Ireland's data commissioner launches new investigation into TikTok

Data Protection Commission has opened a new inquiry into TikTok over the storage of European users' data on servers in China

Thu, 10 Jul, 2025 - 12:50

Martin Claffey

The Data Protection Commission has opened a new inquiry into TikTok over the storage of European users' data on servers in China, following "deep concern" that TikTok submitted inaccurate information to a previous investigation.

TikTok, owned by China's ByteDance, was in May fined €530m by the Irish commissioner over the transfer of European user data to China. The decision to commence the inquiry was taken by the commissioners for data protection, Des Hogan and Dale Sunderland, and was notified to TikTok earlier this week.

Ireland's Data Protection Commission is the lead regulator in the EU as it is registered in Ireland as its HQ in the bloc. The new inquiry will look specifically at the storage of data by TikTok.

A statement from the DPC said: "In April 2025, TikTok informed the DPC of an issue that it had discovered in February 2025, namely that limited EEA user data had in fact been stored on servers in China, contrary to TikTok’s evidence to the previous inquiry.

"The DPC’s decision, which issued following the inquiry cooperation procedure with peer EU regulators under the GDPR One Stop Shop mechanism, expressed its deep concern that TikTok had submitted inaccurate information to that inquiry. At the time of the conclusion of that inquiry, the DPC stated that it was taking those developments 'very seriously' and was ;'considering what further regulatory action may be warranted, in consultation with our peer EU Data Protection Authorities'. As a result of that consideration, the DPC has now decided to open this new inquiry into TikTok."

The purpose of the inquiry is to determine whether TikTok has complied with its relevant obligations under the GDPR in the context of the transfers now at issue, including the lawfulness of the transfers.

The investigation will look at TikTok's GDPR obligations regarding accountability, transparency information in relation to third country transfers, obligation to cooperate with the supervisory authority, and compliance with the relevant requirements for third country transfers.