High Court - TikTok Technology Limited v Data Protection Commission (2026) IEHC 347
High Court upholds finding that TikTok's international data transfers to China were unlawful under GDPR.
The Irish High Court largely dismissed TikTok Technology Limited's appeal against the Data Protection Commission (DPC). The court upheld the finding that TikTok infringed Article 46(1) GDPR by unlawfully transferring personal data to China, as the company failed to adequately verify the level of protection afforded to the data. The court also found TikTok infringed transparency obligations under Article 13(1)(f) GDPR for not properly identifying data transfer destinations and processing nature in its privacy policy. While the court confirmed the DPC's entitlement to impose fines, it vacated the order suspending data transfers, remitting the matter for reassessment.
AI summary of the linked source. Not reviewed by an editor. How this works
Run TikTok Technology Limited?
Get an email when a new story names TikTok Technology Limited, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTikTok failed to adequately verify that personal data transferred to China received a level of protection equivalent to that guaranteed under EU law, violating Article 46(1) GDPR's requirements for lawful third-country data transfers. Compounding this, TikTok's privacy policy did not clearly identify data transfer destinations or the nature of processing, breaching Article 13(1)(f) transparency obligations. This case underscores that organisations cannot treat data transfer mechanisms as a checkbox exercise — they must actively and continuously validate the protections in place in destination countries. The ruling matters beyond TikTok: any organisation routing EU personal data to jurisdictions without an adequacy decision must maintain robust, documented Transfer Impact Assessments (TIAs) or face significant regulatory and reputational consequences.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.