TikTok: an EEA hosting location did not settle the question of remote access from China
The DPC fined TikTok EUR 530 million over EEA-user data transfers to China and transfer transparency. This is separate from the children’s-privacy decision.
The problem
A transfer assessment has to account for who can remotely access data as well as where the servers are hosted.
€530m
- Regulator or court
- Irish Data Protection Commission (DPC)
- Jurisdiction
- Ireland / European Union
- Framework
- GDPR Articles 13(1)(f) and 46(1)
- Decision
- Procedural status
- DPC decision and conditional transfer order; later appeal or stay status not established
International data transfers · Notice, consent scope and assent
Case record
- Irish Data Protection Commission (DPC)
- Ireland / European Union
- GDPR Articles 13(1)(f) and 46(1)
- 2 May 2025
- EUR 530,000,000
- DPC decision and conditional transfer order; later appeal or stay status not established
- 19 October 2026
Primary record: DPC announcement.
What the authority found
The DPC found that TikTok had not demonstrated essentially equivalent protection for EEA-user data remotely accessed by personnel in China. It also found deficiencies in its earlier transfer disclosures. DPC announcement.
The DPC distinguished the transfer finding from transparency: its announcement records EUR 485 million for Article 46 and EUR 45 million for Article 13. It found the December 2022 policy compliant for the transfer-transparency matters within the decision’s scope. Authority notice on EDPB.
Outcome and limits
The decision imposed EUR 530,000,000 and corrective measures, including a conditional suspension of transfers if processing was not brought into compliance within the stated period. This record does not claim the transfers are currently suspended: later appeals, stays and compliance were not verified. DPC announcement.
Checks for your own systems
These are implementation checks suggested by Inth, not additional findings about the company.
- Inventory remote administrative and support access, including access by overseas group companies.
- Reconcile transfer notices with actual hosting, support and access arrangements.
- Have counsel assess transfer mechanisms, supplementary measures and relevant third-country law.
How Inth helps
Audits can help identify reviewed outbound data flows and observable vendor destinations.
Inth does not establish Chapter V transfer compliance. A browser scan cannot identify every overseas access path or validate contractual safeguards.
Sources and limits
Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.