In May 2025, Ireland’s Data Protection Commission (DPC) issued a sky-high €530 million (roughly Rs. 4.366 billion) fine against Tik Tok, setting another record for high penalties since the implementation of the EU’s General Data Protection Regulation (GDPR).
The penalty was aimed squarely at Tik Tok’s transfer of European user data to China, finding it in violation of the GDPR’s provisions on cross-border data transfers and transparency.
This is not only an ordinary regulatory penalty, but also reflects the increasingly fierce battle for “data sovereignty” in global digital governance.
01
Data transfer compliance questioned
The DPC’s investigation, which began in September 2021, focused on the legality of Tik Tok’s transfers of EEA user data to China.
The investigation found that, despite claiming to safeguard data through standard contractual clauses (SCCs), Tik Tok failed to demonstrate that the level of data protection in the Chinese legal environment is substantially equivalent to the EU General Data Protection Regulation.
At the same time, the Irish Data Protection Commission specifically noted that TikTok’s failure to adequately assess what level of protection Chinese law and practice provides for EU users’ personal data processed in China not only directly impacts TikTok’s ability to select appropriate safeguards and complementary measures, but also results in TikTok’s inability to validate and guarantee a substantially equivalent level of protection in China and Europe.
More seriously, TikTok had denied storing EU user data on Chinese servers during the course of the investigation, yet admitted in April 2025 that some of the data did exist in China, an inconsistency that further fueled the regulator’s skepticism.
02
Transparency deficiencies and pressure to rectify
In addition to the data transfer issue, TikTok was also fined €45 million for transparency deficiencies.
The investigation revealed that between July 2020 and December 2022, TikTok’s privacy policy violated GDPR disclosure requirements by failing to explicitly inform users that their data could be transferred to China and accessed remotely by Chinese employees. Although TikTok updated its privacy policy in 2022, the prior violations were retroactively penalized.
To ensure data security and user privacy, the DPC has asked TikTok to complete the rectification within six months or face a data transfer ban.
Notably, this is the second large fine TikTok has suffered in the EU – it was fined €345 million in 2023 for handling children’s data – showing the continued high pressure of EU regulation.
03
Compliance Dilemma in the Shadow of Geopolitics
In the face of the punishment, TikTok said it will appeal, and stressed that it has invested 12 billion euros in the implementation of the “Cloverleaf Plan” to build data centers in Ireland and Norway to achieve the localization of European user data storage.
However, the regulator believes that as long as ByteDance exists as a Chinese parent company, it cannot rule out the risk of Chinese law requiring it to provide data.
Behind this distrust is a deeper game of “digital sovereignty”: the European Union has strengthened its regulatory autonomy through the GDPR and the Digital Marketplace Act, while the U.S. has pressured TikTok to divest its business on national security grounds, and all parties are vying for dominance in data governance.
For TikTok, the fine is only a superficial loss, but the bigger challenge lies in how to establish a sustainable compliance model in the regulatory gap between China and the West.
For enterprises going overseas, establishing localized data storage, improving transparency mechanisms and proactively participating in regulatory dialogues will become mandatory lessons for survival.
The storm also signals a trend: in the digital era, data is not only a commercial asset, but also a national strategic resource, and whoever grasps the right to data governance will win the dominance of future competition.
Article source: www.tiktokdatatool.com
