[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFhusvGLfN-8p9kTPir9aunwbGPNTLU7A_BOymCLpKcU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"1a270662-d73b-47da-991c-571b4ea3899a","tiktok-fined-for-unlawful-gdpr-data-transfers-to-china-and-opaque-privacy-policy","dc5db124-0fed-4339-9905-3a84ec55174a","TikTok Fined for Unlawful GDPR Data Transfers to China and Opaque Privacy Policy","TikTok failed to adequately verify that personal data transferred to China received a level of protection equivalent to that guaranteed under EU law, violating Article 46(1) GDPR's requirements for lawful third-country data transfers. Compounding this, TikTok's privacy policy did not clearly identify data transfer destinations or the nature of processing, breaching Article 13(1)(f) transparency obligations. This case underscores that organisations cannot treat data transfer mechanisms as a checkbox exercise — they must actively and continuously validate the protections in place in destination countries. The ruling matters beyond TikTok: any organisation routing EU personal data to jurisdictions without an adequacy decision must maintain robust, documented Transfer Impact Assessments (TIAs) or face significant regulatory and reputational consequences.","**Immediate actions:**\n- Audit all third-country data transfers and verify that a valid legal transfer mechanism (SCCs, adequacy decision, or BCRs) is in place and documented for each.\n- Review and update privacy policies to explicitly identify every data transfer destination country and the nature of processing, as required by Article 13(1)(f) GDPR.\n\n**Compliance & due diligence measures:**\n- Conduct and document Transfer Impact Assessments (TIAs) for all transfers to high-risk jurisdictions, including an analysis of local surveillance and data access laws.\n- Establish a regular review cycle (at least annually) for all international data transfer arrangements to account for changes in adequacy status or local legislation.\n- Engage legal counsel with cross-border data protection expertise before onboarding vendors or processors located outside the EEA.\n\n**Long-term improvements:**\n- Implement a Data Transfer Register as part of your Records of Processing Activities (RoPA) to maintain continuous visibility over where personal data flows.\n- Build privacy-by-design principles into product development to minimise unnecessary cross-border data transfers from the outset.\n- Train Data Protection Officers and legal teams on evolving international transfer frameworks (e.g., EU-US DPF, Schrems II implications) to ensure ongoing compliance readiness.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 46(1) — Transfers subject to appropriate safeguards","GDPR Article 13(1)(f) — Transparency obligations at time of data collection","GDPR Article 44 — General principle for transfers to third countries","GDPR Article 30 — Records of Processing Activities (RoPA)","EDPB Recommendations 01\u002F2020 on Transfer Impact Assessments","NIST Privacy Framework PR.DS-P1 — Data processing transparency","NIST SP 800-53 PT-7 — Specific Categories of Personally Identifiable Information","CIS Control 3 — Data Protection","ISO\u002FIEC 27701:2019 — Privacy Information Management (PIMS)","ITIL Service Management — Supplier and contract management for third-party risk",{},"published","2026-06-17T10:21:09.350356+00:00","2026-06-17T10:21:09.266+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=High_Court_-_TikTok_Technology_Limited_v_Data_Protection_Commission_(2026)_IEHC_347&diff=51909&oldid=51904","high-court-tiktok-technology-limited-v-data-protection-commission-2026-iehc-347-fa4da2","High Court - TikTok Technology Limited v Data Protection Commission (2026) IEHC 347",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":50,"name":51,"problem":52},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":54,"name":55,"problem":56},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]