Data Protection in Croatia: Key Rules for Businesses
Croatia aligns with EU GDPR standards, but local specifics matter. Here’s what every business should know about data protection compliance.
Illustration: AI-generated image
If you run a business in Croatia, understanding data protection isn't just good practice—it's a legal requirement. Croatia follows the EU's General Data Protection Regulation (GDPR), but with some national nuances. This guide covers the essentials for staying compliant.
Who oversees data protection in Croatia?
The Croatian Personal Data Protection Agency (AZOP) is the independent supervisory authority responsible for enforcing data protection laws. It issues guidance, handles complaints, and can impose fines for violations.
Key national legislation
Beyond the GDPR, Croatia has the Act on Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka). This law sets out specific rules for areas like employee data, CCTV monitoring, and genetic data.
What businesses must do
- Appoint a Data Protection Officer (DPO): Required for public authorities or companies that systematically monitor individuals or process sensitive data on a large scale.
- Maintain records of processing activities: Document what personal data you collect, why, and how long you keep it.
- Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing, such as large-scale profiling or use of new technologies.
- Ensure lawful basis for processing: Consent, contract, legal obligation, vital interests, public task, or legitimate interests—choose and document the right one.
Special rules for employee data
Croatian law places strict limits on monitoring employees. Employers must inform staff about any surveillance, and CCTV in workplaces is allowed only for specific purposes like security or production safety, with clear signage.
Cross-border data transfers
Transfers outside the EU are permitted only with appropriate safeguards, such as Standard Contractual Clauses or adequacy decisions. For US transfers, the EU-US Data Privacy Framework currently applies.
Breach notification
If a data breach occurs, you must notify AZOP within 72 hours if it risks individuals' rights and freedoms. In some cases, you must also inform the affected individuals directly.
Penalties for non-compliance
Fines can reach up to €20 million or 4% of global annual turnover, whichever is higher. AZOP has become more active, so ignoring data protection is a risky strategy.
Staying informed and documenting your compliance efforts is the best way to avoid trouble. When in doubt, seek advice from a local legal expert.
