The encyclopedia · Legal & Compliance · Legal decision · 2025
Irish regulator fined TikTok €530 million for sending European data to China
The DPC found TikTok's transfers to China breached GDPR and its privacy policy hid the fact — the second-largest fine the watchdog had ever issued
TikTok Technology Limited · ByteDance · 2025-05-02
What happened
On May 2, 2025, the Irish Data Protection Commission fined TikTok Technology Limited €530 million — €485 million for unlawful transfers of European Economic Area user data to China and €45 million for a transparency failure — and ordered corrective measures. It was among the largest fines the DPC had ever imposed.
The DPC found TikTok's transfers to China breached Article 46(1) of the GDPR because it failed to verify, guarantee and demonstrate that its standard contractual clauses and supplementary measures actually gave EEA users' data protection equivalent to the EU's. The regulator had regard to Chinese laws TikTok itself identified as diverging from EU standards, including the Counter-Espionage Law and Cybersecurity Law.
Separately, TikTok breached Article 13(1)(f) GDPR from July 2020 to December 2022 because its privacy policy did not name the third countries receiving data or explain that personnel based in China remotely accessed data stored elsewhere. The DPC ordered TikTok to bring its transfers into compliance within six months or face a suspension of transfers to China.
Why it happened
- TikTok relied on standard contractual clauses as a formality without proving they actually protected EEA users' data once Chinese law could force access
- Its privacy policy hid the very fact of transfers to China and remote access from personnel there, so users were never told where their data went — the transparency failure that drew a separate fine
The lesson
Using an approved legal mechanism is not compliance — a transfer tool is only lawful if you can prove it protects the data, and hiding the destination from users turns a transfer risk into a fine
Aftermath
TikTok said it would consider the decision and had already strengthened its data-handling practices. The ruling became a landmark for how regulators police international data transfers and the disclosure of where user data really goes.
Sources
- Irish DPC — DPC fines TikTok €530 million and orders corrective measures
- DSN Group — TikTok receives fine of €530 million by Irish DPC
spotted an error? The club wants to know.
More like this
Twitter bought Vine and then shut it down — letting TikTok fill the vacuum
Orkut was Google's first social network — then Facebook outgrew it and Google killed it
Twitter's 140-character limit was a technical constraint — it became the defining feature
Somewhere, someone solved the problem this company failed at. 2nd Opinion →
Comments · 0
Sign in to join the comments.