TikTok Technology Limited v DPC – 3 June 2026

• Judgment Date: 03 June 2026
• Year: 2026
• Date: 03 June 2026
• Issuer: High Court

1

APPROVED [2026] IEHC 347

THE HIGH COURT

COMMERCIAL

Record No.: 2025/248 MCA

IN THE MATTER OF SECTION 142 AND SECTION 150

OF THE DATA PROTECTION ACT 2018

Between:

TIKTOK TECHNOLOGY LIMITED and TIKTOK INFORMATION

TECHNOLOGIES UK LIMITED

Appellants

And

DATA PROTECTION COMMISSION

Respondent

JUDGMENT of Mr Justice Rory Mulcahy delivered on 3 June 2026

CONTENTS

Introduction ................................................................................................................................ 3

The transfers............................................................................................................................... 8

The General Data Protection Regulation (GDPR) ..................................................................... 9

Data Protection Act 2018 ......................................................................................................... 20

The inquiry ............................................................................................................................... 24

The Decision ............................................................................................................................ 44

The Data Transfer Assessments ............................................................................................... 50

Scope of the appeal .................................................................................................................. 56

Nature of the Inquiry ................................................................................................................ 65

Grounds of appeal .................................................................................................................... 69

2

Ground 3 – Errors of law ......................................................................................................... 71

The decision in Schrems II ................................................................................................... 73

Alleged misinterpretation of the GDPR ............................................................................... 79

Arguments ......................................................................................................................... 79

Discussion ......................................................................................................................... 81

Alleged reversal of burden of proof ..................................................................................... 90

Arguments ......................................................................................................................... 90

Discussion ......................................................................................................................... 92

Alleged requirement to carry out risk assessment ................................................................ 95

Arguments ......................................................................................................................... 95

Discussion ......................................................................................................................... 98

Overall conclusion on Ground 3 ............................................................................................ 101

Grounds 1 – Breach of fair procedures .................................................................................. 102

Failure to put adverse findings to TikTok .......................................................................... 104

Arguments ....................................................................................................................... 104

Discussion ....................................................................................................................... 107

Failure to have regard to submissions made ...................................................................... 115

Arguments ....................................................................................................................... 115

Discussion ....................................................................................................................... 118

Failure to adequately assess Project Clover ....................................................................... 121

Arguments ....................................................................................................................... 121

Discussion ....................................................................................................................... 122

Impermissible amendment of temporal scope .................................................................... 124

Arguments ....................................................................................................................... 124

Discussion ....................................................................................................................... 125

Failure to make the file available ....................................................................................... 126

Arguments ....................................................................................................................... 126

Discussion ....................................................................................................................... 128

Ground not pleaded ............................................................................................................ 129

Overall conclusion on Ground 1 ............................................................................................ 130

Grounds 2 and 10 ................................................................................................................... 130

Alleged errors in assessment .............................................................................................. 130

Arguments ....................................................................................................................... 132

Discussion – errors in assessment of Chinese law evidence .......................................... 133

Discussion – errors in assessment of Project Clover ..................................................... 145

3

Overall conclusions on Ground 2 and 10 ............................................................................... 155

Ground 11 – Error in making the corrective orders ............................................................... 156

Arguments – ground 11 ....................................................................................................... 156

Discussion – ground 11 ...................................................................................................... 158

Overall conclusion on Ground 11 .......................................................................................... 160

Ground 5 – misrepresentation and misapplication of Article 13(1)(f) ................................... 161

Arguments ........................................................................................................................... 164

Discussion .......................................................................................................................... 166

Overall conclusion on Ground 5 ............................................................................................ 169

Appeal against fines ............................................................................................................... 169

Ground 6 – failure by the DPC to establish that TikTok was negligent ................................ 170

Arguments ....................................................................................................................... 173

Discussion ....................................................................................................................... 174

Overall conclusion on Ground 6 ............................................................................................ 177

Summary of conclusions ........................................................................................................ 178

Proposed Order ...................................................................................................................... 181

Introduction

1. The General Data Protection Regulation (Regulation (EU) 679/2016), generally known

as the GDPR, confers significant rights on all EU citizens in respect of their personal data,

including rights to clear information, rights of access, rights of rectification, and rights of

redress. Its territorial scope is the EU (and EEA, the GDPR having been formally

incorporated into the EEA Agreement on 6 October 2018).

2. Controllers and processors of personal data may only transfer that personal data outside

the EEA when the data will be subject to essentially equivalent levels of protection in the

third countries to which the data is transferred to that guaranteed within the EEA.

3. This appeal concerns, at its heart, the scope of the obligations imposed on controllers

of personal data when transferring personal data outside the EEA.

4. The appellant (“TikTok”) challenges a finding by the respondent (“the DPC”) that

TikTok had failed to fulfil its obligation when transferring certain personal data of its users