TikTok hit with €530m fine over GDPR breach

The Irish Data Protection Commission has fined TikTok €530 million ($600m) and has a six month deadline to comply with GDPR rules.
If the social platform fails to comply within the given timeframe, its data transfers to China will be suspended.
The Irish DPC found TikTok in breach of GDPR for both unlawfully transferring EEA user data to China and failing to meet transparency requirements in informing users about these transfers.
The DPC submitted its draft decision on February 21, 2025, under the GDPR cooperation mechanism, with no objections raised by other EU/EEA authorities. The DPC expressed gratitude for their cooperation.
Moreover, the DPC said it submitted its draft decision on February 21st, 2025, under the GDPR cooperation mechanism, with no objections raised by other EU/EEA authorities.
TikTok blunder
The DPC said TikTok initially reported it didn’t store EEA user data in China, but in April 2025 it admitted that some data had been stored there, revealing it had unknowingly provided inaccurate information during the inquiry.
“TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU," said DPC deputy commissioner Graham Doyle in a post.
“As a result of TikTok’s failure to undertake the necessary assessments, TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage and other laws identified by TikTok as materially diverging from EU standards.”
“The DPC is taking these recent developments regarding the storage of EEA User Data on servers in China very seriously. Whilst TikTok has informed the DPC that the data has now been deleted, we are considering what further regulatory action may be warranted, in consultation with our peer EU Data Protection Authorities.”