High Court - TikTok Technology Limited v Data Protection Commission (2026) IEHC 347
High Court revokes TikTok's data transfer ban to China but upholds DPC's finding of unlawful transfer.
The Irish High Court has partially overturned a decision against TikTok Technology Limited regarding unlawful data transfers to China. While the court upheld the Data Protection Commission's (DPC) finding that TikTok unlawfully transferred EEA user data to China, it revoked the transfer ban. This revocation was based on the DPC's failure to adequately assess technical changes made by TikTok, including Project Clover, which aimed to localize data and restrict access from China.
AI summary of the linked source. Not reviewed by an editor. How this works
Run TikTok?
Get an email when a new story names TikTok, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Irish High Court's ruling illustrates that regulatory enforcement actions must keep pace with technical remediation efforts made by organisations under investigation. TikTok's Project Clover introduced significant architectural changes to localise EEA user data and restrict Chinese access, yet the DPC failed to adequately assess these measures before issuing a blanket transfer ban. This matters because poorly assessed enforcement decisions can be overturned, weakening the deterrent effect of data protection law and eroding public trust. Organisations transferring personal data internationally must not only implement robust technical safeguards but also document and communicate those changes clearly to regulators. Regulators, in turn, must embed technical review processes into enforcement workflows to ensure decisions reflect current operational realities.
What helps against this
How we list vendors- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.