Regulator announcement; this article does not establish payment or the outcome of any subsequent appeal.
What happened
The Irish DPC announced €530 million in fines against TikTok in May 2025 concerning EEA user data transferred to China and transparency about those transfers. The findings included access by staff in China to information stored elsewhere. The announcement also described corrective orders. It does not mean every transfer outside Europe is automatically unlawful.
Source: Irish DPC — original source ↗
What it means for your website
A hosting location is only the start of a supplier review. Customer support, analytics, backups and subcontractors can create additional access routes. Ask suppliers for information that explains the actual arrangement, rather than relying only on a flag next to a data-centre address. Keep a list of the services your website uses and who can access the information each receives. Your privacy notice and contractual safeguards should reflect that arrangement. A public scan can reveal contact with a provider, but cannot read your contracts or determine every remote-access practice. Specialist advice may be needed for the legal assessment.
Three useful next steps
- Map suppliers and their support-access locations.
- Check current transfer arrangements and contracts.
- Keep your privacy information consistent with actual practices.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
Irish DPC — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.