Ireland to reconsider TikTok data transfer sanctions after court ruling

Ireland’s Data Protection Commission is revisiting whether to impose new sanctions on TikTok after the Irish High Court largely backed its privacy ruling but told the regulator it had to more carefully assess the company’s submissions before acting again. The dispute has become a stress test for how far European authorities can go when a platform moves EU user data through China, where regulators say access risks are materially higher.

The commission’s final decision, issued on 2 May 2025, fined TikTok Technology Limited €530 million in total, including €485 million for violations of Article 46 of the General Data Protection Regulation and €45 million for Article 13 transparency failures. It also gave TikTok six months to bring its processing into compliance and said it could suspend transfers to China if the company did not do so.

At the center of the case was the regulator’s finding that TikTok had failed to verify, guarantee and demonstrate that European Economic Area user data remotely accessed by staff in China received protection essentially equivalent to that in the European Union. The DPC also said TikTok had not adequately addressed the possibility of access by Chinese authorities under anti-terrorism, counter-espionage and related laws. In April 2025, TikTok told the commission it had discovered in February 2025 that limited EEA user data had in fact been stored on servers in China, contradicting its earlier evidence to the inquiry.

The European Data Protection Board later upheld the Irish decision and said the six-month compliance period was reasonable. TikTok appealed, and on 3 June 2026 the Irish High Court, in a judgment by Mr Justice Rory Mulcahy, largely upheld the commission’s findings on the Article 46 transfer issue and the Article 13 transparency issue, rejecting most of TikTok’s grounds of appeal.

The court battle briefly cut the other way in April, when Ireland’s Supreme Court confirmed on 30 April 2026 that TikTok could keep transferring data from the EU to China while the appeal proceeded. That stay remains central to the next phase, because the DPC must now decide whether the judgment leaves enough room to pursue renewed restrictions or whether TikTok’s explanations change the enforcement calculus.

TikTok has said publicly that it strongly contested the findings and that it was being singled out despite relying on a legal mechanism used by thousands of other companies. For Europe’s regulators, the case reaches beyond one platform: if the DPC moves again, the evidence it needs to justify suspending transfers could shape enforcement against any company moving European user data into jurisdictions seen as higher risk.