In May 2025 Ireland’s Data Protection Commission fined TikTok €530m over transfers of European users’ personal data to China and failings in transparency — one of the largest GDPR penalties to date.
You don’t need to be a tech giant for the principle to apply. Under GDPR you’re responsible for the personal data you hold: where it’s stored, who can access it, and which third parties and tools touch it along the way.
Why this matters
- Data transfers carry legal weight — where data goes, and who can reach it, matters.
- GDPR applies to everyone — the principles are the same at any size.
- Third-party tools process your data — often more of them than you realise.
- Transparency is a duty — telling people clearly what happens to their data.
What we’d advise
Many SMEs are surprised how many cloud apps quietly process their data. We help clients map that data flow and tighten it up — so you stay compliant and your customers’ trust is protected.
Source: Irish Data Protection Commission, May 2025; widely reported.