Overview

• The Irish Data Protection Commission (DPC) imposed a €530 million fine on TikTok for breaching GDPR rules by not adequately protecting EU user data from access by Chinese staff.
• TikTok is appealing the decision, citing its €12 billion Project Clover initiative, which includes building European data centers to enhance security and compliance.
• The DPC has given TikTok six months to comply with EU regulations or face suspension of all data transfers to China.
• During the investigation, TikTok disclosed that some EU user data had been mistakenly stored on Chinese servers in February 2025 but assures the issue was resolved quickly.
• This penalty is the third-largest GDPR fine issued by the DPC, following sanctions against Meta (€1.2 billion) and Amazon (€746 million).