Irish High Court Upholds €530 Million TikTok Fine Over Data Transfer to China

The Irish High Court confirmed the decision of the Irish Data Protection Commission (DPC) that TikTok violated the European GDPR data protection regulation and upheld a fine of 530 million euros. At the same time, the court sent another part of the regulator's decision — an order to suspend the transfer of data of European TikTok users to China — back for reconsideration.

What the Court Established

TikTok challenged both elements of the DPC decision: the fact of GDPR violation with a fine and a separate order to stop cross-border data transfer. The High Court divided these issues and issued different rulings on each.

• Fine — 530 million euros, imposed by Irish regulator DPC for GDPR violation
• The court confirmed the legitimacy of the fine and the fact of violation itself
• The order to suspend data transfer to China was sent to the regulator for new consideration
• The regulating authority in the case — Data Protection Commission (DPC), the leading EU supervisory body for TikTok

Why Ireland Regulates TikTok

TikTok's European headquarters is registered in Dublin, so under the GDPR "one-stop shop" mechanism, the Irish DPC acts as the lead regulator for the company across the entire European Union: any investigation into how TikTok handles European user data ultimately goes through the Irish supervisory authority. This is why decisions of the Irish court on TikTok concern not just Ireland, but all 27 EU countries, and the process itself takes years and includes several levels of appeal.

What Do Data Transfers to Third Countries Have to Do With It

GDPR separately regulates the transfer of personal data outside the European Union: a company must justify that data leaving the EU is protected no worse than within the bloc — either through an official adequacy decision in the destination country or through its own contractual guarantees. It was precisely this part of the regulation that became the subject of a separate proceeding in the TikTok case — separately from the question of the violation itself, for which the company was fined.

What Will Happen to Data Transfers to China

Return of the issue for reconsideration does not automatically mean revocation of the ban — the DPC must reconsider the arguments and issue a new decision taking into account the court's instructions. While the reconsideration is underway, the status of the order to suspend data transfer remains uncertain: TikTok gets a reprieve on this specific point, even having lost on the main point — the fact of GDPR violation. The deadline by which the DPC is required to issue a new decision is not named in the court documents, nor is the exact date when the company will be able to learn the final verdict on data transfer.

What This Means

The case shows that European regulators are increasingly strictly controlling not just the collection of personal data by technology companies, but also where exactly this data is transferred outside the EU. For TikTok, the outcome is mixed: the reputational and financial blow from the confirmed fine remains in force, but the company gets a chance to defend its position on the most sensitive point — data transfer to China, and the final word in the case remains to be said.

Frequently Asked Questions

How Much Did TikTok's Fine Amount To?

530 million euros — this is the fine imposed by the Irish Data Protection Commission for GDPR violation, and the Irish High Court upheld this decision.

Has the Ban on TikTok Data Transfer to China Been Lifted?

No. The court neither lifted nor confirmed the ban, but returned this point to the DPC regulator for reconsideration — there is no final decision on it yet.