Data Protection in Croatia

Data protection in Croatia — searched for as GDPR compliance, data privacy law, Croatia privacy laws or the Croatian data protection authority — covers how a business collects, uses, keeps and deletes personal data. The rules are the EU's General Data Protection Regulation, in Croatian the Opća uredba o zaštiti podataka (Croatians simply type GDPR Hrvatska), the Croatian act implementing it (Zakon o provedbi Opće uredbe o zaštiti podataka) and the practice of AZOP, the Agencija za zaštitu osobnih podataka, the supervisory authority. A data protection officer (DPO) is a službenik za zaštitu podataka.

Who needs it

Foreign-owned companies and sole traders in Croatia, online shops and agencies with Croatian customers, employers, owners of holiday apartments who keep guests' details and identity documents (see tourist rental licence and registration), and shops, offices or residential buildings that use cameras.

What compliance looks like in Croatia

1. Mapping which personal data is collected, why, on what legal basis and for how long, and keeping a record of processing (evidencija aktivnosti obrade).
2. Writing the privacy notice, consent wording (privola) where consent is the basis, and contracts with processors such as accountants, booking platforms and IT providers.
3. Appointing a DPO where the law requires one and giving AZOP the DPO's contact details.
4. Following the Croatian rules on video surveillance (videonadzor), which the implementing act sets out for workplaces, residential buildings and public spaces, including the warning signs.
5. Preparing for a data breach (povreda osobnih podataka) and for individuals exercising their rights of access and erasure.

Common gaps

• A privacy policy copied from another country that names the wrong authority and the wrong rights.
• Cameras that film the street, a neighbour's property or staff without the notices and limits the law sets.
• Copies of guests' or employees' documents kept longer than the purpose allows.
• Relying on confidentiality agreements alone: they are useful, see non-disclosure agreements, but they do not replace data protection rules.

The lawyer's work

The lawyer reviews current practice, drafts the documents in Croatian and English, advises on cameras and on monitoring staff, handles correspondence with AZOP, a breach notification or an inspection, and reviews the data protection terms of supplier contracts.

Questions and answers

I only rent out one apartment. Do the rules apply to me?

Yes. Guest details and copies of passports are personal data handled for a business. The obligations grow with the activity, so a single rental needs far less documentation than a hotel.

When is a DPO compulsory?

For public bodies and for organisations whose main business involves systematic monitoring of people on a large scale or large volumes of sensitive data. For most small firms the appointment is optional.

Who supervises data protection in Croatia?

AZOP, the Croatian Personal Data Protection Agency. It handles complaints, carries out inspections and can impose fines.

My own data was misused in Croatia. Can a lawyer help?

Yes. A person can ask the business for access or deletion, complain to AZOP and claim compensation in court, and a lawyer can take each of these steps.