What Is Act on the Implementation of the General Data Protection Regulation?
Croatia's implementing statute is the Act on the Implementation of the General Data Protection Regulation, published in Narodne novine 42/2018, item 805. It was adopted on 27 April 2018 and entered into force on 25 May 2018, repealing the prior general Personal Data Protection Act. Croatia is an EU member state, so the GDPR applies directly alongside the national Act. No separately published consolidated version was located. Current AZOP materials continue describing the 2018 Act as operative without flagging a newer amendment, so the official Narodne novine text should be described carefully and currentness rechecked before publication. Croatia has no express GDPR Article 85 journalism, academic, artistic, or literary exemption located in the implementing Act. Its Article 33 regime concerns official statistics specifically and must not be generalized to scientific research.
At a glance
- Full name
- Act on the Implementation of the General Data Protection Regulation
- Short code
- Act on the Implementation of the GDPR
- Jurisdiction
- Croatia
- Enacted
- 2018
- Last major update
- Official Narodne novine 42/2018, item 805 text; no separately published consolidated version was located and currentness should be rechecked before publication
- Regulator
- Croatian Personal Data Protection Agency (AZOP)
- Private right of action
- Limited
Scope, who Act on the Implementation of the GDPR covers
Protected data
Data subject rights
GDPR transparency and information rights under Articles 12-14, generally subject to a one-month response period and a possible two-month extension
Right of access under Article 15, with a specific official-statistics limitation where necessary and proportionate
Right to rectification under Article 16, with the same official-statistics limitation
Right to erasure under Article 17; no general Croatian derogation was located, including for data in public registers, subject to ordinary Article 17 conditions
Right to restriction of processing under Article 18, subject to the official-statistics regime
Right to data portability under Article 20; no separate Croatian derogation was located
Right to object under Article 21, including ordinary direct-marketing objection, subject to the official-statistics regime
Protection concerning automated decision-making under Article 22; no general derogation was located
Right to request a determination of a rights violation from AZOP
Right to administrative-court review of an AZOP decision; no administrative appeal exists
Notable features
Croatia’s implementing Act contains no express GDPR Article 85 journalism, academic, artistic, or literary derogation located in the report. Article 33 creates a specific official-statistics regime, allowing necessary and proportionate limitations on access, rectification, restriction, and objection, but it is not a general scientific-research exemption. The OIB is an identifier framework rather than a GDPR exemption, and historical kuna-denominated penalty provisions create a currentness trap.
Enforcement & penalties
Regulator: Croatian Personal Data Protection Agency (AZOP)
Penalties: GDPR Article 83 applies directly: up to €10 million or 2% of annual worldwide turnover for the lower tier, and up to €20 million or 4% for the higher tier. Public authorities cannot receive an administrative fine under the GDPR or the implementing Act, although AZOP’s other corrective powers remain available. A narrow video-surveillance signage, access-logging, or recordings-misuse fine caps at 50,000 kuna, and a separate 5,000-50,000 kuna misdemeanor range applies to unauthorized disclosure by specified AZOP officials. These kuna-denominated provisions are historical-currency provisions, not a general current Croatian fine schedule.
Private right of action: Individuals may request an AZOP determination of a rights violation and bring an administrative lawsuit because no administrative appeal exists. A general private damages route was not described in the reviewed report.
Relevance to data brokers
Not located. No dedicated Croatian data-broker, people-search, or public-record-specific route was located. The only mechanisms found are ordinary GDPR controller-request rights and the AZOP complaint route, with erasure subject to the ordinary Article 17 conditions.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Does Croatia have a journalism exemption under GDPR Article 85?+
No express GDPR Article 85 journalism, academic, artistic, or literary exemption was located in Croatia’s implementing Act. AZOP evaluates media publication case-by-case under GDPR principles, legal bases, public interest, and separate Croatian media legislation.
Can I complain to Croatia’s data-protection regulator?+
Yes. An individual may request a determination of a rights violation from AZOP after first contacting the controller. No administrative appeal exists against an AZOP decision; the identified route is an administrative lawsuit.
Does Croatia have a dedicated data-broker deletion route?+
Not located. No dedicated data-broker, people-search, or public-record-specific route was located. Ordinary GDPR controller-request rights and the AZOP complaint route are the mechanisms identified in the reviewed materials.
Official sources & citations
Other international privacy regimes
Act on the Implementation of the GDPR sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: