TikTok let staff in China access EEA user data — €530M GDPR fine

In May 2025 Ireland's Data Protection Commission, TikTok's lead regulator in the EU, fined the platform €530 million for infringing the GDPR over transfers of European users' personal data to China. It was one of the largest data-protection fines ever issued in the European Union.

The DPC found TikTok could not verify, guarantee or demonstrate that personal data of EEA users, remotely accessed by staff in China, was given a level of protection essentially equivalent to that guaranteed in the EU. The regulator also said TikTok did not address the potential access by Chinese authorities to EEA data under Chinese anti-terrorism, counter-espionage and other laws that diverge materially from EU standards.

The DPC ordered TikTok to bring its processing into compliance within six months and warned it would suspend transfers to China if the platform did not. It also found TikTok had given inaccurate information during the inquiry: TikTok had claimed it did not store European users' data on servers in China, then told the regulator it had discovered in February that limited EU data had in fact been stored on Chinese servers, contrary to its earlier statements.

TikTok disagreed with the decision and said it would appeal in full, pointing to Project Clover, a €12 billion data-security programme it introduced in 2023, and noting the decision focused on a period before that programme. It said the DPC itself had recorded that TikTok had never handed European user data to Chinese authorities.