Cybersecurity Policy Report, Irish Privacy Regulator to Investigate Chinese Online Retailer, (May 5, 2026)

By Tony Foley

The Irish Data Protection Commission (DPC) has opened an investigation into Infinite Styles Services Co. Ltd., d/b/a Shein Ireland, regarding concerns over transfers of personal data of European data subjects by the online retailer to China.

According to a news release today, the DPC will examine and assess the extent to which Shein Ireland has complied with its obligations under the European Union’s General Data Protection Regulation (GDPR) in relation to the data transfers, including the personal data processing principles under GDPR article 5, transparency obligations under article 13, and the requirements of GDPR chapter 5 regarding transfers of data to third countries. The DPC notified Shein Ireland of its intention to commence the inquiry last Thursday, it said.

“When an individual’s personal data is transferred to a country outside the EU, the GDPR requires that this personal data is afforded essentially the same protections as it would within the EU,” said DPC Deputy Commissioner Graham Doyle. “Recent regulatory action by the DPC, together with complaints to other European supervisory authorities, has brought data transfers to China, in particular, into focus. The inquiry is an important strategic priority for the DPC and we intend to cooperate closely with our peer European Supervisory Authorities as part of the investigation.”

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR