---
title: "Croatia Data Protection & Privacy Regulation | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/croatia/
source_html: /jurisdictions/croatia/index.html
description: "Croatia data protection and privacy regulation: 10 categories, 100 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border…"
generated_at: 2026-11-07T14:58:19Z
content_sha256: 085789d68dea9e063abf3d8e6970e3d671a3df362ae3d301ee8118bde67f03d4
generator: "fe-fleet/md-twin@1.0"
---
# Croatia Data Protection & Privacy Regulation | Data Protection Monitor

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

# Croatia Data Protection & Privacy Regulation

schema gdpri-v2
trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/croatia/), [World Payments](https://payments.gi/jurisdictions/croatia/), artificial-intelligence

Last updated 2026-10-25 · 10 categories · 100
claims · 40 sources in the cumulative register

Download report (PDF) Expand all

AZOP is confirmed as Croatia's sole independent public supervisory authority within the meaning of GDPR Article 51.

Data collected 2026-10-25 · Data published 2026-10-25

AI-assembled from cited sources

Not fully checked this cycle: Regulator & Framework, Controller/Processor Duties, Enforcement & Redress (3 open gaps).

Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

[Open in Co-Pilot ↗](/reports/?type=copilot&j=CROATIA)[Build Report](/reports/?j=CROATIA)[Compare](/compare/?j=CROATIA)

Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified

Lead supervisory authority Agencija za zaštitu osobnih podataka (AZOP) / Croatian Personal Data Protection Agenc Primary statutory & supervisory perimeter

Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record

Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain

10 Categories

0 Red categories 57 Sub-modules

100 Claims

12 Tier-1 sources

Traffic-light mix 6 green 4 amber
(sums to 10 rendered categories; click to filter)

No red categories; 8 sub-modules are flagged red.

Law made at European Economic Area (Bloc) level that applies in Croatia is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Croatia’s own layer: implementation, national authorities, national options and local enforcement.

## Jurisdiction brief

Jurisdiction lead brief 1,058 Full executive summary 232

###### Latest update · 19 October 2026

#### Lead Signal

AZOP, Croatia's data protection authority, fined a gambling and casino operator EUR 2,590,000 on 2 October 2026 for unlawfully collecting four fingerprints, rather than the two disclosed to data subjects, for biometric identification purposes. The decision found that the collection exceeded the necessity threshold for the stated purpose and was not supported by valid consent. AZOP also found, in the same decision, that the operator's consent mechanism bundled multiple processing purposes without offering data subjects a separable choice, and that the privacy information provided was incomplete, inaccurate, and in places contradictory. This is a confirmed enforcement action evidencing an assertive supervisory posture toward biometric data processing specifically and toward consent-mechanism design more broadly.

This fine follows a EUR 1.5 million penalty AZOP imposed on a bank on 18 December 2025 for processing the personal data of 433,922 mobile-banking users without a legal basis, establishing what reads as a pattern of large, consequential AZOP fines across different sectors over the past year.

#### Other Developments

AZOP opened an urgent supervisory procedure over a data breach at CARNET involving students' and teachers' personal data, understood to have been initiated around 15 June 2026. This is a probable, rather than fully confirmed, development in the education sector, reflecting an active supervisory response to a breach affecting a government-adjacent research and education network.

The European Commission sent Croatia an additional letter of formal notice on 29 April 2026 regarding the Digital Services Act, citing Croatia's failure to empower its Digital Services Coordinator and the presence of DSA-non-compliant penalty provisions in national law. This is a confirmed development that is adjacent to, rather than squarely within, core data protection enforcement, but it bears on the broader institutional capacity of Croatia's digital-regulation architecture.

AZOP began implementing the 2026 European Data Protection Board Coordinated Enforcement Framework on GDPR Articles 12 to 14 transparency obligations, with a scope that includes AI systems and higher-education-institution transparency practices, and a questionnaire response that was due 15 July 2026. This is a confirmed, active coordinated-enforcement exercise running in parallel with AZOP's domestic enforcement activity.

#### Cross-Monitor Connections

The European Commission's letter of formal notice on Digital Services Act non-compliance is adjacent to the artificial-intelligence and platform-governance monitoring line; readers tracking Croatia's broader digital-regulation posture should refer there for analysis of the DSA enforcement trajectory itself, as this brief treats it only as sectoral context for AZOP's own data protection activity.

#### Outlook

The EUR 2.59 million biometric fine, read alongside the December 2025 bank fine, suggests AZOP's enforcement trajectory is tightening and increasingly willing to impose seven-figure penalties on both financial-sector and biometric-processing violations. Whether the CARNET supervisory procedure results in a further enforcement decision, and whether the 2026 EDPB Coordinated Enforcement Framework exercise on transparency produces a published outcome, are both plausible sources of further signal as AZOP's current enforcement posture continues.

2 earlier updates not shown here.

###### Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

#### Lead Signal

AZOP is confirmed as Croatia's sole independent public supervisory authority within the meaning of GDPR Article 51. The Act on the Implementation of the GDPR (NN 42/2018) supplements the GDPR as Croatia's principal national implementing instrument. AZOP imposed its largest publicized fine to date, EUR 5.47 million against EOS Matrix d.o.o. in October 2023, after an anonymous petition revealed unauthorized processing of 181,641 individuals' data, including unlawful health-data and recorded-call processing. AZOP has this year begun 2026 EDPB Coordinated Enforcement Framework activity, requiring mandatory controller questionnaires on GDPR compliance, AI systems, and Articles 12-14 transparency, due 15 July 2026. Taken together, these developments describe a stable statutory framework now entering a more assertive enforcement phase, with an emerging watch area in AI-systems compliance.

#### Other Developments

The Implementation Act prohibits processing genetic data to calculate disease probability for life-insurance or pure-endowment contracts, even with explicit consent. Public authorities and private entities may process biometric data without consent for protection of persons, property, classified data, or business secrets, subject to a balancing test. State bodies performing official statistics are exempted from enabling access, rectification, restriction, and objection rights where this would threaten statistical activities. State and local-government bodies are excluded from administrative fines, while public-service legal entities remain fineable within limits that cannot endanger service performance. Video-surveillance personal data cannot be retained longer than six months unless necessary for judicial or arbitral proceedings. Croatia sets the digital age of consent at 16, with no lower national derogation. AZOP issued FAQs guiding EOS Matrix breach victims on exercising GDPR access and compensation rights. AZOP's investigation of the Croatian Insurance Bureau found the controller had not set maximum retention periods, violating the GDPR Article 5(1)(e) storage-limitation principle. That fine, EUR 101,000 against the Croatian Insurance Bureau, formed part of a EUR 350,500 aggregate across eight separate AZOP decisions announced 2 July 2025. AZOP is understood to have separately fined a company EUR 12,000 for DPO-appointment violations. Croatia applies GDPR Chapter V directly for international transfers, with no separate national regime. Adequacy decisions are adopted exclusively by the European Commission at EU level, and Croatia issues no independent national adequacy determinations. The Electronic Communications Act, in force since 2022, is understood to implement the EU ePrivacy Directive for telecom providers under joint HAKOM and AZOP supervision. Cookie and direct-marketing practices continue to be governed by ePrivacy-derived opt-in consent rules alongside GDPR lawful-basis requirements.

#### Cross-Monitor Connections

The Croatian Insurance Bureau enforcement action intersects with financial-sector data-protection obligations. AML-specific angles are routed to financial-integrity for further analysis. The EOS Matrix debt-collection enforcement may carry a payments-adjacent personal-data surface potentially relevant to world-payments, though this connection remains uncertain. AZOP's 2026 Coordinated Enforcement Framework questionnaire probes controllers' AI systems against GDPR transparency obligations. This intersects with EU AI Act compliance; AI-Act-first framing is routed to artificial-intelligence, while this monitor retains the profiling and automated-decision-making transparency angle.

#### Outlook

AZOP's coordinated 2026 questionnaire activity, due 15 July 2026, is likely to keep AI-systems transparency and Articles 12-14 compliance under active national scrutiny in the near term, absent any dedicated Croatian AI statute. The agency's enforcement record, anchored by the EOS Matrix and Croatian Insurance Bureau fines, suggests a maturing, more assertive supervisory posture is likely to continue within the existing GDPR and Implementation Act framework, rather than through new legislative change.

Read full brief · 1058 words

Standing brief, as of 25 August 2026.

#### Regulatory Status

AZOP is Croatia's sole independent public supervisory authority within the meaning of GDPR Article 51. In lawful processing, the Implementation Act prohibits genetic-data processing for life-insurance disease-probability calculations even with consent. Data subject rights are understood to follow the unmodified GDPR one-month response deadline, with no identified Croatian derogation. On controller and processor duties, AZOP's 2026 Coordinated Enforcement Framework activity now requires controller questionnaires on AI systems and Articles 12-14 transparency, due 15 July 2026. Cross-border transfers rely directly on GDPR Chapter V, with no separate Croatian regime. In sectoral watch, AZOP fined the Croatian Insurance Bureau EUR 101,000 over the Register of Registered Vehicles data leak affecting one million vehicle owners. Adtech and commercial-privacy practices are governed by the ePrivacy Directive as transposed via the Electronic Communications Act, alongside GDPR consent standards. AZOP's 2026 questionnaire marks the first documented probe into controllers' AI-systems compliance, absent a dedicated Croatian AI statute. Croatia's digital age of consent for children is set at 16, with no lower national derogation. On enforcement, AZOP's largest publicized fine to date, EUR 5.47 million against EOS Matrix d.o.o. in October 2023, anchors an active enforcement record.

#### Outlook

Croatia's data-protection framework remains stable and GDPR-aligned overall, with the near-term outlook dominated by AZOP's 2026 Coordinated Enforcement Framework activity on AI-systems transparency and by continued follow-through on its multi-year enforcement record.

Read full brief · 232 words

Key regulatory facts for Croatia Regulatory Dimension Croatia Standing Position

Jurisdiction Croatia (HR)

Regulatory Scope Data Protection & Privacy Regulation (10 modules, 100 sourced findings)

Regulator & Framework Fully GDPR-aligned omnibus regime with an established, active national implementing act and functioning DPA.

Lawful Processing & Special Data GDPR baseline applies with narrow, well-documented national derogations on special categories; consent and anonymisation rely on unmodified GDPR text.

Data Subject Rights Rights framework is GDPR-standard with narrow, documented statistics carve-out and an active regulator issuing rights-exercise guidance after incidents.

Controller/Processor Duties Strong, evidenced enforcement record across security, breach-notification, retention and DPO duties; standard GDPR framework for ROPA/joint-controller arrangements.

Primary Instruments Cited European Data Protection Board, International Association of Privacy Professionals, AZOP, Vision Compliance, dataprotection.gi

Last Confirmed / Updated 2026-10-25 (40 sources in cumulative register)

10 of 10 categories

Signal
Red
Amber
Green

Density
Comfortable
Compact

Expand all sources
Reset all

Selections OR within a group, AND across groups. Press / to search.

### Croatia: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Fully GDPR-aligned omnibus regime with an established, active national implementing act and functioning DPA.

Primary framework Regulation (EU) 2016/679 (GDPR) as supplemented by the Act on the Implementation of the General Data Protection Regulation (Narodne novine 42/2018)

Supervisory authority [Agencija za zaštitu osobnih podataka (AZOP) / Croatian Personal Data Protection Agency](https://azop.hr/)

Traffic-light rationale — Green Fully GDPR-aligned omnibus regime with an established, active national implementing act and functioning DPA.

#### Sub-modules (5)

#### Regulator And AuthorityGreen

AZOP is confirmed as the only independent public supervisory authority in Croatia within the meaning of GDPR Article 51.

Claims (5):

- AZOP (Agencija za zaštitu osobnih podataka) is the sole independent public supervisory authority in the Republic of Croatia within the meaning of Article 51 of the GDPR.
- AZOP (Agencija za zaštitu osobnih podataka) — AZOP's Deputy Chair, Zdravko Vukić, chaired/participated in the EDPB's October 2026 plenary which adopted a statement on smart glasses and published the report 'The connected gaze'.
- AZOP — Croatia's sole supervisory authority under GDPR, operating under the national implementing Act (NN 42/18, in force since 25 May 2018).
- AZOP — Croatia's sole independent public supervisory authority under GDPR Art 51
- AZOP is Croatia's sole independent public supervisory authority within the meaning of GDPR Article 51.

#### Act And InstrumentsGreen

The Implementation Act (NN 42/2018) is the principal domestic instrument; it also sets an advisory-fee schedule for AZOP's consultation services to commercial requesters.

Claims (2):

- The Act on the Implementation of the General Data Protection Regulation (Narodne novine No. 42/2018) is Croatia's principal national instrument supplementing the GDPR.
- The Implementation Act authorizes AZOP to charge fees for advisory consultations provided to business subjects such as law firms and GDPR consultants, while data subjects, DPOs, journalists and public authorities receive free consultation.

#### Material ScopeGreen

Material scope follows GDPR directly, with a narrow national carve-out for state statistical bodies.

Claims (1):

- State bodies performing official state statistics activities are not required to enable data subjects to exercise access, rectification, restriction or objection rights where doing so would threaten or disable performance of statistical activities.

#### Territorial ScopeGreen

Territorial application of national administrative-fine provisions tracks GDPR's establishment/targeting tests for controllers with business residence or service provision in Croatia.

Claims (1):

- Controllers bound by the Implementation Act's derogations are those having business residence or providing services in the Republic of Croatia.

#### Regulator Registration And FilingAmber

No general controller-registration/filing regime beyond GDPR Art 30 ROPA; state/local-government bodies are exempt from administrative fines, though public-service legal entities remain fineable within limits.

Claims (1):

- State administrative bodies, other state bodies, and units of local and regional self-government are excluded from the charging of administrative fines, while legal entities performing public authority or public-service functions remain fineable in amounts that cannot endanger performance of those services.

Croatia is an EU Member State applying the GDPR directly, supplemented by the national Act on the Implementation of the General Data Protection Regulation (Narodne novine No. 42/2018). The Croatian Personal Data Protection Agency (AZOP) is the sole independent supervisory authority under Article 51 GDPR. The Implementation Act adds Croatia-specific procedural rules (advisory fee schedule, statistics-body carve-outs, court-review route) without displacing GDPR's material or territorial scope.

No periodic updates recorded in this cycle

Sources and claims (10)
- [European Data Protection Board](https://edpb.europa.eu/system/files/2023-04/csc_guide_right_of_access_rectification_and_erasure_20230403_en.pdf) — AZOP (Agencija za zaštitu osobnih podataka) is the sole independent public supervisory authority in the Republic of Croatia within the meaning of Article 51 of the GDPR.
- [European Data Protection Board](https://edpb.europa.eu/system/files/2023-04/csc_guide_right_of_access_rectification_and_erasure_20230403_en.pdf) — The Act on the Implementation of the General Data Protection Regulation (Narodne novine No. 42/2018) is Croatia's principal national instrument supplementing the GDPR.
- [International Association of Privacy Professionals](https://iapp.org/news/a/croatian-gdpr-implementation-law-main-features-and-unanswered-questions) — The Implementation Act authorizes AZOP to charge fees for advisory consultations provided to business subjects such as law firms and GDPR consultants, while data subjects, DPOs, journalists and public authorities receive free consultation.
- [International Association of Privacy Professionals](https://iapp.org/news/a/croatian-gdpr-implementation-law-main-features-and-unanswered-questions) — State bodies performing official state statistics activities are not required to enable data subjects to exercise access, rectification, restriction or objection rights where doing so would threaten or disable performance of statistical activities.
- [International Association of Privacy Professionals](https://iapp.org/news/a/croatian-gdpr-implementation-law-main-features-and-unanswered-questions) — Controllers bound by the Implementation Act's derogations are those having business residence or providing services in the Republic of Croatia.
- [International Association of Privacy Professionals](https://iapp.org/news/a/croatian-gdpr-implementation-law-main-features-and-unanswered-questions) — State administrative bodies, other state bodies, and units of local and regional self-government are excluded from the charging of administrative fines, while legal entities performing public authority or public-service functions remain fineable in amounts that cannot endanger performance of those services.
- [AZOP](https://azop.hr/naslovna-english/) — AZOP (Agencija za zaštitu osobnih podataka) — AZOP's Deputy Chair, Zdravko Vukić, chaired/participated in the EDPB's October 2026 plenary which adopted a statement on smart glasses and published the report 'The connected gaze'.
- [Vision Compliance](https://visioncompliance.eu/hr/blog/gdpr-hrvatska-vodic-za-uskladivanje) — AZOP — Croatia's sole supervisory authority under GDPR, operating under the national implementing Act (NN 42/18, in force since 25 May 2018).
- [dataprotection.gi](https://dataprotection.gi/jurisdictions/croatia/) — AZOP — Croatia's sole independent public supervisory authority under GDPR Art 51
- [AZOP](https://azop.hr/naslovna-english/) — AZOP is Croatia's sole independent public supervisory authority within the meaning of GDPR Article 51.

### Croatia: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾

GDPR baseline applies with narrow, well-documented national derogations on special categories; consent and anonymisation rely on unmodified GDPR text.

Primary framework GDPR Articles 6-9 as supplemented by the Implementation Act (NN 42/2018)

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Green GDPR baseline applies with narrow, well-documented national derogations on special categories; consent and anonymisation rely on unmodified GDPR text.

Periodic update · new data 2026-10-13

#### Lawful Processing & Special Data

AZOP's 2 October 2026 decision against an unnamed gambling operator applies the consent-validity and special-category rules together in a single enforcement action. On consent, AZOP found that the operator presented four bundled consent fields covering distinct processing purposes, without a mechanism allowing a user to consent to one purpose while withholding consent to another. That structure fails the requirement that consent be freely given, specific, informed and unambiguous, since bundling removes the specificity a data subject needs to make a genuine choice about each distinct purpose.

On special-category data, the decision found that the operator collected four fingerprints per player, two from each hand, for identification purposes, despite having represented to users that only two fingerprints, one per hand, were being collected. AZOP found that the operator could not demonstrate that the larger scope of biometric collection was necessary for the stated identification purpose, and that reliance on a justification of needing a backup fingerprint, without more, did not meet that necessity standard. The finding affected 34,933 players, a scale that elevates this beyond an isolated procedural defect and into a population-wide data-minimisation failure. Press reporting identifies the operator as Admiral, though AZOP's own release does not name the entity, and this identification should be treated as unconfirmed by the regulator itself.

Together, the consent and biometric findings describe an operator whose data-collection architecture had grown beyond what it had disclosed to users and beyond what it could justify as necessary, two distinct GDPR Article 5 and Article 9 problems converging in a single enforcement outcome. The EUR 2,590,000 fine reflects the combined weight of both findings rather than either issue standing alone.

#### Outlook

The decision gives Croatian controllers operating consent flows with multiple bundled processing purposes, and those operating biometric identification systems generally, a concrete applied benchmark for both consent granularity and necessity testing. Where the fined operator's identity is confirmed, or where the decision is tested on appeal, the precedent value of this decision for other consent-bundling and biometric-collection practices in Croatia is likely to sharpen further.

D2 · Lawful Processing — Full Module Record 4 sub-modules · 48 words · 12 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Croatia: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Rights framework is GDPR-standard with narrow, documented statistics carve-out and an active regulator issuing rights-exercise guidance after incidents.

Primary framework GDPR Articles 13-22 as supplemented by the Implementation Act (NN 42/2018)

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Green Rights framework is GDPR-standard with narrow, documented statistics carve-out and an active regulator issuing rights-exercise guidance after incidents.

#### Sub-modules (5)

#### Access RightGreen

Access-right exercise is GDPR-standard; AZOP issued dedicated FAQs helping data subjects claim access/compensation after the EOS Matrix breach.

Claims (2):

- Following the 2023 EOS Matrix breach, AZOP released FAQs guiding affected citizens on exercising GDPR rights, including claiming compensation and accessing their personal data held by EOS Matrix.
- AZOP — FAQs guiding EOS Matrix breach victims on exercising GDPR access/compensation rights

#### Rectification And ErasureGreen

No Croatia-specific derogation to rectification/erasure beyond the statistics carve-out was found.

#### Restriction And ObjectionAmber

State statistical bodies are exempted from enabling restriction/objection rights where this would impair statistical functions.

Claims (2):

- State bodies performing official state statistics activities are exempted from enabling data subjects to exercise access, rectification, restriction-of-processing or objection rights where this would threaten or disable performance of statistical activities.
- state statistical bodies — enabling restriction/objection rights where compliance would impair statistical functions

#### Data PortabilityAmber

No Croatia-specific derogation to GDPR Article 20 portability was identified; the unmodified GDPR right applies.

#### Deadlines And Response WindowsAmber

No Croatia-specific shortened/lengthened response-deadline rule was found; the GDPR one-month (extendable) default applies.

Claims (2):

- No Croatia-specific derogation from the GDPR default one-month (extendable by two further months for complex requests) subject-access response deadline was identified.
- Croatia — GDPR default one-month (extendable by two months) subject-access response deadline

Data-subject rights follow GDPR Articles 13-22 directly. Croatia's principal derogation excuses state statistical bodies from certain rights where compliance would impair statistical functions, and provides a court-review (not administrative-complaint) route against AZOP decisions on rights matters. AZOP has also issued rights-exercise FAQs following major breaches. No Croatia-specific portability or deadline derogation was found.

Periodic update · new data 2026-09-28

#### Data Subject Rights

AZOP is understood to have fined a bank for breaching Article 15(3) of the GDPR by charging a fee for providing copies of credit documentation to a data subject, an action reported via IAPP's coverage of the regulator's enforcement record rather than confirmed directly from AZOP's own decision text. The framing of this case within IAPP's own reporting places it as one of at least two comparable cases in which AZOP has advocated for the right of access to credit documentation against banks specifically, suggesting a recurring rather than isolated enforcement focus on this particular data-subject right within the financial sector.

The substantive issue in each instance is the same: a controller charging a fee for the provision of copies under Article 15(3), where the GDPR permits a reasonable fee only in defined circumstances such as repeated requests, and treats free provision as the default expectation for a first copy. AZOP's enforcement pattern here indicates a regulator prepared to police fee-charging practices around subject access requests specifically within the banking sector, rather than treating access-right compliance as a lower-priority administrative matter.

No Croatia-specific legislative change to the access-right framework itself was located this cycle; the development here is enforcement-pattern rather than statutory. No primary AZOP decision text for either underlying case was directly retrieved, so both cases are understood at Probable confidence rather than Confirmed.

#### Outlook

Watch for whether AZOP extends this access-rights enforcement focus beyond banks to other sectors handling comparable documentation-heavy customer relationships, and for whether a primary AZOP decision publication becomes available to confirm the exact facts and penalty amounts in either reported case.

Sources and claims (6)
- [DataGuidance](https://www.dataguidance.com/news/croatia-azop-fines-eos-matrix-547m-unlawful-processing) — Following the 2023 EOS Matrix breach, AZOP released FAQs guiding affected citizens on exercising GDPR rights, including claiming compensation and accessing their personal data held by EOS Matrix.
- [International Association of Privacy Professionals](https://iapp.org/news/a/croatian-gdpr-implementation-law-main-features-and-unanswered-questions) — State bodies performing official state statistics activities are exempted from enabling data subjects to exercise access, rectification, restriction-of-processing or objection rights where this would threaten or disable performance of statistical activities.
- [EUR-Lex / Publications Office of the EU](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) — No Croatia-specific derogation from the GDPR default one-month (extendable by two further months for complex requests) subject-access response deadline was identified.
- [DataGuidance](https://www.dataguidance.com/news/croatia-azop-fines-eos-matrix-547m-unlawful-processing) — AZOP — FAQs guiding EOS Matrix breach victims on exercising GDPR access/compensation rights
- [International Association of Privacy Professionals](https://iapp.org/news/a/croatian-gdpr-implementation-law-main-features-and-unanswered-questions) — state statistical bodies — enabling restriction/objection rights where compliance would impair statistical functions
- [EUR-Lex / Publications Office of the EU](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) — Croatia — GDPR default one-month (extendable by two months) subject-access response deadline

### Croatia: D4 Controller/Processor Duties7 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Strong, evidenced enforcement record across security, breach-notification, retention and DPO duties; standard GDPR framework for ROPA/joint-controller arrangements.

Primary framework GDPR Articles 24-39 as supplemented by the Implementation Act (NN 42/2018)

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Green Strong, evidenced enforcement record across security, breach-notification, retention and DPO duties; standard GDPR framework for ROPA/joint-controller arrangements.

Periodic update · new data 2026-10-25

#### Controller/Processor Duties

AZOP's finding against an unnamed gambling operator centres on two distinct controller-duty failures. First, the operator collected four fingerprints per casino player for identification purposes without demonstrating that collecting all four was necessary, which speaks directly to data minimisation obligations: a controller processing biometric data for identification purposes is expected to justify the scope of what it collects against what the stated purpose actually requires, and collecting a fuller biometric dataset than a stated identification purpose demands is the kind of gap AZOP's finding appears to target. Second, the operator's consent forms impermissibly bundled multiple processing purposes together, which goes to the separate obligation that consent, where relied upon as a lawful basis, must be specific and granular rather than an omnibus authorisation covering several distinct purposes at once.

The scale of the processing under scrutiny is notable: consent to biometric data processing had been recorded for 34,933 players, indicating this was not a narrow or isolated processing activity but one embedded in the operator's standard customer-identification workflow across a substantial player base. That scale is part of what gives the finding its materiality, since a security-measures or consent-design gap of this kind, replicated across tens of thousands of data subjects, represents a systemic control weakness rather than an isolated lapse.

It should be stated plainly that the precise GDPR article or articles AZOP relied on in reaching this finding is not confirmed. The account available rests on press reporting of AZOP's own public statement about the case, not on the regulator's primary decision document, which has not been retrieved. This means the account here describes the substance of the finding as reported, while flagging that the exact legal basis cited by AZOP, and any further procedural detail the decision document would contain, remains outside the current evidence base.

The case sits within a broader pattern noted elsewhere: AZOP's enforcement attention to biometric-processing design overlaps in subject matter, though not directly in substance, with the European Data Protection Board's own contemporaneous attention to biometric and surveillance-adjacent technologies through its smart-glasses statement. Both reflect a regulatory environment in which biometric processing design, encompassing both the scope of data collected and the structure of consent obtained for it, has become a specific area of scrutiny.

#### Outlook

Retrieval of AZOP's own decision document would materially sharpen understanding of this case, in particular the specific GDPR article or articles cited, the date of the decision itself, and whether it is subject to appeal. Until that document is available, the account of the operator's controller-duty failures rests on secondary characterisation rather than the primary enforcement text.

Periodic update · new data 2026-10-19

#### Controller/Processor Duties

AZOP's fine against a gambling and casino operator, issued 2 October 2026 at EUR 2,590,000, centres on a controller-processor duty failure around biometric data minimisation. The operator had disclosed to data subjects that it would collect two fingerprints for biometric identification purposes but in fact collected four, a discrepancy that AZOP's decision found exceeded what was necessary for the stated identification purpose and was not supported by valid consent. This is a confirmed finding under a decision directly reported by a national outlet and corroborated by a specialist compliance publication.

The same decision identified further controller-duty deficiencies beyond the biometric-collection discrepancy itself. AZOP found that the operator's consent mechanism bundled multiple distinct processing purposes together without giving data subjects a separable choice between them, a structure that is widely understood under GDPR to undermine the specificity requirement for valid consent. The decision further found that the privacy information the operator provided to data subjects was incomplete, inaccurate, and in places contradictory, compounding the consent deficiency with a parallel transparency failure. Together, these findings describe a controller whose data-protection documentation and consent architecture failed on multiple, mutually reinforcing grounds rather than on a single isolated point.

The scale of the fine, at EUR 2.59 million, situates this decision within a broader pattern of AZOP enforcement activity. It follows a EUR 1.5 million fine against a bank in December 2025 for processing mobile-banking users' data without a legal basis, indicating that AZOP is prepared to impose substantial penalties for controller-duty failures across different sectors, not only where biometric data specifically is involved.

#### Outlook

The specific reference number or AZOP's own press release for this decision was not located this cycle, which limits the ability to confirm further procedural detail such as whether the operator has indicated an intention to appeal. Given the pattern of escalating fine amounts evident in AZOP's recent enforcement record, further controller-duty decisions of comparable scale are a plausible continuation of the current trajectory, particularly where biometric or other special-category data processing is involved.

Periodic update · new data 2026-10-13

#### Controller/Processor Duties

AZOP's 2 October 2026 decision against an unnamed gambling operator includes a finding on transparency and accountability, separate from its consent and biometric findings. The decision found that the operator had presented incomplete and internally inconsistent information about the purposes and legal bases for its processing, contrary to the transparency principle and the information duties that controllers owe data subjects about what is being processed and why.

The significance of this finding lies in what internal inconsistency in a controller's own documentation reveals. Where a controller cannot present a coherent account of its own legal bases for different processing activities, that inconsistency is itself treated as an accountability failure, independent of whether any single processing activity considered in isolation might otherwise have had a defensible basis. AZOP's finding here therefore reaches the controller's governance of its own documentation and disclosure practices, rather than only the substance of what was disclosed.

This accountability finding sits alongside the operator's consent and biometric failures as part of the same decision, and reinforces a reading of the case as one where the operator's internal governance of its data-processing programme, not merely a single discrete practice, fell short of GDPR requirements. The combination of an incomplete information architecture with substantive consent and data-minimisation failures suggests a controller whose accountability documentation had not kept pace with the scope of its actual data-processing activity.

#### Outlook

The transparency and accountability finding is likely to be read by other Croatian controllers, particularly those in regulated sectors handling sensitive identity data, as a signal that AZOP will scrutinise the internal consistency of a controller's documented legal bases, not only the user-facing adequacy of its privacy notices. Whether this finding is separately contested on appeal, alongside the consent and biometric findings, remains to be seen.

Periodic update · new data 2026-09-28

#### Controller/Processor Duties

AZOP's 2025 enforcement record is reported to treat organisational governance failures as aggravating factors in penalty calculation rather than as freestanding violations alone. In a EUR 4.5 million fine against a telecom operator, secondary reporting indicates that AZOP counted the controller's disregard of its own data protection officer's explicit warning about excessive data collection, together with a failure to adequately vet a telemarketing processor's security measures, as factors that increased the severity of the eventual penalty. This is reported via VinciWorks' analysis of the case rather than confirmed directly from AZOP's own decision text, so the finding is understood at Probable confidence.

The structural significance, if the reporting holds, is that AZOP's enforcement approach extends beyond assessing whether a breach occurred to assessing whether internal governance mechanisms, specifically DPO independence and processor due-diligence, functioned as GDPR requires. A controller that received and ignored its own DPO's warning is treated more severely than one that had no such warning at all, and a controller that failed to scrutinise a processor's security posture before engaging it is treated as having failed its own Article 28 due-diligence obligation independently of whatever the processor itself did wrong.

No primary AZOP decision document for this case was directly retrieved this cycle; the quantum, the specific aggravating-factor reasoning, and the full facts rest on CMS Law and VinciWorks secondary analysis. This is a material gap for any controller seeking to calibrate governance practice precisely against AZOP's actual enforcement reasoning.

#### Outlook

The question to track is whether AZOP's underlying decision becomes publicly available in full, which would allow confirmation of exactly how DPO-disregard and processor-vetting failures were weighted in the final penalty, and whether this reasoning recurs in subsequent AZOP decisions against other controllers.

D4 · Controller & Processor — Full Module Record 7 sub-modules · 58 words · 19 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Croatia: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Full pass-through of the harmonized EU cross-border transfer regime; no national gaps or derogations found.

Primary framework GDPR Chapter V (Articles 44-49)

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Green Full pass-through of the harmonized EU cross-border transfer regime; no national gaps or derogations found.

D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 40 words · 4 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Croatia: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Telecom and insurance/credit overlays are well evidenced; employment and education sectoral rules rely on unconfirmed GDPR-only baseline.

Primary framework GDPR plus sector overlays: Electronic Communications Act (ePrivacy); Implementation Act genetic/insurance derogation

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Amber Telecom and insurance/credit overlays are well evidenced; employment and education sectoral rules rely on unconfirmed GDPR-only baseline.

Periodic update · new data 2026-10-19

#### Sectoral Watch

Two distinct sectoral developments are in view for Croatia this cycle. The first concerns the education sector, where AZOP initiated an urgent supervisory procedure over CARNET following a data breach involving the personal data of students and teachers, understood to have begun around 15 June 2026. This is a probable, rather than fully confirmed, development, reflecting a notable supervisory response specifically within the education and research-network sector, an area that has not previously generated significant visible AZOP enforcement activity in available reporting.

The second development is adjacent to data protection but sits within the Digital Services Act framework: the European Commission sent Croatia an additional letter of formal notice on 29 April 2026, citing Croatia's continued failure to empower its Digital Services Coordinator and the presence of penalty provisions in national law that do not comply with DSA requirements. This is a confirmed development sourced directly to the Commission's own announcement. While this sits within platform-governance and digital-services regulation rather than core GDPR enforcement, it bears on the institutional capacity of Croatia's wider digital-regulation architecture, within which AZOP itself operates as the data protection component.

Taken together, these two developments illustrate sectoral pressure points distinct from AZOP's financial-sector and biometric-processing enforcement activity: an active supervisory response in education, and an unresolved institutional gap in digital-services governance flagged by the European Commission. Whether Croatia's Digital Services Coordinator has since been formally empowered following the Commission's letter was not established this cycle.

#### Outlook

The CARNET supervisory procedure may produce a further enforcement decision or published outcome in a subsequent cycle, which would clarify both the scope of the breach and AZOP's response to it. On the Digital Services Act front, confirmation of whether Croatia has since empowered its Digital Services Coordinator in response to the Commission's formal notice would resolve an open institutional question, though that question sits principally within platform-governance monitoring rather than within this sectoral-watch assessment itself.

Periodic update · new data 2026-09-28

#### Sectoral Watch

Croatia's financial sector faced continued AZOP scrutiny this cycle. A bank is reported to have been fined EUR 1.5 million for processing personal data belonging to 433,922 users without a valid legal basis, arising from software embedded in the bank's mobile-banking applications. This is reported via a&s Adria Magazine rather than confirmed directly from AZOP's own decision text, placing the finding at Probable confidence, though the scale of both the fine and the affected-user count is specific enough to suggest a substantive underlying case rather than a minor administrative matter.

The legal-basis failure at the centre of this case, embedded software processing personal data absent a valid GDPR Article 6 basis, points to a recurring sectoral risk in financial-services mobile applications: third-party or embedded software components processing customer data in ways the controller bank may not have fully mapped or assessed before deployment. Separately, reporting also references a fine involving the Croatian Insurance Bureau and a sports-betting company, though the facts of that action were not independently detailed in the evidence reaching this cycle beyond its mention.

Taken together, these actions indicate AZOP maintaining active sectoral attention on financial services and gambling-adjacent industries specifically, rather than treating GDPR enforcement as evenly distributed across the economy. No primary AZOP decision text was retrieved for either action this cycle.

#### Outlook

Watch for confirmation of the facts underlying the Croatian Insurance Bureau and sports-betting company fine, and for whether AZOP's mobile-banking-app scrutiny extends to other banks operating comparable embedded third-party software in Croatia.

D6 · Sectoral Watch — Full Module Record 7 sub-modules · 51 words · 9 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Croatia: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Cookie/direct-marketing baseline is confirmed via ePrivacy transposition, but several sub-modules (dark patterns, opt-out signals, clean rooms, cross-context advertising) have no Croatia-specific instrument identified.

Primary framework ePrivacy Directive 2002/58/EC as transposed by the Electronic Communications Act; GDPR consent baseline

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Amber Cookie/direct-marketing baseline is confirmed via ePrivacy transposition, but several sub-modules (dark patterns, opt-out signals, clean rooms, cross-context advertising) have no Croatia-specific instrument identified.

D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 71 words · 2 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Croatia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Biometric and genetic-data rules are well documented; ADM transparency, AI-risk-assessment, and state-surveillance sub-modules rely on thin or GDPR-baseline-only evidence.

Primary framework GDPR Articles 9, 22 as supplemented by the Implementation Act (NN 42/2018)

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Amber Biometric and genetic-data rules are well documented; ADM transparency, AI-risk-assessment, and state-surveillance sub-modules rely on thin or GDPR-baseline-only evidence.

Periodic update · new data 2026-10-25

#### Algorithmic, Biometric & Surveillance Governance

Two developments, one domestic and one at EU level, converge on biometric and surveillance governance in Croatia this reporting period. Domestically, AZOP fined an unnamed gambling operator approximately EUR 2.59 million for unlawfully processing biometric fingerprint data from casino players, a finding that rests specifically on the operator's biometric-identification design: collecting four fingerprints per player without demonstrating the necessity of collecting all four, alongside consent forms that impermissibly bundled multiple processing purposes together. Consent records existed for 34,933 players, underscoring that this was an established, scaled biometric-processing operation rather than a pilot or limited trial.

At EU level, and connected to Croatia through AZOP's own institutional participation, the European Data Protection Board adopted a statement on smart glasses and published a report titled The Connected Gaze at its latest plenary, reported 13 October 2026. AZOP's Deputy Chair, Zdravko Vukić, participated in that plenary. The statement and accompanying report address the surveillance, video-recording and evidence-handling implications that smart-glasses technology raises, a distinct but adjacent biometric-and-surveillance governance concern from the fingerprint-processing case, in that it concerns ambient recording and image capture rather than biometric identifiers collected directly from identified individuals.

The combination of these two developments, a concrete domestic enforcement action against biometric identification practices and direct Croatian institutional participation in an EU-level policy statement on a different but related surveillance technology, signals heightened regulatory attention to biometric and surveillance-adjacent data processing both within Croatia and at the European level during this period. The domestic enforcement action demonstrates that AZOP is prepared to act against established biometric-processing practices that fail to meet necessity and consent-granularity standards, while the EDPB statement demonstrates that the policy conversation around newer biometric-adjacent and surveillance technologies, such as smart glasses, is actively developing at the European level with Croatian regulatory participation.

It is worth noting what is not established by the evidence available: there is no finding connecting the gambling operator's fingerprint-processing practices to the EDPB's smart-glasses statement, and the two developments should be read as parallel signals of regulatory attention to biometric and surveillance technology generally, rather than as connected elements of a single regulatory action.

#### Outlook

Given AZOP's demonstrated willingness to enforce against biometric-processing design failures domestically, and its direct institutional engagement with the EDPB's developing position on smart-glasses surveillance technology, further Croatian regulatory attention to biometric and surveillance-adjacent processing, whether through additional enforcement action or through domestic guidance responsive to the EDPB's EU-level statement, is a plausible direction for this area going forward.

Periodic update · new data 2026-10-19

#### Algorithmic, Biometric & Surveillance Governance

AZOP's EUR 2.59 million fine against a gambling and casino operator is, at its core, a biometric-governance enforcement action: the operator was found to have collected four fingerprints for biometric identification purposes when only two had been disclosed to data subjects, exceeding what AZOP found necessary for the stated purpose and lacking valid consent. This confirmed decision demonstrates that AZOP is prepared to scrutinise the specific technical scope of biometric data collection against what was actually disclosed to data subjects, rather than assessing biometric processing only at the level of general lawfulness.

Running in parallel with this enforcement action, AZOP began implementing the 2026 European Data Protection Board Coordinated Enforcement Framework (CEF 2026), which this year focuses on GDPR Articles 12 to 14 transparency obligations, with a scope explicitly including AI systems and higher-education-institution transparency practices. A questionnaire response under this framework was due 15 July 2026. This is a confirmed, active coordinated-enforcement exercise that extends AZOP's governance attention into algorithmic and AI-system transparency specifically, beyond the biometric-processing enforcement evidenced by the gambling-operator fine.

Together, these two developments indicate that AZOP's attention to algorithmic and biometric governance is proceeding on two fronts simultaneously: a domestic enforcement action targeting excess biometric data collection, and participation in an EU-coordinated exercise examining transparency specifically in relation to AI systems and the higher-education sector. This dual-track activity suggests a supervisory authority engaging both with individual enforcement matters and with structured cross-border coordination exercises on algorithmic governance within the same period.

#### Outlook

The outcome of the 2026 CEF exercise on Articles 12 to 14 transparency, once published by the EDPB or by AZOP itself, would be the most informative next development in this area, potentially revealing findings specific to AI-system transparency practices among Croatian controllers. Separately, whether the biometric-collection enforcement approach evidenced in the gambling-operator decision is applied to other sectors using biometric identification remains an open question for subsequent cycles.

Periodic update · new data 2026-10-13

#### Algorithmic, Biometric & Surveillance Governance

AZOP's 2 October 2026 decision against an unnamed gambling operator establishes an applied precedent on biometric data-minimisation necessity testing in a commercial access-control setting. The operator had collected four fingerprints per player, two from each hand, for identification purposes, despite representing to users that it collected only two. AZOP found that the operator could not demonstrate that the larger scope of biometric collection was necessary for its stated identification purpose, and specifically that a justification resting on needing a backup fingerprint, without further substantiation, does not satisfy the necessity test. The fine attached to this finding, within the EUR 2,590,000 total, affected 34,933 players, giving the decision a scale that extends its relevance well beyond the single operator concerned.

The necessity-testing standard applied here is significant for any Croatian controller using biometric identification for commercial access control, identity verification, or similar purposes. It establishes that the stated purpose for biometric collection constrains the scope of what may be collected, and that scope creep beyond what was represented to users, even where framed as a backup or redundancy measure, requires its own independent necessity justification. A controller cannot rely on operational convenience or system-design preference alone to justify collecting more biometric data points than its disclosed purpose requires.

This is a comparatively underdeveloped area of enforcement precedent in Croatia, and the decision gives AZOP's approach to biometric proportionality a concrete, commercially-grounded reference point. Gambling operators specifically, who commonly deploy biometric identification for age verification and self-exclusion enforcement, are a natural audience for this standard, but the necessity-testing logic articulated is not sector-limited on its face.

#### Outlook

Controllers across sectors using biometric data for identification or access-control purposes in Croatia now have a concrete applied benchmark against which to test their own data-minimisation justifications. Whether AZOP extends this necessity-testing approach to other biometric use cases, such as workplace access control or video surveillance with facial-recognition elements, beyond the gambling-sector context of this decision, is a question this cycle's material does not resolve.

Periodic update · new data 2026-09-28

#### Algorithmic, Biometric & Surveillance Governance

AZOP is reported to have issued guidelines for AI systems involving personal data, emphasising GDPR compliance and risk assessment as the operative framework for controllers deploying AI. The regulator is also reported to have published FAQs addressing legal bases and individual rights specifically in the AI context. Neither the guidelines nor the FAQ document was independently retrieved from a primary AZOP publication this cycle; the finding rests on DataGuidance's aggregator-level summary, which caps confidence at Uncertain rather than Probable or Confirmed.

If the reporting is accurate, this represents Croatia's first documented move toward AI-specific data-protection guidance at the national level, distinct from the general GDPR framework that already applies to any personal-data processing regardless of whether AI is involved. The content of the guidance, specifically what risk-assessment methodology AZOP recommends and how it maps GDPR legal bases onto AI use cases, is not established in the evidence reaching this cycle beyond the general description that it exists and covers these topics.

This is properly read as an emerging rather than settled governance posture. Reports suggest AZOP may have engaged in international coordination on AI and data protection questions, though the specifics of any such coordination were not corroborated by a primary source this cycle and are not asserted here beyond that caveat.

#### Outlook

The priority for the next reporting period is direct retrieval of AZOP's actual AI guidance document and FAQ text, which would allow this module to move from an aggregator-sourced Uncertain finding to a properly sourced Confirmed or Probable assessment of Croatia's AI-specific data-protection posture.

D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 70 words · 11 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Croatia: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾

Age-of-consent rule is clearly documented; parental-consent mechanics, minor-profiling bans, education-settings rules and dependent-adults protections rely on GDPR baseline or incidental enforcement evidence only.

Primary framework GDPR Article 8 as implemented by the Act on the Implementation of the GDPR (NN 42/2018)

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Amber Age-of-consent rule is clearly documented; parental-consent mechanics, minor-profiling bans, education-settings rules and dependent-adults protections rely on GDPR baseline or incidental enforcement evidence only.

D9 · Children's Privacy — Full Module Record 5 sub-modules · 61 words · 6 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

### Croatia: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾

Strong, multi-year enforcement track record and an active 2026 EDPB coordinated activity; redress route is clear via administrative courts, though collective-redress and regulator-capacity sub-modules lack confirmed detail.

Primary framework GDPR Articles 77-84 as supplemented by the Implementation Act (NN 42/2018)

Supervisory authority [AZOP](https://azop.hr/)

Traffic-light rationale — Green Strong, multi-year enforcement track record and an active 2026 EDPB coordinated activity; redress route is clear via administrative courts, though collective-redress and regulator-capacity sub-modules lack confirmed detail.

Periodic update · new data 2026-10-19

#### Enforcement & Redress

AZOP's enforcement record over the past year shows an escalating pattern of substantial financial penalties across different sectors. The most recent confirmed action is the EUR 2,590,000 fine against a gambling and casino operator, issued 2 October 2026, for unlawful biometric fingerprint collection exceeding disclosed scope and lacking valid consent, compounded by a bundled consent mechanism and incomplete, inaccurate, and contradictory privacy information. This fine follows a EUR 1.5 million penalty AZOP imposed on a bank on 18 December 2025 for processing the personal data of 433,922 mobile-banking users without a legal basis. Both decisions are confirmed and together establish a clear and growing trend in the scale of AZOP's enforcement activity against different categories of controller.

Beyond financial-penalty decisions, AZOP's enforcement and redress activity this cycle also includes a probable supervisory procedure opened over a data breach at CARNET affecting students' and teachers' personal data, and participation in the 2026 EDPB Coordinated Enforcement Framework exercise on GDPR transparency obligations, with a questionnaire response due 15 July 2026. These represent two additional, confirmed-to-probable avenues of enforcement and redress-adjacent activity running alongside the headline financial penalties.

The pattern across these developments, read together, is one of an increasingly assertive national supervisory authority willing to impose seven-figure fines on both financial-sector and biometric-data violations, to open urgent supervisory procedures in response to sector-specific breaches, and to participate actively in EU-coordinated enforcement exercises. This is a materially different enforcement posture from one in which fines are occasional or modest in scale.

#### Outlook

Given the escalating trend in fine amounts evidenced across the gambling-operator and bank decisions, further large AZOP enforcement decisions are a plausible continuation of the current trajectory. The CARNET supervisory procedure's eventual outcome, and any published results from the 2026 EDPB Coordinated Enforcement Framework exercise, are both potential sources of further enforcement-and-redress signal in subsequent reporting.

Periodic update · new data 2026-10-13

#### Enforcement & Redress

AZOP's EUR 2,590,000 fine against an unnamed gambling operator, issued 2 October 2026, is among the largest penalties on record for Croatia's data protection authority. Third-party commentary, resting on a single uncorroborated source, states that AZOP issued 32 administrative fines totalling EUR 3.1 million between 2020 and the period before October 2026, with the largest prior single fine being EUR 2.26 million against B2 Kapital. If that figure is accurate, the October 2026 fine against the gambling operator alone approaches or exceeds the combined total of AZOP's enforcement activity across the preceding six years, though this comparison should be treated with appropriate caution given its single-source basis.

The fine was issued under the statutory maximum framework set by GDPR Article 83(4) to (6), under which administrative fines may reach up to EUR 10,000,000 or 2% of total worldwide annual turnover for lower-tier breaches, and up to EUR 20,000,000 or 4% of turnover for higher-tier breaches, a category that includes unlawful special-category processing and consent-principle violations, both of which were found in this decision.

This fine does not stand alone. It follows a December 2025 fine of EUR 1,500,000 against Erste Bank connected to a mobile-banking fraud-detection tool, and a separate February 2026 fine against a Zagreb credit institution for breach of the data subject's right of access under Article 15(3). Read together, these three enforcement actions across roughly a twelve-month span describe AZOP directing escalating attention toward the financial and gambling sectors specifically, sectors whose business models depend on processing sensitive customer-identification and financial data at scale.

Whether the gambling operator's fine will be appealed, and whether AZOP will publicly confirm the operator's identity, both remain open questions as at this writing. The scale of the fine, whichever of the available historical comparisons is used, marks a materially more assertive enforcement posture than AZOP's prior pattern of activity.

#### Outlook

The near-term question is less whether this fine stands as an outlier and more whether it marks a sustained new enforcement baseline for AZOP, particularly toward the financial and gambling sectors following the Erste Bank and Zagreb credit institution actions earlier in the same twelve-month window. An appeal, if filed, would test the necessity-testing and consent-bundling reasoning underlying the decision, with consequences for how firmly other Croatian controllers can rely on the precedent this decision sets.

Periodic update · new data 2026-09-28

#### Enforcement & Redress

AZOP confirmed directly, via its own website, that it imposed an administrative fine of EUR 100,000 on a real estate agency on 19 February 2026 for processing contrary to GDPR provisions. This is the single most directly evidenced enforcement action reaching this cycle, sourced from AZOP's own publication rather than secondary reporting, and it sits within a considerably larger reported enforcement pattern: AZOP is understood to have imposed nearly EUR 7 million in fines during 2025 as a whole, following what is described as a record EUR 10.5 million across 97 decisions in 2024. Both aggregate figures rest on a T4 aggregator source rather than an AZOP-published enforcement report, so they are treated as Uncertain rather than Confirmed, even though the February 2026 individual fine is itself Confirmed.

Beyond the aggregate volume, AZOP is reported to have launched a 2026 coordinated enforcement action alongside the European Data Protection Board focused on transparency, and to have opened a supervisory procedure over CARNET following a data breach affecting students and teachers. Neither the outcome of the EDPB-coordinated action nor the resolution of the CARNET procedure is established in the evidence reaching this cycle; both are open, active matters rather than concluded enforcement outcomes.

Taken as a whole, the picture is of a data-protection authority maintaining a high enforcement tempo across multiple concurrent tracks, sectoral fines, individual enforcement decisions, and participation in EU-wide coordinated actions, though the precision of the aggregate figures depends on AZOP publishing its own annual enforcement report, which was not directly retrieved this cycle.

#### Outlook

The outcome of the CARNET supervisory procedure and the EDPB coordinated transparency action are the two concrete developments to track into the next reporting period; either reaching a public resolution would convert an open enforcement track into a documented outcome.

D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 99 words · 21 traced claims · Re-verified 2026-10-25

The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) .

[Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/)

## GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (21 mapped).

Show article map GDPR article to category mapping Article Category Sub-module

Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases

Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds

Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) parental consent

Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories

Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right

Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability

Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection

Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency

Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements

Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements

Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia

Art. 13-14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows

Art. 16-17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure

Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures

Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements

Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms

Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties