Croatia

The main law is Regulation (EU) 2016/679, the General Data Protection Regulation. It sets out who it applies to. Croatia's own addition is one Act. It is the Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka), Official Gazette 42/2018. It has been in force since 25 May 2018. That Act does not widen or narrow who is caught. It fills the gaps the Regulation leaves to member states. It leaves out police work on crime and work for national security, which sit under separate Croatian laws. There is no general registration or licensing step in Croatia. Two Croatian rules work differently. They apply because you have a presence in Croatia, not because you target people there. The Accounting Act binds every business subject to Croatian accounting law. That captures a Croatian subsidiary or branch even if the group is foreign. The Act on State Information Infrastructure binds Croatian public bodies and their suppliers.

The answer depends on your industry. Here is the position for each, checked 18 August 2026. ALL BUSINESSES - ACCOUNTING RECORDS. Closed as against countries outside the European Union. The rule is in the Accounting Act (Zakon o računovodstvu), Official Gazette 85/2024. It lets a company keep its accounting documents and business books outside Croatia only in another European Union member state. No transfer tool, consent or contract unlocks a country outside the Union. Where you hold the records electronically, you must give the supervising authority online access on demand. This is the Croatian rule people miss most often. It sits in tax and accounting law rather than privacy law. And it hits the systems most likely to run on cloud outside the Union: the finance system, the invoice archive and the payroll archive. GOVERNMENT AND PUBLIC SECTOR. Closed. The rule is in the Act on State Information Infrastructure (Zakon o državnoj informacijskoj infrastrukturi), Official Gazette 72/2025. Registers containing personal data must be stored in data centres on Croatian territory. Registers of non-personal data may sit in Croatia or another member state. The state can also require Croatian storage of non-personal data where public security justifies it. That is the opening Regulation (EU) 2018/1807 leaves. Some bodies must use the hosting services of the Shared Services Centre, the state cloud. Those are state administration bodies, other state bodies, and public institutions founded solely by the Republic of Croatia. HEALTH. A copy has to stay in Croatia. The rule is in the Act on Data and Information in Healthcare, Official Gazette 14/2019. Health data is handled electronically inside the health information infrastructure of the Republic of Croatia. All healthcare providers must exchange data through the Central Health Information System of the Republic of Croatia (CEZIH). The Act does not expressly ban a private clinic from also hosting its own records abroad. So we record this as a strong limit in fact rather than an express ban. MAPPING AND GEOSPATIAL. Allowed with conditions: a collection permit plus a defence check. The Regulation on Aerial Photography, Official Gazette 77/2020, requires a registered operator to hold an approval for aerial photography. That approval covers a survey period of at most three months. A second, separate approval is needed before the images may be used. A joint commission of the State Geodetic Administration and the Ministry of Defence inspects imagery showing military locations and defence structures. It decides which images may be released and which must be excluded. News organisations must hand the captured material to the State Geodetic Administration within eight days. BANKING. Allowed with conditions. The Croatian National Bank Decision on Outsourcing, Official Gazette 118/2020 as amended by Official Gazette 150/2024, does NOT require data to stay in Croatia. It requires the bank to record the cloud model and the exact location of the data. The provider must tell the bank when it changes location. The bank must assess country risk. Before using a supplier outside the Union, the bank must show that local law lets the Croatian National Bank inspect directly. Local law must also give the Bank prompt and unrestricted access to documents and data. The European Union's Digital Operational Resilience Act has covered outsourcing by financial firms since 17 January 2025. It does not require data to stay in any country either. PAYMENTS, INSURANCE, SECURITIES. Allowed with conditions. We found no Croatian rule that data must stay in the country, checked 18 August 2026. TELECOMS. Allowed with conditions, on the evidence we have. We found no Croatian rule on where telecoms data must be stored, checked 18 August 2026. Croatia does make operators keep traffic data under the Electronic Communications Act, Official Gazette 76/2022. We could not verify the keeping period or any location requirement from an official source. See the unconfirmed list. ONLINE GAMBLING. Allowed with conditions. Several neighbouring countries make the gaming server sit on their soil. We found no such rule in Croatia's Gambling Act (Official Gazette 87/09 to 72/25) or the remote betting rulebook, checked 18 August 2026. The remote betting rulebook does require the operator's system to connect directly to the Ministry of Finance information system. You must declare the equipment location in the licence application. Player money accounts must be held at a bank registered in Croatia. EDUCATION, E-COMMERCE, SOCIAL MEDIA, DEFENCE. We found no separate Croatian rule that data must stay in the country, checked 18 August 2026. Defence and national security work sits outside the general privacy law.

For personal data you can send it freely to approved countries, and use standard tools for everywhere else. We verified the European Commission's list of approved countries on 18 August 2026. It covers Andorra, Argentina, Brazil (new, 26 January 2026), Canada for commercial bodies, the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan and Jersey. It also covers New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland and Uruguay. It covers the United Kingdom too, renewed on 19 December 2025 and running to 2031. And it covers the European Patent Organisation. The United States is covered only for companies signed up to the EU-US Data Privacy Framework. None has been withdrawn or suspended. Where the destination is not approved, use the 2021 standard contract clauses (Decision (EU) 2021/914). They are still the current set and unchanged. The promised new clauses for recipients already covered by the Regulation have still not been adopted. Company-wide binding rules remain available. The narrow exceptions in the Regulation are not a basis for routine or bulk flows. You are also expected to write down why the destination country is safe. AZOP treats this seriously rather than as paperwork. On 14 November 2025 it fined a telecoms operator EUR 4.5 million (about 4.9 million US dollars). A supplier in Serbia had administrator-level access to the whole customer database. The operator had not put the 2021 standard clauses in place after the 27 December 2022 cut-off. It had not written down why Serbia was safe. And it had not told its 847,862 affected customers that their data went outside the European Economic Area. Accounting records work differently. Under the Accounting Act you may keep them only in European Union member states. Standard clauses, consent and company-wide rules make no difference to that.

AGENCIJA ZA ZASTITU OSOBNIH PODATAKA (AZOP) is the privacy regulator under the Act implementing the General Data Protection Regulation. It is independent and reports to Parliament. Its director serves a four-year term and can be reappointed once. It is clearly up and running. Its own published tally shows 1 fine in 2020, 4 in 2021, 14 in 2022, 28 in 2023, 38 in 2024 and 13 in 2025. The 2025 fines totalled EUR 6,725,500. Its largest fine so far is EUR 5.47 million against the debt collection agency EOS Matrix d.o.o. on 5 October 2023. Its second largest is the EUR 4.5 million telecoms fine of 14 November 2025. On 18 May 2026 it published five recruitment competitions for six posts, so it is staffed and growing rather than idle. We rate enforcement active rather than aggressive. The fines are large but the number of cases each year is modest. Most cases come from complaints rather than from the regulator's own sweeps. The 2025 fines fell on a telecoms operator, a bank, an energy producer, a betting operator, the Croatian Insurance Bureau and a parking company. That spread shows AZOP is not limited to one industry. NACIONALNI CENTAR ZA KIBERNETICKU SIGURNOST (NCSC-HR) sits inside the Security and Intelligence Agency. It is the central state body for cybersecurity. It is also the national computer security incident response team, the crisis management body and the single point of contact under the Cybersecurity Act. It runs the national incident reporting platform. The National CERT at CARNET covers the remaining industries. Both are up and running and publishing guidance. Other regulators matter for data too. The Croatian National Bank covers banks. The Croatian Financial Services Supervisory Agency covers insurance, pensions and markets. The State Geodetic Administration covers aerial imagery. The Tax Administration covers eInvoice reporting and accounting records. The Ministry of Justice, Public Administration and Digital Transformation covers the state information infrastructure. Unlawful use of personal data is also a crime under the Criminal Code, and the State Attorney's Office does prosecute it.

MINIMUMS. Accounting Act, Official Gazette 85/2024: the journal and general ledger at least 11 years. Subsidiary ledgers at least 11 years. Documents supporting entries in the journal and general ledger at least 11 years. Documents supporting entries in subsidiary ledgers at least 11 years. Payroll lists at least 6 years. Analytical records of wages and contributions permanently. The clock runs from the last day of the business year they relate to. The same Act also fixes where you may keep them: Croatia or another European Union member state, nowhere else. Healthcare: medical records are kept for ten years after the person dies, and data in the statutory health registers is kept permanently. eInvoice reporting has applied since 1 January 2026 and creates a further archive that falls under the accounting keeping rules. MAXIMUMS. Camera recordings must be deleted after six months at the latest. That changes only if another law sets a longer period, or the footage is evidence in a case. The general European rule applies on top. Do not keep personal data in a form that identifies someone for longer than you need it. AZOP's 2025 decisions repeatedly counted the lack of any deletion policy against the company. CONFLICT. Croatia settles the clash the normal European way. A keeping period set by another law beats a deletion request. So someone cannot force you to delete an invoice inside the eleven years. The trap is that this covers only the accounting record itself. Marketing profiles, call recordings and camera footage about the same customer are not covered. You must still delete those on time.

CLOCK 1 - PERSONAL DATA BREACH. Under Regulation (EU) 2016/679, tell AZOP without undue delay and, where you can, within 72 hours of finding out. You can skip this if the breach is unlikely to create a risk. Tell the people affected without undue delay where the risk to them is high. Croatia does not change these deadlines. CLOCK 2 - SIGNIFICANT CYBER INCIDENT. This comes from the Cybersecurity Act, Official Gazette 14/2024, and the Cybersecurity Regulation, Official Gazette 135/2024. They put the European network and information security directive into Croatian law. Essential and important entities must send an early warning within 24 hours of finding out. A fuller notice follows within 72 hours. An interim report is due if the response team asks for one, usually within 48 hours to 7 days. A final report is due within 30 days of the first notice. If the incident is still running, send progress reports every 30 days. Trust service providers skip the early warning but must file the first notice within 24 hours. Reports go through the national platform for collecting and sharing threat and incident data. If the platform is down, email the relevant response team. CLOCK 3 - FINANCIAL FIRMS. The European Union's Digital Operational Resilience Act has applied since 17 January 2025. It adds its own reporting timetable for major incidents at banks, insurers, investment firms and their critical technology providers. CLOCK 4 - TELECOMS. The Electronic Communications Act makes operators report security incidents to the telecoms regulator. We could not verify the exact deadline from an official source. It is listed as unconfirmed. The mistake is almost always the same. The security team starts the 72-hour privacy clock and forgets that the cyber early warning was due at hour 24.

1. THE ACCOUNTING CLOUD TRAP. The Accounting Act lets you hold business books and accounting documents outside Croatia only in another European Union member state. That is not a privacy rule, and no privacy paperwork overrides it. Say a Croatian subsidiary runs its finance system, invoice archive or payroll archive abroad. If that infrastructure is in the United States, the United Kingdom, Switzerland or Serbia, it is breaking the rule. What its data protection contract says makes no difference. Compulsory eInvoice reporting began on 1 January 2026, so the volume of records caught by this rule has grown sharply. 2. AGE 16, NOT 13 OR 15. The Act implementing the General Data Protection Regulation sets 16 as the age at which a child can agree to an online service. Croatia took the highest age the Regulation allows. A product built to a 13-year cut-off breaks the rules in Croatia. A single global setting of 15 or 16 will still be wrong unless it is 16 for Croatia. 3. CRIMINAL LIABILITY. The Criminal Code makes unlawful use of personal data a crime. It attaches to people, not just to companies. The State Attorney's Office does bring charges under it, sometimes alongside computer fraud. An employee who misuses a customer database is personally at risk. So is the manager who told them to do it. 4. GENETIC DATA AND LIFE INSURANCE. The Croatian implementing Act bans one use of genetic data. You may not use it to price a life insurance policy. That covers working out how likely someone is to fall ill, and other health facts about them. This is a flat national ban. Consent does not unlock it. Most other member states have nothing like it. 5. CAMERAS HAVE THEIR OWN RULES. Croatia puts the camera rules in the law itself rather than in guidance. Delete recordings within six months, unless another law says otherwise or they are evidence. Signs must name the company responsible and give its contact details. You may not film changing rooms, washrooms or rest areas. Public areas may generally be filmed only by public authorities and public service providers. In a residential building you need two thirds of the co-owners to agree, and you may cover only entrances and common areas. Fingerprint or face-based door entry and clocking-in systems in the private sector need each employee's explicit consent. They must also be offered as an alternative to another option. That makes fingerprint-only clocking systems hard to justify. 6. BONUS - PUBLIC PROCUREMENT. If you sell software to the Croatian state, the Act on State Information Infrastructure now forces personal-data registers into Croatian data centres. It also forces state bodies into the government's Shared Services Centre. A foreign vendor whose systems assume a big cloud region outside Croatia cannot bid credibly.

CROATIA - WITH DATES. 1 January 2027: the penalty parts of the Act on State Information Infrastructure start to apply. Fines run from EUR 500 to EUR 6,630, roughly 540 to 7,200 US dollars. Until then the Croatian data-centre rule for state registers is in force but carries no fine. That gap is exactly what makes suppliers miss it. 1 January 2027: the second phase of eInvoice reporting catches traders who are not registered for value added tax. Phase one, covering businesses registered for value added tax, has applied since 1 January 2026. Within 12 months of the state infrastructure regulation: projects must be registered in the state project register, and data exchange interfaces must be built. A public consultation on changes to the Electronic Communications Act was open in 2026. We could not verify its content from an official source. EUROPEAN UNION - WITH DATES. 12 January 2027: under the Data Act, Regulation (EU) 2023/2854, all cloud switching charges and data export fees must be zero. This is a firm deadline and it changes what cloud contracts cost. 2 August 2026: the openness duties of the Artificial Intelligence Act have already started. Still not adopted: the European cloud certification scheme, stuck over sovereignty since 2020. So national arrangements continue to apply. The Digital Omnibus proposal of 19 November 2025 would loosen the definition of personal data and stretch breach reporting from 72 to 96 hours. It has no legal effect, and its core change was opposed in February 2026. POWERS ALREADY HELD, which could change the answer with no consultation. 1. The Act on State Information Infrastructure lets the state require NON-personal data to be stored in Croatia where public security justifies it. Regulation (EU) 2018/1807 leaves that opening. Croatia has written it into its law, ready to use. 2. The Ministry of Defence commission for aerial imagery can block any image from release, with no published standard. You can fly a survey lawfully and still be unable to use the results. 3. The Europe-United States Data Privacy Framework is still in force and legally valid on 18 August 2026. But the Latombe appeal is pending before the Court of Justice, after the General Court dismissed the case on 3 September 2025. The United States oversight bodies behind it have been weakened. On 31 July 2026 the European Data Protection Board wrote to the Commission. It asked the Commission to check whether the decision that the United States is safe enough still holds. The Commission has not suspended or revoked it. Do not build on it as your only route.