530 million euros for sending users to China

Tiktok It has been sanctioned with a fine of 530 million euros for violating the General Data Protection Regulation (RGPD). The social network, owned by Bytedance, allowed remote access from China to data from European users, without guaranteeing a level of protection equivalent to that of the European Union. In addition, in February 2025 it was discovered that part of that data had been stored in Chinese servants, contradicting what the company itself had declared during the investigation.

The blow is not there. In addition to the economic sanction, the Ireland Data Protection Commission (DPC) has given Tiktok a period of six months to adapt the data processing to the RGPD requirements. If you do not do it within that period, all data transfers to the Asian country will be suspended.

What has happened exactly. The investigation has been led by the DPC, main authority by having Tiktok Technology Limited headquarters in Ireland. The final report concludes that Tiktok did not guarantee a level of protection equivalent to the European in data transfers, and did not properly evaluate the risk of access by the Chinese authorities.

Graham Doyle, an attached commissioner of the DPC, summarized it as follows: “Tiktok did not carry out the necessary evaluations and did not address the risk of access to personal data by the Chinese authorities in accordance with anti -terrorist laws, counter -signs and other norms identified by the company itself as materially divergent of the EU standards.”

Breakdown of the sanction. The fine imposed is broken down into two concepts that respond to two different articles of the RGPD:

• 485 million euros for violating the Article 46(1), by making data transfers between the European Economic Space (EEE) and China without adequate safeguards or guarantees of equivalent protection.
• 45 million euros for violating the Article 13(1) (F), by not informing properly in its October 2021 privacy policy about the data recipients of the data, including China. This infraction extends from July 29, 2020 to December 1, 2022, at which time Tiktok updated its policy.

Background: A suspicion of 2021. Research dates back to 2021When doubts arose about whether engineers in China could access European user data. Then, the DPC opened a formal investigation to verify the legality of data transfers outside the EEE. At that time, Tiktok said he did not store European data in China, although he acknowledged that there could be remote access from the country.

Version and contradiction changes. In April 2025, Tiktok notified the DPC that he had discoveredtwo months before, a case in which a limited amount of European user data had been stored on Chinese servers, contradicting their previous statements. The company indicated that these data have already been eliminated, but this finding has weighed in the regulator’s final decision.

Why this is important. The RGPD establishes that personal data can only be transferred outside the EEE if the receiving country guarantees an essentially equivalent level of protection. In the absence of a “adaptation decision” by the European Commission (which China does not have), additional measures must be applied, such as standard contractual clauses and risk assessments. Tiktok did not meet these requirements.

Tiktok defends himself. The company has announced that the decision will resort. According to BloombergTiktok states that he has never received a request for European user data from Chinese authorities, and that he has not provided any information.

Ireland’s role in all this. Although the European Data Protection Committee (CEPD) includes about twenty authorities, the Irish DPC leads this case because it is the main Tiktok regulator in Europe. It is not the first time he does: in 2023, I fined the social network with 345 million euros for not properly protecting the privacy of minors.

Images | Mourizal Zativa | Christian Lue

In Xataka | Apple loses the war against Epic. Fortnite returns triumphant and Spotify already prepares its rematch