Croatia. Comprehensive data protection. Act
ZPOUZPAct on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka)
In force
§1Summary
- Synopsis
Croatia's implementing act establishes AZOP and adds national rules for video surveillance, biometric and genetic data, and statistics. It sets the age of consent and limits fines on public bodies.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 16. No administrative fines may be imposed on public authorities; processing of genetic data for life-insurance purposes is prohibited; detailed video surveillance rules including workplace monitoring.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; no fines on public authorities
§3Dates
- Key dates
- Adopted
- In force
- Published Narodne novine 42/2018 (9.5.2018)
§4Text and authority
- Text
- Authoritative text narodne-novine.nn.hr
- Authority
- Agencija za zaštitu osobnih podataka (AZOP)
§5Where it applies
- Domestic law of
- Croatia
§6Sources and verification
- Sources consulted
- Verification
High confidence.