[Enforcement library](/enforcement)

# TikTok: an EEA hosting location did not settle the question of remote access from China

The DPC fined TikTok EUR 530 million over EEA-user data transfers to China and transfer transparency. This is separate from the children's-privacy decision.

## Key facts

- **Regulator or court:** Irish Data Protection Commission (DPC)
- **Jurisdiction:** Ireland / European Union
- **Framework:** GDPR Articles 13(1)(f) and 46(1)
- **Record date:** 2025-05-02
- **Procedural status:** DPC decision and conditional transfer order; later appeal or stay status not established

The DPC fined TikTok EUR 530 million over EEA-user data transfers to China and transfer transparency. This is separate from the children's-privacy decision.

Irish Data Protection Commission (DPC) · GDPR Articles 13(1)(f) and 46(1) · Decision: 2 May 2025

## The problem

A transfer assessment has to account for who can remotely access data as well as where the servers are hosted.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | Irish Data Protection Commission (DPC) |
| Jurisdiction | Ireland / European Union |
| Law | GDPR Articles 13(1)(f) and 46(1) |
| Decision date | 2 May 2025 |
| Recorded fine | EUR 530,000,000 |
| Procedural status | DPC decision and conditional transfer order; later appeal or stay status not established |
| Source review | 19 October 2026 |

Primary record: [DPC announcement](https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following).

## What the authority found

The DPC found that TikTok had not demonstrated essentially equivalent protection for EEA-user data remotely accessed by personnel in China. It also found deficiencies in its earlier transfer disclosures. [DPC announcement](https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following).

The DPC distinguished the transfer finding from transparency: its announcement records EUR 485 million for Article 46 and EUR 45 million for Article 13. It found the December 2022 policy compliant for the transfer-transparency matters within the decision's scope. [Authority notice on EDPB](https://www.edpb.europa.eu/news/irish-supervisory-authority-fines-tiktok-eu530-million-and-orders-corrective-measures_en).

## Outcome and limits

The decision imposed EUR 530,000,000 and corrective measures, including a conditional suspension of transfers if processing was not brought into compliance within the stated period. This record does not claim the transfers are currently suspended: later appeals, stays and compliance were not verified. [DPC announcement](https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Inventory remote administrative and support access, including access by overseas group companies.
- Reconcile transfer notices with actual hosting, support and access arrangements.
- Have counsel assess transfer mechanisms, supplementary measures and relevant third-country law.

## How Inth helps

Audits can help identify reviewed outbound data flows and observable vendor destinations.

Inth does not establish Chapter V transfer compliance. A browser scan cannot identify every overseas access path or validate contractual safeguards.

## Sources and limits

- [DPC announcement](https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following)
- [Authority notice on EDPB](https://www.edpb.europa.eu/news/irish-supervisory-authority-fines-tiktok-eu530-million-and-orders-corrective-measures_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.