Almost three years after TikTok’s largest market, India, banned the Chinese-owned social media app over geopolitical tensions, troves of personal data of Indian citizens who once used TikTok remain widely accessible to employees at the company and its Beijing-based parent, ByteDance.

“I don’t think [Indians are] aware of how much of their data is exposed to China right now, even with the ban in place,” a current TikTok employee told in an interview.

According to the employee and a review of internal TikTok and ByteDance programs, almost anyone at the companies with basic access to their tools can retrieve and analyze granular data about past TikTok users in India.

“We have steadfastly complied, and continue to remain in full compliance, with the Government of India order since it was implemented,” TikTok spokesperson Jason Grosse said in an email.

“All user data is subject to our robust internal policy controls surrounding access, retention, and deletion,” Grosse added. However, ByteDance did not respond to a request for comment.

The purpose of India’s 2020 ban appears to have focused on preventing public access to TikTok in the country going forward, given concerns about the app potentially sending data it had collected on Indian users back to China.

“We can’t ban them from the data they already have,” former NSA general counsel Glenn Gerstell.

The ban did not seem to call for deletion of app data that had already been captured and stored.