Cybersecurity Policy Report, Slovak Authority Issues Warning on TikTok Data Transfers to China, (Jan 6, 2026)

By Tony Foley

Slovakia’s Office for the Protection of Personal Data (ÚOOÚ) recently issued a warning to the public concerning information shared among European Union authorities in connection with the processing of the personal data of users of the TikTok social media platform.

ÚOOÚ said in a news release that TikTok had informed users that it would continue to transfer personal data to third countries, including China. The agency said TikTok’s data-sharing practices violate a recent decision of the Irish Data Protection Commission (DPC) finding that the transfer of data from the European Economic Area (EEA) to China violates the EU General Data Protection Regulation (GDPR) (CPR, May 2, 2025). In November 2025, the Irish High Court temporarily suspended the enforcement of sanctions imposed by the DPC while TikTok’s appeal is ongoing, but ÚOOÚ said the expert assessment of the DPC concerning the lawfulness of TikTok’s data transfers remained intact.

The agency said it was important that users and organizations understand the significance of this information and its potential impact on privacy, noting that the transfer of personal data to third countries outside the EU without equivalent personal data protection rules may pose increased risks to the fundamental rights of data subjects. Specifically, ÚOOÚ advised TikTok users to familiarize themselves with the platform’s notice and privacy policy, pay close attention to privacy settings—particularly with respect to access to location, contacts, microphone, camera and other data—consider whether they want to continue to use the platform under the circumstances, and exercise caution when sharing personal or sensitive information through the app.

In addition, the Office of the Ombudsman of the Slovak Republic warned organizations, especially public sector entities, to thoroughly assess the risks associated with the use of the TikTok platform, consider their responsibility towards affected persons, and transparently communicate any decision on its continued use.

News: InternationalLegislation DataPrivacy DataSecurity GDPR