TikTok fined EUR 530 million for failing to demonstrate essential equivalence under Chinese law
Subject: TikTok Technology Limited (Ireland)
What happened
TikTok relied on the EU Standard Contractual Clauses plus supplementary measures to let staff in China remotely access the personal data of EEA users. As lead supervisory authority the Irish DPC examined whether those transfers were lawful and whether users were adequately informed about them.
How it was handled
During the inquiry TikTok’s own assessment of Chinese law showed that the Anti-Terrorism Law, Counter-Espionage Law, Cybersecurity Law and National Intelligence Law diverge materially from EU standards in several respects. The DPC found TikTok had failed to verify, guarantee and demonstrate that the SCCs and supplementary measures secured a level of protection essentially equivalent to the EU for remotely accessed data, infringing Art. 46(1). It also found the October 2021 EEA privacy policy inadequate for Art. 13(1)(f) purposes (infringement period 29 July 2020 to 1 December 2022), while the December 2022 policy was assessed as compliant. The draft decision went to the Art. 60 cooperation mechanism on 21 February 2025 and drew no objections.
Outcome
Administrative fines totalling EUR 530 million — EUR 485 million for the Art. 46(1) infringement and EUR 45 million for Art. 13(1)(f) — plus an order to bring processing into compliance within six months and a suspension order on transfers to China if it does not. Separately, in April 2025 TikTok told the DPC that in February 2025 it had discovered limited EEA user data had in fact been stored on servers in China, contrary to the evidence it gave the inquiry; the DPC said it is considering further regulatory action with peer authorities.
What it means for Chinese exporters
- · Before you tell anyone "the data never leaves the region", account for remote access: engineers in China reading EU user data through a bastion host, an ops console or a model-debugging platform is a Chapter V transfer under the GDPR, regardless of where the bytes physically sit.
- · Do not outsource the transfer impact assessment to a template. TikTok was undone by its own assessment of Chinese law: once an assessment concedes that local law diverges materially from EU standards, it must be paired with technical measures that actually neutralise that divergence (end-to-end encryption with keys held outside the jurisdiction, verifiable access-denial mechanisms), or the assessment becomes the regulator’s evidence.
- · Spell out transfer disclosures item by item as Art. 13(1)(f) requires: destination country, categories of recipient, the transfer mechanism relied on, and how to obtain a copy of it. "We may share data with affiliates" does not satisfy the article — that single point cost EUR 45 million here.
- · Every statement you give a regulator must survive later self-verification. The real second-order risk in this case was not the fine but having supplied inaccurate information — put quarterly, evidenced testing of actual data-storage locations in place instead of relying on verbal confirmation from business lines.
Sources (1)
- Irish DPC fines TikTok EUR 530 million over transfers of EEA user data to ChinaData Protection Commission of Ireland (DPC) · published 2025-05-02 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.