🇭🇷Act Implementing the General Data Protection Regulation

← Back to laws in Croatia

Act Implementing the General Data Protection Regulation

Croatia applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Act implements the GDPR in Croatia, establishes AZOP and adds national provisions for children, genetic and biometric data, video surveillance, procedure and administrative fines.

National additions and variations

• Article 19 sets 16 as the age for consent-based information-society services offered directly to a child resident in Croatia.
• Article 20 prohibits genetic-data processing to calculate disease and health prospects for life-insurance and survival-benefit contracts; consent cannot lift the prohibition.
• Articles 21-24 impose necessity and balancing requirements on public- and private-sector biometrics and permit employee biometrics for time or premises access only under a statutory route or as an alternative with explicit consent.
• Articles 25-30 regulate video surveillance, including legitimate-purpose limits, access controls, notice before entry, a general six-month retention ceiling and additional rules for residential, workplace and public-area monitoring.
• AZOP may investigate, order compliance and impose GDPR fines, while the Act contains specific procedure, publication and public-authority rules.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.