Croatia
10 regulators · 16 laws & regulations · 4 obligations · 5 enforcement actions
| Obligation | Timing | Regulator | Arises from | Source | Detail |
|---|---|---|---|---|---|
| All industries | |||||
| Lawful basis, notice and data subject rights | — | AZOP | Zakon o provedbi Opće uredbe o zaštiti podataka (Act on the Implementation of the General Data Protection Regulation) | official | |
AZOP applies the GDPR directly. In its October 2026 decision on a games-of-chance operator it relied on Arts. 5(1)(a) and (c), 6(1), 7, 9(1), 12(1) and 13 (lawful basis, valid consent and clear information). The Implementation Act adds national rules, including a six-month default retention limit for video surveillance recordings (Art. 29). |
|||||
| Personal data breach notification to AZOP | Deadline Within 72 hours of becoming aware | AZOP | Zakon o provedbi Opće uredbe o zaštiti podataka (Act on the Implementation of the General Data Protection Regulation) | official | |
Per AZOP, the controller must notify the Agency of a personal data breach no later than 72 hours after becoming aware of it, unless the breach is unlikely to risk individuals' rights and freedoms; a later report must give the reasons for the delay (Art. 33 GDPR). Failure to notify is a breach of Art. 33 and can attract fines under Art. 83. |
|||||
| No obligations match these filters. | |||||