Data Protection for Businesses in Croatia: A GDPR Compliance Guide

For any business operating in Croatia, compliance with the General Data Protection Regulation (GDPR) is not optional. As a member of the European Union, Croatia applies the same data protection framework that governs the entire bloc, meaning local companies, foreign branches, and even sole traders must handle personal data with care.

The Croatian Personal Data Protection Agency (AZOP) is the national supervisory authority responsible for enforcing GDPR. Businesses that fail to comply risk significant fines and, perhaps more importantly, damage to their reputation and customer trust.

Who needs to comply?

In short: almost everyone. GDPR applies to any organisation—public or private, large or small—that processes personal data of individuals in the EU. This includes collecting names, email addresses, phone numbers, employee records, customer databases, CCTV footage, and even IP addresses. If you run a business in Croatia, you are almost certainly processing personal data.

Key steps to GDPR compliance

Becoming compliant is an ongoing process, but these steps will set you on the right path:

1. Appoint a Data Protection Officer (DPO) if your core activities involve large-scale monitoring or processing of sensitive data. Many small businesses may not need a DPO, but it is wise to designate someone responsible for data protection even if not legally required.
2. Map your data. Understand what personal data you collect, where it is stored, who has access to it, and why you need it. Document this in a record of processing activities.
3. Identify a lawful basis. For every type of processing, you must have a valid legal reason: consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. Relying on consent requires clear, affirmative action and easy withdrawal.
4. Update your privacy notices. Tell people what data you collect, why, how long you keep it, and their rights. This information should be concise, transparent, and easily accessible.
5. Handle data subject requests. Individuals have the right to access, correct, delete, restrict, and port their data. You must respond to such requests within one month, free of charge.
6. Plan for data breaches. If a breach occurs, you must notify AZOP within 72 hours if it poses a risk to individuals. In serious cases, you must also inform the affected people.
7. Review international transfers. If you transfer personal data outside the EU, you need appropriate safeguards such as standard contractual clauses or an adequacy decision.

Practical tips for Croatian businesses

• Conduct a data audit at least once a year to identify any new data flows or risks.
• Train your employees regularly on data protection principles and your internal policies.
• Review contracts with any service providers who process data on your behalf (e.g., cloud storage, payroll, marketing agencies). You need a data processing agreement that sets out their obligations.
• Implement technical measures like encryption, access controls, and secure backups.
• Be careful with email marketing: you must have consent or another lawful basis, and include an easy unsubscribe option.

Common mistakes to avoid

Even well-intentioned businesses often slip up. Some frequent errors include:

• Assuming small amounts of data don't matter—GDPR applies regardless of scale.
• Ignoring requests from individuals or responding too slowly.
• Using personal data for a new purpose without updating the privacy notice.
• Failing to secure paper records, not just digital files.
• Thinking GDPR only applies to customers, not employees. Employee data is equally protected.

Compliance with GDPR is not a one-time task but a continuous commitment. By establishing clear procedures and fostering a privacy-aware culture, your Croatian business can build trust and avoid costly penalties.