What Is Act on the Implementation of the General Data Protection Regulation?
Croatia's implementing statute is the Act on the Implementation of the General Data Protection Regulation, published in Narodne novine 42/2018, item 805. It was adopted on 27 April 2018 and entered into force on 25 May 2018, repealing the prior general Personal Data Protection Act. Croatia is an EU member state, so the GDPR applies directly alongside the national Act. AZOP’s current national-legislation page continues to identify the 2018 Act as operative, and its 2026 guidance confirms AZOP's continuing GDPR supervisory role. No separately published consolidated version was located, so the official Narodne novine text remains the statutory citation. Croatia has no express GDPR Article 85 journalism, academic, artistic, or literary exemption located in the implementing Act. Its Article 33 regime concerns official statistics specifically and must not be generalized to scientific research.
At a glance
- Full name
- Act on the Implementation of the General Data Protection Regulation
- Short code
- Act on the Implementation of the GDPR
- Jurisdiction
- Croatia
- Enacted
- 2018
- Last major update
- AZOP’s current national-legislation page continues to identify the Act on the Implementation of the GDPR (Official Gazette 42/2018, item 805) as operative; no separately published consolidated version was located
- Regulator
- Croatian Personal Data Protection Agency (AZOP)
- Private right of action
- Limited
Scope, who Act on the Implementation of the GDPR covers
Protected data
Data subject rights
GDPR transparency and information rights under Articles 12-14, generally subject to a one-month response period and a possible two-month extension
Right of access under Article 15, with a specific official-statistics limitation where necessary and proportionate
Right to rectification under Article 16, with the same official-statistics limitation
Right to erasure under Article 17; no general Croatian derogation was located, including for data in public registers, subject to ordinary Article 17 conditions
Right to restriction of processing under Article 18, subject to the official-statistics regime
Right to data portability under Article 20; no separate Croatian derogation was located
Right to object under Article 21, including ordinary direct-marketing objection, subject to the official-statistics regime
Protection concerning automated decision-making under Article 22; no general derogation was located
Right to request a determination of a rights violation from AZOP; current AZOP guidance accepts personal, written, fax, or email submission and asks for an understandable, complete request identifying the controller, facts, requested remedy, prior controller contact where applicable, and supporting documents
Right to administrative-court review of an AZOP decision; no administrative appeal exists
Notable features
Croatia’s implementing Act contains no express GDPR Article 85 journalism, academic, artistic, or literary derogation located in the report. Article 33 creates a specific official-statistics regime, allowing necessary and proportionate limitations on access, rectification, restriction, and objection, but it is not a general scientific-research exemption. The OIB is an identifier framework rather than a GDPR exemption, and historical kuna-denominated penalty provisions create a currentness trap.
Enforcement & penalties
Regulator: Croatian Personal Data Protection Agency (AZOP)
Penalties: GDPR Article 83 applies directly: up to €10 million or 2% of annual worldwide turnover for the lower tier, and up to €20 million or 4% for the higher tier. Public authorities cannot receive an administrative fine under the GDPR or the implementing Act, although AZOP’s other corrective powers remain available. A narrow video-surveillance signage, access-logging, or recordings-misuse fine caps at 50,000 kuna, and a separate 5,000-50,000 kuna misdemeanor range applies to unauthorized disclosure by specified AZOP officials. These kuna-denominated provisions are historical-currency provisions, not a general current Croatian fine schedule.
Private right of action: Individuals may request an AZOP determination of a rights violation and bring an administrative lawsuit because no administrative appeal exists. A general private damages route was not described in the reviewed report.
Relevance to data brokers
Not located. No dedicated Croatian data-broker, people-search, or public-record-specific route was located. The identified mechanisms are ordinary GDPR controller-request rights, an AZOP request for determination of a rights violation, and administrative-court review. AZOP’s current request materials ask for controller identification, the facts and requested remedy, prior controller correspondence where applicable, and supporting documents; these requirements do not create a broker-specific route.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does Croatia have a journalism exemption under GDPR Article 85?+
No express GDPR Article 85 journalism, academic, artistic, or literary exemption was located in Croatia’s implementing Act. AZOP evaluates media publication case-by-case under GDPR principles, legal bases, public interest, and separate Croatian media legislation.
Can I complain to Croatia’s data-protection regulator?+
Yes. An individual may request a determination of a rights violation from AZOP after first contacting the controller. AZOP’s current guidance accepts personal, written, fax, or email submission and asks for the controller, facts, requested remedy, prior correspondence where applicable, and supporting documents. No administrative appeal exists against an AZOP decision; the identified route is an administrative lawsuit.
Does Croatia have a dedicated data-broker deletion route?+
Not located. No dedicated data-broker, people-search, or public-record-specific route was located. Ordinary GDPR controller-request rights and the AZOP complaint route are the mechanisms identified in the reviewed materials.
Official sources & citations
Other international privacy regimes
Act on the Implementation of the GDPR sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: