TikTok Data Breach Under Fresh Irish Investigation Over China Transfers

The Irish Data Protection Commission (DPC) has launched a new investigation into TikTok’s handling of EU user data.
The regulator wants to determine if TikTok violated GDPR by transferring personal information to servers in China.
This new probe follows a €530 million fine the DPC issued on April 30, 2025.
That penalty stemmed from an earlier TikTok data breach involving remote data access by staff in China.
The previous investigation found TikTok failed to follow EU privacy rules and did not prevent unauthorized access.

TikTok gave regulators false information

During the first inquiry, TikTok claimed it did not store European user data in China.
Later, the company admitted that some personal data had indeed reached Chinese servers.
This contradiction raised serious concerns with the DPC.
The regulator believes TikTok may have submitted misleading or incomplete information.
Now, the DPC aims to determine if ByteDance, TikTok’s parent company, also violated GDPR transparency rules.
The investigation will focus on the lawfulness of transferring data outside the EU.
It will also review whether TikTok provided users with clear, accurate details about data handling.

ByteDance faces mounting pressure

The DPC is working with other European privacy regulators to decide what action to take next.
Officials will investigate whether ByteDance misled regulators or withheld critical details.
TikTok has appealed the original fine, saying it was based on outdated practices.
The company points to Project Clover, a €12 billion plan to build EU-based data centers.
TikTok says this investment proves its commitment to full GDPR compliance.

Despite those claims, regulators remain skeptical.
They want to know if the company truly changed its behavior or simply shifted strategies.
The new investigation may reveal further violations in another TikTok data breach.
If confirmed, TikTok could face new fines and restrictions on how it handles European data.
The outcome could reshape how tech companies manage cross-border data transfers in the future.