TikTok has been fined €530 million ($601.3 million) by Ireland’s privacy regulator for breaching the EU’s GDPR law by transferring user data to China.

The Irish Data Protection Commission, which oversees TikTok’s privacy practices in the EU, announced the fine on Friday, citing violations related to the handling of European user data.

The regulator has instructed TikTok to bring its data processing practices into compliance within six months. If TikTok fails to do so, the DPC has stated it will suspend the transfer of user data to China.

“TikTok’s personal data transfers to China infringed the GDPR because TikTok failed to verify, guarantee and demonstrate that the personal data of EEA users, remotely accessed by staff in China, was afforded a level of protection essentially equivalent to that guaranteed within the EU,” Graham Doyle, deputy commissioner at the DPC, said in a statement Friday.

“As a result of TikTok’s failure to undertake the necessary assessments, TikTok did not address potential access by Chinese authorities to EEA personal data under Chinese anti-terrorism, counter-espionage and other laws identified by TikTok as materially diverging from EU standards,” he added.

The DPC also revealed that TikTok had provided inaccurate information during its inquiry, claiming it did not store European user data on servers in China.

TikTok later informed the regulator that it had discovered in February that some European user data had, in fact, been stored on Chinese servers, contradicting its earlier statements.

The DPC considers this issue “very serious” and is evaluating potential further regulatory actions in consultation with other EU data protection authorities.

TikTok has expressed disagreement with the Irish regulator’s decision and plans to appeal in full.

In a blog post on Friday, TikTok’s Head of Public Policy and Government Relations for Europe, Christine Grahn, stated that the decision did not consider Project Clover, a €12-billion data security initiative designed to safeguard European user data.

“It instead focuses on a select period from years ago, prior to Clover’s 2023 implementation and does not reflect the safeguards now in place,” Grahn said.

“The DPC itself recorded in its report what TikTok has consistently said: it has never received a request for European user data from the Chinese authorities, and has never provided European user data to them,” she added.

TikTok has previously acknowledged that its staff in China can access user data.