TikTok Technology Limited

Background to the Inquiry Process The transfers of personal data considered in the Decision consisted of TikTok’s transfers of EEA User Data to China by way of remote access to that personal data by personnel of the ByteDance group of companies in China. The Decision considered whether those transfers complied with Chapter V of the GDPR. The Decision also considered whether TikTok’s provision of information to users in relation to such transfers met TikTok’s transparency requirements as required by the GDPR. Summary of Findings The decision concluded that: The DPC found that TikTok infringed Article 46(1) GDPR during the temporal scope of the Inquiry by carrying out the Data Transfers while failing to verify, guarantee and demonstrate that that the personal data of EEA users subject to the Data Transfers was afforded a level of protection essentially equivalent to that guaranteed within the European Union. The DPC found that TikTok infringed Article 13(1)(f) GDPR from 29 July 2020 to 1 December 2022 by failing to provide data subjects with required information on the Data Transfers and information on how the processing concerned remote access to personal data stored in Singapore and the United States by personnel based in China. Corrective Measures Having considered the infringements of the GDPR as set out above, the DPC decided to exercise the following corrective powers, in accordance with Article 58(2) GDPR: An order pursuant to Article 58(2)(j) GDPR requiring TikTok Ireland to suspend the Data Transfers. An order pursuant to Article 58(2)(d) GDPR requiring TikTok Ireland to bring the processing into compliance.

INTRODUCTION The General Data Protection Regulation ("GDPR") is a regulation in European Union law on the protection of individuals with regard to the processing of their personal data. The date of application of the GDPR is 25 May 2018.1 The Data Protection Commission ("DPC" or, otherwise, "IE SA") was established on 25 May 2018, pursuant to the Data Protection Act 2018 ("the 2018 Act"), as Ireland's supervisory authority within the meaning of, and for the purposes specified in, the GDPR.2 This is a decision ("the Decision") of the DPC pursuant to Section 111 of the 2018 Act and Articles 60 and 65 of the GDPR. I have made this Decision, as the decision-maker for the DPC, further to an own-volition Inquiry conducted by the DPC pursuant to Section 110 of the 2018 Act ("the Inquiry"), concerning the compliance or otherwise of TikTok Technology Limited with its obligations pursuant to Articles 5, 12, 13, 24 and 25 GDPR in the context of the TikTok platform. For the purpose of this Decision, "TTL" will be used to refer to TikTok Technology Limited while "TikTok" will be used to refer to the platform itself, whether web- or applicationbased. In preparing this Decision, the DPC has taken into account all submissions made by TTL in response to the Inquiry, as well as other relevant information received by the DPC, and public sources of information, as set out in this Decision. 4.