Ireland's High Court upholds €530 million TikTok fine over data transfers to China

Ireland's High Court has upheld the decision by Ireland's Data Protection Commission (DPC) that TikTok violated the EU's General Data Protection Regulation (GDPR), leaving the €530 million fine in place. At the same time, the court sent another part of the regulator's decision back for review: the order suspending transfers of European TikTok users' data to China.

What the court ruled

TikTok challenged two elements of the DPC decision: the GDPR violation finding along with the fine, and a separate order to halt cross-border data transfers. The High Court split these issues and ruled differently on each.

• Fine: €530 million, imposed by the Irish regulator DPC for violating the GDPR
• The court upheld both the fine and the violation finding
• The order to suspend data transfers to China goes back to the regulator for reconsideration
• The regulator in the case is the Data Protection Commission (DPC), TikTok's lead supervisory authority in the EU

Why Ireland regulates TikTok

TikTok's European headquarters is registered in Dublin, so under the GDPR's "one-stop-shop" mechanism, Ireland's DPC acts as the company's lead regulator for the entire EU. Any investigation into how TikTok processes European users' data ultimately runs through the Irish authority. That is why Irish court rulings on TikTok affect not just Ireland but all 27 EU member states, and why the process drags on for years across multiple levels of appeal.

Where third-country data transfers come in

The GDPR separately governs transfers of personal data outside the EU. A company must show that data leaving the EU is protected at least as well as it is inside the bloc, either through an official adequacy decision covering the destination country or through its own contractual safeguards. This part of the regulation became the subject of separate proceedings in the TikTok case, distinct from the GDPR violation itself, for which the company was fined.

What happens to data transfers to China now

Sending the issue back for review does not automatically lift the ban. The DPC must reconsider the arguments and issue a new decision that takes the court's guidance into account. While that review is underway, the status of the suspension order remains uncertain: TikTok gets a reprieve on this specific point, even though it lost on the main question of the GDPR violation. The court documents do not specify a deadline for the DPC's new decision, nor an exact date when the company will learn the final verdict on data transfers.

What it means

The case shows that European regulators are tightening control not only over how tech companies collect personal data, but also over where that data goes outside the EU. For TikTok, the outcome is mixed. The reputational and financial hit from the upheld fine stands, but the company now has a chance to defend its position on the most sensitive point, data transfers to China, and the case is not yet closed.

FAQ

How much was TikTok fined?

€530 million. Ireland's Data Protection Commission imposed the fine for violating the GDPR, and Ireland's High Court upheld that decision.

Has the ban on TikTok's data transfers to China been lifted?

No. The court neither overturned nor upheld the ban. Instead, it sent this point back to the DPC for reconsideration, and there is no final decision on it yet.