Supreme Court dismisses DPC appeal in TikTok data-transfer stay case

The Supreme Court has dismissed an appeal by the Data Protection Commission in proceedings involving TikTok and a major GDPR enforcement decision concerning transfers of EEA user data outside the European Economic Area.

The case arose from a DPC decision of 30 April 2025, in which the regulator found that TikTok had infringed Articles 46 and 13(1)(f) of the GDPR. The findings related to the transfer of certain personal data of TikTok users to jurisdictions outside the EEA. The DPC directed TikTok to suspend the transfers, bring the processing into compliance with the GDPR, and pay two administrative fines of €485 million and €45 million.

TikTok brought a statutory appeal under the Data Protection Act 2018. The High Court had granted a stay on the first two elements of the DPC’s direction, namely the suspension of transfers and the compliance direction, pending the full statutory appeal. The fines were automatically stayed when the proceedings began.

The DPC appealed the High Court’s decision to grant the stay. The central issue before the Supreme Court was what legal test should apply when a company seeks to suspend the effect of a regulatory decision of this kind. The DPC argued that the ordinary Irish test for stays should not apply because of the EU-wide effect of the decision. It submitted that a test developed by the Court of Justice of the European Union should govern the application instead.

Mr Justice Brian Murray, delivering judgment, held that the test governing a stay on a DPC decision of this kind is a matter of national law rather than EU law. The Court also declined to refer a question to the Court of Justice of the European Union, finding that the proper resolution of the issue was sufficiently clear.

However, the Court also stressed that stays on regulatory decisions intended to protect users’ rights should be viewed as exceptional. It said such a stay should “only very rarely, if ever” be granted unless the applicant has established a strong case. Where that threshold is met, the court must balance the harm to the applicant if a stay is refused against the public interest and the rights of third parties if a stay is granted.

The Supreme Court dismissed the DPC’s appeal but allowed the stay granted by the High Court to continue unless the DPC applies to have the matter revisited. The judgment means TikTok retains the benefit of the High Court stay for now, but the Court’s reasoning sets a demanding test for similar future applications.

The ruling is likely to be closely read by technology companies, regulators and data-protection lawyers. It does not decide TikTok’s full statutory appeal against the DPC enforcement decision. Instead, it clarifies the legal framework for interim stays where a regulated company seeks to suspend the effect of a major data-protection decision while litigation is ongoing.

The judgment is significant because it balances two competing concerns. On one side is the need for companies to avoid potentially irreversible consequences before their appeal is heard. On the other is the public interest in allowing regulators to enforce decisions intended to protect users’ data rights. The Supreme Court’s message is that such stays remain available, but only in rare and carefully justified cases.