Croatia

Art. 19(2) requires employers with at least 50 workers to set up an internal reporting system. Art. 20 requires a confidential person and deputy. Under Art. 22(2) the confidential person acknowledges receipt within seven days and gives feedback generally within 30 days, and no later than 90 days. The Ombudsman is the external body (Art. 24); retaliation is prohibited (Art. 9).

AZOP applies the GDPR directly. In its October 2026 decision on a games-of-chance operator it relied on Arts. 5(1)(a) and (c), 6(1), 7, 9(1), 12(1) and 13 (lawful basis, valid consent and clear information). The Implementation Act adds national rules, including a six-month default retention limit for video surveillance recordings (Art. 29).

Per AZOP, the controller must notify the Agency of a personal data breach no later than 72 hours after becoming aware of it, unless the breach is unlikely to risk individuals' rights and freedoms; a later report must give the reasons for the delay (Art. 33 GDPR). Failure to notify is a breach of Art. 33 and can attract fines under Art. 83.

Art. 14 provides that Hanfa decides on CASP authorisation for Croatian joint-stock companies or limited liability companies under MiCA Arts. 62 and 63; Art. 15 covers revocation and Art. 18 requires Hanfa's approval for management board appointments. ART and EMT issuers that are not credit institutions are authorised by the HNB (Art. 40).