Data protection & GDPR compliance in Croatia (2026)

AZOP launched the EDPB's 2026 Coordinated Enforcement Framework action, requiring higher-education data controllers to complete a mandatory questionnaire on GDPR compliance, AI systems, and Articles 12–14 transparency obligations by 15 July 2026. The exercise marks Croatia's integration into EU-wide supervisory priorities and signals an upcoming focus on AI governance.

AZOP imposed Croatia's largest 2025 fine on telecoms operator Telemach for transferring personal data to a Serbian processor without a valid transfer instrument or risk assessment, processing employee identity documents without legal basis, and failing to consult its DPO — the first major Croatian enforcement action targeting third-country data transfers.

An anonymous complaint led AZOP to confirm that a USB stick containing data on over one million vehicle owners from the national Register of Registered Vehicles originated from the Croatian Insurance Bureau's database; AZOP found failures in technical and organisational security measures and the absence of defined data retention periods.

The Croatian DPA concluded 97 enforcement decisions in 2024 totalling €10.5 million, establishing Croatia as one of the most active GDPR enforcers among newer EU member states and signalling a structural shift toward high-volume, multi-sector supervision.

Debt-collection agency EOS Matrix d.o.o. was fined for processing data of 181,641 individuals — including non-debtors and minors — without legal basis, unlawfully recording health data under Article 9 GDPR, and failing to implement adequate technical security measures; the fine set a national record and prompted scrutiny of debt-collection sector practices across the region.

AZOP found that a sports betting company collected copies of 2,078 players' bank cards — with full card data visible on 655 copies — as a purported AML measure, without a valid legal basis; the decision reinforced that GDPR data-minimisation requirements apply even where anti-money-laundering obligations exist.

Croatia adopted a revised Electronic Communications Act implementing the EU ePrivacy Directive framework, requiring prior informed consent for cookies and imposing fines up to €132,720 for breaches of confidentiality, cookie consent, and electronic direct-marketing rules — closing a significant gap in the GDPR-era framework.

Croatia enacted the Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka, NN 42/2018), setting national supplementing rules for employment data processing, genetic and biometric data, and video surveillance — replacing the 2003 Personal Data Protection Act and repositioning AZOP as the Article 51 supervisory authority.

Upon EU accession, the full data protection acquis including Directive 95/46/EC became directly applicable in Croatia; AZOP formally joined the EU network of data protection authorities, and cross-border enforcement cooperation and consistency obligations took effect immediately.

The Croatian Personal Data Protection Agency (AZOP — Agencija za zaštitu osobnih podataka) was established under the 2003 Act as the independent supervisory authority for personal data protection, modelled on Directive 95/46/EC's requirement for an independent national DPA.