Croatia

The operative instrument is Regulation (EU) 2016/679, whose Article 3 sets territorial scope. Croatia's national top-up is the Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka), Official Gazette 42/2018, in force since 25 May 2018. That Act does not extend or narrow territorial reach; it fills the gaps the Regulation leaves to member states. It carves out processing by law enforcement for criminal purposes and processing for national security, which sit under separate Croatian statutes. There is no general registration or licensing step for controllers in Croatia. Note that two Croatian rules do turn on establishment rather than on targeting: the Accounting Act binds every 'poduzetnik' subject to Croatian accounting law, which captures a Croatian subsidiary or branch even if the group is foreign, and the Act on State Information Infrastructure binds Croatian public bodies and their suppliers.

Headline rating: restrictions apply only in specific sectors. Sector by sector, checked 18 August 2026. ALL BUSINESSES - ACCOUNTING RECORDS - data must stay in the country as against non-EU countries. The Accounting Act (Zakon o računovodstvu), Official Gazette 85/2024, Article 10(3) for accounting documents and Article 13(3) for business books, permits a company to keep them outside Croatia 'ali samo u drugoj državi članici' - only in another European Union member state. There is no transfer mechanism, consent or contract that unlocks a third country. The company must also give the supervising authority online access on demand where records are held electronically. This is the single most commonly missed Croatian rule, because it is in tax and accounting law rather than in privacy law, and because it bites on the very systems most likely to be hosted on non-EU cloud infrastructure - the finance system, the invoice archive and the payroll archive. GOVERNMENT AND PUBLIC SECTOR - data must stay in the country. The Act on State Information Infrastructure (Zakon o državnoj informacijskoj infrastrukturi), Official Gazette 72/2025, Article 27(1): 'Registri koji sadrže osobne podatke pohranjuju se u podatkovnim centrima koji se nalaze na teritoriju Republike Hrvatske.' Registers containing personal data are stored in data centres located on Croatian territory. Article 27(2) allows registers of non-personal data to sit in Croatia or another member state, and Article 27(3) lets the state require Croatian storage of non-personal data where public security justifies it - which is exactly the carve-out Regulation (EU) 2018/1807 permits. Article 17(1) obliges state administration bodies, other state bodies and public institutions founded solely by the Republic of Croatia to use the hosting services of the Shared Services Centre, the state cloud. HEALTH - a copy must stay in the country in practice. The Act on Data and Information in Healthcare, Official Gazette 14/2019, Article 19(2): health data processing is carried out electronically 'u zdravstvenoj informacijskoj infrastrukturi Republike Hrvatske' - in the health information infrastructure of the Republic of Croatia. Article 28(3) makes exchange through the Central Health Information System of the Republic of Croatia (CEZIH) compulsory for all healthcare providers. The Act does not contain an explicit ban on a private clinic additionally hosting its own records abroad, so this is recorded as a strong de facto wall rather than an express prohibition. MAPPING AND GEOSPATIAL - data can leave with the right paperwork, with a collection permit and a defence screen. The Regulation on Aerial Photography, Official Gazette 77/2020, requires a registered operator to hold an approval for aerial photography (Articles 4 and 9, valid for a survey period of at most three months) and then a SECOND, separate approval before the images may be used (Article 10). Article 13 sets up a joint review commission of the State Geodetic Administration and the Ministry of Defence that inspects imagery showing military locations and defence structures, and Article 14 decides which images may be released and which must be excluded. Article 6(3) obliges news organisations to hand the captured material to the State Geodetic Administration within eight days. BANKING - data can leave with the right paperwork. The Croatian National Bank Decision on Outsourcing, Official Gazette 118/2020 as amended by Official Gazette 150/2024, imposes NO localisation. It requires the bank to document the cloud model and the concrete location of the data, to be told when the provider changes location, to assess country risk, and - before outsourcing to a third country - to show that the law there lets the Croatian National Bank inspect directly and gives it timely and unrestricted access to documents and data. The European Union's Digital Operational Resilience Act is the operative outsourcing regime for financial entities since 17 January 2025 and also imposes no localisation. PAYMENTS, INSURANCE, SECURITIES - data can leave with the right paperwork. No Croatian data-residency rule found, checked 18 August 2026. TELECOMS - data can leave with the right paperwork on the evidence available. No Croatian storage-location rule for telecoms was located, checked 18 August 2026. Croatia does operate a traffic-data retention regime under the Electronic Communications Act, Official Gazette 76/2022, but the article number, the retention period and any location requirement could not be verified from an official source in this run - see the unconfirmed list. ONLINE GAMBLING - data can leave with the right paperwork. Contrary to the pattern in several neighbouring countries, no requirement that the gaming server sit on Croatian soil was found in the Gambling Act (Official Gazette 87/09 to 72/25) or the remote betting rulebook, checked 18 August 2026. The remote betting rulebook does require the operator's system to be directly connected to the Ministry of Finance information system, the equipment location to be declared in the licence application, and player money accounts to be held at a bank registered in Croatia. EDUCATION, E-COMMERCE, SOCIAL MEDIA, DEFENCE - no separate Croatian localisation rule found, checked 18 August 2026. Defence and national security processing is outside the scope of the general privacy statute.

For personal data the model is an allowlist of approved destinations plus fallback instruments, exactly as under Regulation (EU) 2016/679 Chapter V. The Commission's adequacy list, verified 18 August 2026, covers Andorra, Argentina, Brazil (new, 26 January 2026), Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States for entities self-certified under the EU-US Data Privacy Framework, and the European Patent Organisation. No decision has been withdrawn or suspended. Where the destination is not approved, the 2021 standard contractual clauses (Decision (EU) 2021/914) remain the operative set, unamended; the promised new clauses for importers already directly caught by the Regulation are still not adopted. Binding corporate rules remain available. Article 49 derogations are narrow and are not a basis for routine or bulk flows. A transfer impact assessment is expected. AZOP treats this seriously rather than as paperwork. Its 14 November 2025 decision fined a telecoms operator EUR 4.5 million (about USD 4.9 million) because a processor in Serbia had administrator-level access to the whole customer relationship database, the operator had not put the 2021 standard clauses in place after the 27 December 2022 cut-off, had not carried out a transfer impact assessment, and had not told its 847,862 affected customers that their data went outside the European Economic Area. For accounting records the model is a hard allowlist consisting of the European Union member states alone, under the Accounting Act. Standard clauses, consent and binding corporate rules are irrelevant to it.

AGENCIJA ZA ZASTITU OSOBNIH PODATAKA (AZOP) is the supervisory authority under the Act implementing the General Data Protection Regulation. It is independent and reports to Parliament; its director serves a four-year term, renewable once. It is unambiguously operational. Its own published tally shows 1 fine in 2020, 4 in 2021, 14 in 2022, 28 in 2023, 38 in 2024 and 13 in 2025, the 2025 batch totalling EUR 6,725,500. Its largest fine to date is EUR 5.47 million against the debt collection agency EOS Matrix d.o.o. (5 October 2023); its second largest is the EUR 4.5 million telecoms fine of 14 November 2025. On 18 May 2026 it published five recruitment competitions for six posts, which is the clearest possible evidence that it is staffed and expanding rather than dormant. Enforcement is rated actively enforced rather than aggressive: the fines are large but the annual case count is modest, and much of the docket comes from complaints rather than from own-initiative sweeps. The 2025 fines fell on a telecoms operator, a bank, an energy producer, a betting operator, the Croatian Insurance Bureau and a parking company - a spread that shows AZOP is not confined to any one industry. NACIONALNI CENTAR ZA KIBERNETICKU SIGURNOST (NCSC-HR) sits inside the Security and Intelligence Agency and is the central state body for cybersecurity, the national computer security incident response team, the crisis management body and the single point of contact under the Cybersecurity Act. It runs the national incident reporting platform. The National CERT at CARNET handles the remaining sectors. Both are operational and publishing guidance. Other regulators that bite on data: the Croatian National Bank for credit institutions, the Croatian Financial Services Supervisory Agency for insurance, pensions and markets, the State Geodetic Administration for aerial imagery, the Tax Administration for fiscalisation and accounting records, and the Ministry of Justice, Public Administration and Digital Transformation for the state information infrastructure. Unlawful use of personal data is also a criminal offence under Article 146 of the Criminal Code and is actually prosecuted by the State Attorney's Office.

THE FLOOR. Accounting Act, Official Gazette 85/2024: the journal and general ledger at least 11 years, subsidiary ledgers at least 11 years, documents supporting entries in the journal and general ledger at least 11 years, documents supporting entries in subsidiary ledgers at least 11 years, payroll lists at least 6 years, and analytical records of wages and contributions permanently. The clock runs from the last day of the business year to which they relate. The same Act fixes WHERE they may be kept: Croatia or another European Union member state, nowhere else. Healthcare: medical documentation is kept for ten years after the death of the individual, and data in the statutory health registers is kept permanently. Fiscalisation of eInvoices has applied since 1 January 2026 and produces a further archive that has to live inside the accounting retention framework. THE CEILING. Video surveillance recordings must be deleted after six months at the latest unless a longer period is set by another law or the footage is evidence in proceedings. The general privacy rulebook's storage limitation principle applies on top: personal data must not be kept in identifiable form longer than necessary for the purpose. AZOP's 2025 decisions repeatedly cited the absence of any retention policy as an aggravating factor. CONFLICT. Croatia resolves the clash the ordinary European way: a specific statutory keeping period is a legal obligation and beats a deletion request, so an individual cannot force you to delete an invoice inside the eleven years. The practical trap is that the legal obligation only covers the accounting record itself. Marketing profiles, call recordings and CCTV attached to the same customer are not protected by it and must still be deleted on time.

CLOCK 1 - PERSONAL DATA BREACH. Regulation (EU) 2016/679 Article 33: notify AZOP without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to result in a risk. Article 34: tell the affected individuals without undue delay where the risk to them is high. There is no Croatian variation on these deadlines. CLOCK 2 - SIGNIFICANT CYBER INCIDENT. Cybersecurity Act, Official Gazette 14/2024, and the Cybersecurity Regulation, Official Gazette 135/2024, implementing the European network and information security directive. Essential and important entities must file an early warning within 24 hours of becoming aware, a fuller incident notification within 72 hours, an intermediate report if the response team asks for one (typically 48 hours to 7 days), and a final report within 30 days of the initial notification. If the incident is still running, progress reports are due every 30 days. Trust service providers are exempt from the early warning but must file the initial notification within 24 hours. Reports go through the national platform for collecting and sharing threat and incident data, or by email to the relevant response team if the platform is down. CLOCK 3 - FINANCIAL ENTITIES. The European Union's Digital Operational Resilience Act has applied since 17 January 2025 and adds its own major-incident reporting timetable for banks, insurers, investment firms and their critical technology providers. CLOCK 4 - TELECOMS. The Electronic Communications Act imposes security incident notification duties towards the telecoms regulator. The exact deadline could not be verified from an official source in this run and is listed as unconfirmed. The operational failure is almost always the same: the security team starts the 72-hour privacy clock and forgets that the cyber early warning was due at hour 24.

1. THE ACCOUNTING CLOUD TRAP. The Accounting Act allows business books and accounting documents to be held outside Croatia only in another European Union member state. That is not a privacy rule and no privacy instrument overrides it. A Croatian subsidiary running its finance system, invoice archive or payroll archive on infrastructure in the United States, the United Kingdom, Switzerland or Serbia is in breach regardless of what its data processing agreement says. Since mandatory eInvoice fiscalisation began on 1 January 2026 the volume of records caught by this rule has grown sharply. 2. AGE 16, NOT 13 OR 15. Article 19 of the Act implementing the General Data Protection Regulation sets the age at which a child can consent to an online service at 16. Croatia took the maximum the Regulation allows. Products built to a 13-year threshold are non-compliant in Croatia, and a global 'age of digital consent' switch set to 15 or 16 will still be wrong if it is not set to 16 for Croatia. 3. CRIMINAL LIABILITY. Article 146 of the Criminal Code makes unlawful use of personal data a criminal offence attaching to individuals, not an administrative matter. The State Attorney's Office does bring indictments under it, including in combination with computer fraud. An employee who misuses a customer database is exposed personally, and so potentially is the manager who directed it. 4. GENETIC DATA AND LIFE INSURANCE. The Croatian implementing Act forbids the processing of genetic data for the purpose of calculating the probability of illness or other health aspects of a person insured under a life insurance policy. This is a flat national prohibition, not a consent-based restriction, and it has no equivalent in most other member states. 5. VIDEO SURVEILLANCE HAS ITS OWN CODE. Croatia regulates cameras in the statute itself rather than by guidance: recordings must be deleted within six months unless another law says otherwise or they are evidence; signage must carry the controller's identity and contact details; monitoring of changing rooms, washrooms and rest areas is banned; public areas may generally be filmed only by public authorities and public service providers; and in a residential building you need the agreement of two thirds of the co-owners and may cover only entrances and common areas. Biometric access control and time-and-attendance in the private sector needs the employee's explicit consent and must be an alternative to another solution, which makes 'fingerprint only' clocking systems hard to justify. 6. BONUS - THE PUBLIC PROCUREMENT WALL. If you sell software to the Croatian state, the Act on State Information Infrastructure now forces personal-data registers into Croatian data centres and forces state bodies into the government's Shared Services Centre. A foreign vendor whose architecture assumes a regional hyperscale region outside Croatia cannot bid credibly.

CROATIA - DATED. 1 January 2027: the penalty articles of the Act on State Information Infrastructure (Articles 33 and 34, fines of EUR 500 to EUR 6,630, roughly USD 540 to USD 7,200) start to apply. Until then the Croatian data-centre rule for state registers is in force but carries no fine, which is exactly the kind of gap that lulls suppliers into missing it. 1 January 2027: the second phase of eInvoice fiscalisation catches traders who are not registered for value added tax. Phase one, covering value added tax registered businesses, has applied since 1 January 2026. Within 12 months of the state infrastructure regulation: projects must be registered in the state project register and data exchange interfaces must be built. A public consultation on amendments to the Electronic Communications Act was open in 2026; the content could not be verified from an official source in this run. EUROPEAN UNION - DATED. 12 January 2027: under the Data Act, Regulation (EU) 2023/2854, all cloud switching charges and data egress fees must be zero. This is a hard deadline and it changes cloud contract economics. 2 August 2026: the transparency obligations of the Artificial Intelligence Act have already started. Still not adopted: the European cloud certification scheme, deadlocked over sovereignty since 2020, so national arrangements continue to govern. The Digital Omnibus proposal of 19 November 2025 - which would loosen the definition of personal data and stretch breach notification from 72 to 96 hours - has no legal effect and was opposed on its core change in February 2026. DORMANT SWITCHES - the powers already held that could change the picture with no consultation. 1. Article 27(3) of the Act on State Information Infrastructure lets the state require NON-personal data to be stored in Croatia where a public security justification is made out. That is the escape hatch Regulation (EU) 2018/1807 leaves open, and it is written into Croatian law and ready to use. 2. The Ministry of Defence review commission for aerial imagery can exclude any image from release without a published standard. A survey flight can be flown lawfully and the resulting dataset still be unusable. 3. The Europe-United States Data Privacy Framework remains in force and legally valid on 18 August 2026, but the Latombe appeal is pending before the Court of Justice after the General Court dismissed the case on 3 September 2025, the United States oversight bodies that underpin it have been weakened, and on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether the adequacy decision is still sound. The Commission has neither suspended nor revoked it. Do not build a single-mechanism architecture on it.