Tiktok Technology Limited & Anor v Data Protection Commission – 13 November 2025

• Judgment Date: 13 November 2025
• Issuer: High Court
• Date: 13 November 2025
• Year: 2025

NO REDACTION REQUIRED

APPROVED [2025] IEHC 619

THE HIGH COURT

COMMERCIAL

Record No.: 2025/248 MCA

IN THE MATTER OF SECTION 142 AND SECTION 150

OF THE DATA PROTECTION ACT 2018

Between:

TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION

TECHNOLOGIES UK LIMITED

Applicants

And

DATA PROTECTION COMMISSION

Respondent

JUDGMENT of Mr Justice Rory Mulcahy delivered on 13 November 2025

Introduction

1. On 14 September 2021, the respondent (“the DPC”) commenced an inquiry (“the

Inquiry”) into the first applicant (“TikTok”) in accordance with section 110 of the Data

Protection Act 2018 (“the Act”) regarding the transfer by TikTok of its users’ personal data

to China. The DPC is the State’s supervisory authority for the purpose of the General Data

Protection Regulation, Regulation 2016/679 (“the GDPR”).

2. Following a detailed investigation, and having consulted with other supervisory

authorities in accordance with Article 60 of the GDPR, the DPC issued its decision on 30

April 2025 (“the Decision”). The Decision defined the temporal scope of the Inquiry as

relating to data transfers taking place from 29 July 2020 until 17 May 2023. In the Decision,

2

the DPC found that TikTok had infringed Article 46(1) the GDPR by failing to ensure that

personal data of its users within the European Economic Area (“EEA Users”) which was

transferred outside the EEA, in this case by being made available by remote access to

personnel based in China (“the data transfers”), was afforded a level of protection

essentially equivalent to that provided within the European Union (“EU”) during the

Inquiry’s temporal scope. The Decision also found a breach of Article 13(1)(f) of the GDPR,

that TikTok had failed to provide required information on the data transfers to data subjects

from 29 July 2020 to 1 December 2022.

3. As part of the Decision, the respondent imposed administrative fines totalling €530

million. The second applicant (“TikTok UK”) has been joined to these proceedings on the

basis that it is the entity which will ultimately be responsible for paying any such

administrative fines. The DPC disputes its standing as a party in these proceedings, but that

issue does not require to be resolved at this time.

4. In addition to the administrative fines, the DPC made an order pursuant to Article

58(2)(j) of the GDPR requiring TikTok to suspend the data transfers (“the Suspension

Order”) and an order pursuant to Article 58(2)(d) requiring TikTok to bring its processing

into compliance with the GDPR (“the Corrective Order”). These orders were to take effect

six months after the date of the Decision.

5. By originating notice of motion issued on 27 May 2025, TikTok appealed the Decision

pursuant to sections 142 and 150 of the Act. TikTok pleads errors of law and fact on the part

of the DPC. It contends that the data transfers, by virtue of its standard contractual clauses

(SCCs) and, inter alia, additional measures put in place by TikTok pursuant to what it calls

“Project Clover”, are afforded an equivalent level of protection to that provided within the

EU. In addition, TikTok contends that the Decision was reached in breach of fair procedures.

TikTok also claims that the DPC has erred in its interpretation of relevant Chinese laws.

6. By operation of section 142 of the Act, the appeal operates as a stay on the requirement

to pay the administrative fines. However, there is no automatic stay on the Suspension Order

3

or Corrective Order (for convenience, any further reference to the Suspension Order can be

read as referring to both orders). This judgment concerns TikTok’s application to stay those

orders. In short, TikTok claims that the steps it will be necessary to take in order to comply

with the Suspension Order will require it to incur billions of euros expenditure, will be

disruptive of its business and of its workforce, and will diminish its stakeholders’

experience. It contends that most of this loss cannot be made good if it ultimately succeeds

in its appeal. In order to provide it with an effective remedy, TikTok argues, the Suspension

Order must be stayed pending the determination of its appeal.

7. The DPC opposes the stay. It contends that the fundamental rights of TikTok’s 159

million monthly EEA users are at risk if the data transfers continue.

8. The proceedings were entered in the Commercial List of the High Court on 5 June 2025.

TikTok applied for a stay on the Decision at that time, on the basis of the affidavits grounding

the entry application. The stay application was opposed by the DPC. The court granted a

temporary stay up to the hearing of this application, which was listed for 7 October 2025.

The stay application was heard over four days from 7 to 10 October 2025. When the hearing

commenced, the DPC did not oppose a continuation of the stay pending the determination

of this application.

9. As will be seen, much of the debate between the parties concerned the test which should

be applied to an application for a stay on a decision of the DPC. The DPC argues that, having

regard to particular features of the decision challenged, a decision made in accordance with

the GDPR, in consultation with other EU supervisory authorities, and with their consent or

agreement, the appropriate threshold is that applied by the CJEU in an application for

interim measures, referred to below as the Zuckerfabrik test. TikTok contends that the

Decision should be treated in the same way as any other national law measure made in

purported compliance with EU law, and that the relevant threshold is the well-established

test applied to such national law measures, the Okunade test.