TikTok Fined for Unlawful GDPR Data Transfers to China and Opaque Privacy Policy
Written by AI from the linked story. Not reviewed by an editor. How this works
TikTok failed to adequately verify that personal data transferred to China received a level of protection equivalent to that guaranteed under EU law, violating Article 46(1) GDPR's requirements for lawful third-country data transfers. Compounding this, TikTok's privacy policy did not clearly identify data transfer destinations or the nature of processing, breaching Article 13(1)(f) transparency obligations. This case underscores that organisations cannot treat data transfer mechanisms as a checkbox exercise — they must actively and continuously validate the protections in place in destination countries. The ruling matters beyond TikTok: any organisation routing EU personal data to jurisdictions without an adequacy decision must maintain robust, documented Transfer Impact Assessments (TIAs) or face significant regulatory and reputational consequences.
Tactical Insight
Immediate actions
- Audit all third-country data transfers and verify that a valid legal transfer mechanism (SCCs, adequacy decision, or BCRs) is in place and documented for each.
- Review and update privacy policies to explicitly identify every data transfer destination country and the nature of processing, as required by Article 13(1)(f) GDPR.
Compliance & due diligence measures
- Conduct and document Transfer Impact Assessments (TIAs) for all transfers to high-risk jurisdictions, including an analysis of local surveillance and data access laws.
- Establish a regular review cycle (at least annually) for all international data transfer arrangements to account for changes in adequacy status or local legislation.
- Engage legal counsel with cross-border data protection expertise before onboarding vendors or processors located outside the EEA.
Long-term improvements
- Implement a Data Transfer Register as part of your Records of Processing Activities (RoPA) to maintain continuous visibility over where personal data flows.
- Build privacy-by-design principles into product development to minimise unnecessary cross-border data transfers from the outset.
- Train Data Protection Officers and legal teams on evolving international transfer frameworks (e.g., EU-US DPF, Schrems II implications) to ensure ongoing compliance readiness.