in context
12. What happens next for TikTok
13. How compliance software can help prevent GDPR violations

Background of the TikTok investigation

The Irish DPC launched its investigation into TikTok's data practices to examine whether the company's transfers of European Economic Area (EEA) users' personal data to China were lawful under GDPR. The investigation also scrutinized whether TikTok was providing adequate information to users about these transfers.

The case centered on TikTok's practice of allowing staff based in China to remotely access European user data stored on servers in Singapore and the United States. This investigation was particularly significant because it marked the first time a European regulator has taken a formal stance on data transfers to China under GDPR.

The DPC, which serves as TikTok's lead supervisory authority in Europe due to the company's EU headquarters being located in Ireland, submitted its draft decision through the GDPR cooperation mechanism in February 2025. Notably, no objections were raised by other European data protection authorities, indicating unanimous support for the Irish regulator's findings.

Key findings from the Irish DPC

The DPC's investigation concluded with two main findings against TikTok:

1. Data transfer violations: TikTok infringed Article 46(1) of GDPR by failing to ensure that personal data transferred to China was protected at a level "essentially equivalent" to that guaranteed under EU law.

2. Transparency failures: TikTok breached Article 13(1)(f) of GDPR by not adequately informing users about transfers of their data to China in its privacy policy between July 2020 and December 2022.

The decision was made by the Commissioners for Data Protection, Dr. Des Hogan and Mr. Dale Sunderland, following a thorough investigation into TikTok's data handling practices.

DPC Deputy Commissioner Graham Doyle emphasized that "TikTok's personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU."

Data transfer violations explained

The core of TikTok's violation related to its inability to properly assess and mitigate the risks associated with Chinese access to European user data. Under GDPR's Chapter V provisions, companies transferring data outside the EU must ensure that the receiving country provides adequate protection for personal data.

Since China does not have an adequacy decision from the European Commission (unlike countries such as Canada, Japan, or the UK), TikTok was required to implement additional safeguards, typically through Standard Contractual Clauses (SCCs).

However, the DPC found that TikTok failed to properly assess whether these safeguards were effective in the context of Chinese laws that grant authorities broad access to data. TikTok's own assessment acknowledged that certain Chinese laws - including the Anti-Terrorism Law, Counter-Espionage Law, Cybersecurity Law, and National Intelligence Law - "materially diverge from EU standards."

The regulator determined that TikTok did not adequately address the potential access that Chinese authorities might have to European user data under these laws. By failing to conduct a proper assessment, TikTok couldn't implement appropriate supplementary measures to protect the data.

Transparency breaches detailed

The second major violation concerned TikTok's failure to properly inform users about data transfers to China. Article 13(1)(f) of GDPR requires companies to tell users when their personal data is being transferred to third countries.

The DPC found that TikTok's October 2021 EEA Privacy Policy was inadequate in two key ways:

1. It did not explicitly name China as a destination for data transfers
2. It failed to explain that processing included remote access to data stored in Singapore and the United States by personnel in China

TikTok subsequently updated its privacy policy in December 2022 to address these issues. The new policy identified the specific third countries where data was transferred, including China, and explained that data stored on servers in the US and Singapore could be remotely accessed by TikTok employees in Brazil, China, Malaysia, Philippines, Singapore, and the United States.

The DPC determined that this updated policy resolved the transparency issues, which is why the violation period was limited to July 2020 through December 2022.

TikTok's response to the fine

TikTok has strongly contested the DPC's findings and announced plans to appeal the decision in full. The company expressed disappointment at being "singled out despite relying on the same legal mechanism employed by thousands of other companies providing services in Europe."

Christine Grahn, TikTok's head of public policy and government relations for Europe, emphasized that the company "has never received a request for European user data from the Chinese authorities, and has never provided European user data to them."

TikTok also warned that the ruling "risks setting a precedent with far-reaching consequences for companies and entire industries across Europe that operate on a global scale" and "delivers a blow to the European Union's competitiveness."

The company's response highlights the tension between global tech operations and regional data protection laws, particularly when it comes to cross-border data flows.

Project Clover and TikTok's compliance efforts

TikTok pointed to its €12 billion investment in "Project Clover" as evidence of its commitment to European data protection. This initiative involves building multiple data centers within Europe to store European user data locally, rather than on servers in Singapore or the United States.

The first of these European data centers opened in Ireland, with additional facilities planned in Norway and other EU locations. TikTok has presented Project Clover as a comprehensive solution to concerns about data transfers to China, as it would theoretically eliminate the need for such transfers.

However, the Irish DPC determined that these efforts, while positive, were insufficient to address the violations identified in its investigation. The regulator noted that despite Project Clover's implementation, TikTok still needed to bring its data transfer operations into full compliance with GDPR requirements.

This suggests that even localized data storage may not fully resolve concerns if there remains any possibility of remote access from countries with surveillance laws incompatible with EU privacy standards.

Misleading information provided during investigation

In a troubling development, the DPC revealed that TikTok had provided incorrect information during the investigation. Throughout the inquiry, TikTok had consistently stated that it did not store EEA user data on servers in China.

However, in April 2025, TikTok informed the DPC that it had discovered in February 2025 that "limited EEA User Data" had actually been stored on servers in China, contrary to the company's previous statements. This discovery meant TikTok had provided inaccurate information to investigators.

While TikTok informed the regulator that this data has since been deleted from Chinese servers, Deputy Commissioner Doyle stated that the DPC is "taking these recent developments regarding the storage of EEA User Data on servers in China very seriously" and is "considering what further regulatory action may be warranted."

This discrepancy raises additional questions about TikTok's data management practices and could potentially lead to further enforcement actions beyond the current fine.

Data transfers under GDPR

To understand the significance of this case, it's important to grasp how GDPR regulates international data transfers. GDPR's Chapter V outlines strict requirements for sending personal data outside the European Economic Area.

The primary mechanism for lawful transfers is an "adequacy decision" from the European Commission, which certifies that a particular country ensures an adequate level of data protection. Currently, adequacy decisions exist for:

For countries without adequacy decisions, like China, companies must implement additional safeguards through mechanisms such as Standard Contractual Clauses (SCCs). However, following the landmark Schrems II decision by the European Court of Justice in 2020, companies cannot rely solely on SCCs if the receiving country's surveillance laws undermine the protection they provide.

Instead, companies must assess the legal framework of the destination country and implement supplementary measures to ensure GDPR-level protection. If this isn't possible, the data transfer should not occur.

Chinese surveillance laws and EU data protection

The TikTok case highlights the fundamental conflict between Chinese national security laws and EU data protection principles. Several Chinese laws grant authorities broad powers to access data held by companies:

• Anti-Terrorism Law: Requires companies to provide technical support and assistance to authorities in terrorism prevention and investigation activities
• Counter-Espionage Law: Mandates that organizations and individuals support and assist counter-espionage work
• Cybersecurity Law: Gives authorities broad powers to conduct security inspections of network operators
• National Intelligence Law: Obligates organizations and citizens to support, assist, and cooperate with intelligence work

These laws create a legal environment where Chinese authorities can potentially access personal data with limited independent oversight or judicial review. This stands in stark contrast to GDPR's principles of purpose limitation, data minimization, and protection against unauthorized access.

TikTok's own assessment acknowledged these divergences from EU standards, which proved critical in the DPC's finding that the company failed to ensure essentially equivalent protection for transferred data.

Implications for other companies transferring data to China

The TikTok decision sets a precedent that could have far-reaching consequences for any organization transferring personal data from Europe to China. It signals that European regulators are taking a stricter approach to assessing the adequacy of protection for such transfers.

Companies operating across Europe and China will need to:

1. Conduct thorough transfer impact assessments focused specifically on Chinese surveillance laws
2. Implement robust supplementary measures beyond standard contractual clauses
3. Consider data localization strategies to minimize transfers to China
4. Be fully transparent with users about any data flows to China

This ruling may accelerate the trend toward data localization, with more companies following TikTok's lead in establishing European data centers to avoid cross-border transfers entirely. However, even with data stored in Europe, companies will need to carefully control remote access from countries like China.

The decision also highlights the growing geopolitical tensions in digital trade, as different regions establish incompatible regulatory regimes for data governance. This fragmentation creates significant compliance challenges for global companies.

The €530 million fine in context

The €530 million penalty imposed on TikTok ranks as the third-largest fine ever issued under GDPR. Only Luxembourg's €746 million fine against Amazon in 2021 and Ireland's €1.2 billion fine against Meta in 2023 exceed it.

This substantial financial penalty reflects the seriousness with which European regulators view data transfer violations, particularly when they involve countries with extensive surveillance powers. The breakdown of the fine - €485 million for transfer violations and €45 million for transparency failures - indicates that regulators consider the data transfer issues significantly more serious.

The size of the fine also demonstrates the DPC's willingness to impose substantial penalties against major tech platforms. The Irish regulator has faced criticism in the past for moving slowly on complaints against tech giants, but this decision, along with recent actions against Meta, signals a more assertive approach.

What happens next for TikTok

TikTok faces several critical decision points following this ruling:

1. Appeal process: The company has announced its intention to appeal the decision in full. This legal challenge could take years to resolve through the Irish courts and potentially the European Court of Justice.

2. Six-month compliance deadline: Regardless of the appeal, TikTok has been given six months to bring its data processing operations into compliance with GDPR's Chapter V requirements. If it fails to do so, it must suspend all data transfers to China.

3. Potential further investigations: The DPC indicated it is considering additional regulatory action regarding TikTok's incorrect statements about storing European user data in China. This could lead to further penalties.

4. Accelerating Project Clover: TikTok will likely fast-track its European data localization efforts to minimize the need for any data transfers to China.

The case may also inspire similar investigations by other data protection authorities across Europe, potentially leading to a coordinated approach to Chinese data transfers more broadly.

How compliance software can help prevent GDPR violations

The TikTok case demonstrates the complexity of GDPR compliance, particularly regarding international data transfers. Organizations handling personal data can benefit significantly from specialized compliance software to navigate these challenges.

Compliance platforms like ComplyDog offer comprehensive solutions that help companies:

1. Map data flows: Identify and document all cross-border transfers of personal data, ensuring no transfers slip through unnoticed.

2. Conduct transfer impact assessments: Systematically evaluate the legal frameworks of destination countries and assess whether appropriate safeguards are in place.

3. Implement appropriate safeguards: Deploy and manage standard contractual clauses and supplementary measures for different types of transfers.

4. Maintain transparent documentation: Generate and update privacy notices that clearly communicate to users where their data is being transferred.

5. Monitor regulatory changes: Stay updated on evolving requirements and new adequacy decisions that may affect compliance obligations.

6. Demonstrate accountability: Maintain detailed records of all compliance activities to satisfy regulatory inquiries.

With GDPR fines reaching hundreds of millions of euros, investing in proper compliance tools is not just a regulatory necessity but a sound business decision. The TikTok case shows that regulators are particularly focused on international data transfers and transparency requirements - precisely the areas where compliance software provides the most significant value.

By implementing a systematic approach to data protection compliance, companies can avoid costly penalties while building trust with their users. As global data protection regulations continue to evolve, having adaptable compliance systems becomes increasingly crucial for businesses of all sizes.