Croatia Recording Laws: All-Party Consent, GDPR & Penalties (2026)

Croatia is an all-party consent jurisdiction: recording privately spoken words without consent is a criminal offense under Article 143 of the Kazneni zakon (Criminal Code, NN 125/11), punishable by up to three years in prison. GDPR enforcement through AZOP adds administrative fines on top of any criminal exposure.

Overview of Croatia Recording Laws

Croatia requires all-party consent before recording any private conversation. Under Article 143 of the Kazneni zakon (Criminal Code, Official Gazette NN 125/11, as amended through NN 144/12, 56/15, 61/15, 101/17, 118/18, 126/19, 84/21, 114/22), recording privately spoken words of another person without consent is a criminal offense punishable by up to three years of imprisonment. Croatia is not a jurisdiction where being a participant in a conversation gives you the right to record it.

Jurisdiction scope: This article addresses recording laws in Croatia, covering the Kazneni zakon (Criminal Code), the Constitution of the Republic of Croatia, the Act on Implementation of the GDPR (NN 42/2018), the Electronic Communications Act (NN 76/22), the Cybersecurity Act (NN 14/24), the Criminal Procedure Act, and EU Regulation 2016/679 (GDPR). It does not address other EU member states individually; for a broader comparison, see EU recording laws.

The legal framework operates at four layers: constitutional privacy rights (Articles 35, 36, 37 of the Constitution), criminal law penalties (Criminal Code Articles 143, 144, and 144a), data protection obligations under the GDPR and its Croatian implementing act, and the EU AI Act overlay that became partly applicable in 2025. AZOP, the national data protection authority, is an active enforcer that imposed nearly EUR 7 million in total administrative fines across Croatian organizations in 2025 alone.

For visitors, residents, and businesses operating in Croatia, understanding this layered framework is essential. A single unauthorized recording can simultaneously trigger criminal prosecution, GDPR administrative fines, and civil damages claims.

Constitutional Foundation for Privacy

The Croatian Constitution establishes the fundamental right to privacy of communications through three interlocking articles that courts use as the interpretive foundation for all recording restrictions.

Article 35 guarantees all citizens respect for and legal protection of personal and family life, dignity, reputation, and honor. This broad privacy protection serves as the constitutional basis for recording restrictions across the Criminal Code and data protection statutes.

Article 36 is the most directly relevant provision. It states that the freedom and secrecy of correspondence and all other forms of communication are guaranteed and inviolable. Only restrictions necessary for the protection of national security or the conduct of criminal proceedings may be prescribed, and only by law.

Article 37 further guarantees the safety and secrecy of personal data. Without the consent of the person concerned, personal data may only be collected, processed, and used under conditions specified by law. The use of personal data contrary to the purpose of their collection is expressly prohibited.

These three constitutional articles create a strong baseline protection that the Criminal Code and data protection laws build upon. Croatian courts apply proportionality analysis when evaluating whether a recording violated these rights, weighing the privacy interest against any competing interest such as public accountability or safety.

Criminal Code Article 143: Unauthorized Audio Recording and Eavesdropping

Article 143 of the Kazneni zakon (Neovlasteno zvucno snimanje i prisluskivanje) is the primary criminal statute governing unauthorized audio recording in Croatia. It sits in Chapter XIV of the Criminal Code, covering criminal offenses against privacy.

Paragraph 1: Basic Offense

Anyone who unlawfully makes an audio recording of words spoken in private by another person, or who unlawfully eavesdrops on words spoken in private by another person using special devices not intended for them, faces imprisonment of up to three years.

The key elements of this offense are:

• The words must be privately spoken (nejavno izgovorene rijeci). Public statements, speeches at public events, or statements made in a public forum are not protected.
• The recording or eavesdropping must be unauthorized (neovlasteno). This means it was done without the consent of the person whose words were recorded.
• For eavesdropping specifically, the perpetrator must use special devices (posebne naprave) to intercept words not intended for them.

This paragraph criminalizes both the act of recording and the act of listening in. Simply using a device to monitor a conversation you are not a party to is sufficient to commit this offense, even without creating a permanent file.

Paragraph 2: Dissemination of Recordings

The same penalty of up to three years applies to anyone who uses unauthorized recordings, makes them available to a third party, or publicly states the eavesdropped words verbatim or in their essential features.

Even if you did not make the original recording, you can face criminal liability for:

• Playing a recording for someone else
• Sharing a recording file through any medium, including messaging apps
• Publishing the content of an eavesdropped conversation
• Repeating the substance of what was overheard to others

Paragraph 3: Official Misconduct Enhancement

If a public official (sluzbenica osoba) commits the offense in the course of performing official duties or exercising public authority, the penalty increases to imprisonment from six months to five years.

This enhanced penalty targets government employees, police officers, and other officials who abuse their positions to conduct unauthorized surveillance. The minimum six-month sentence reflects the heightened trust placed in public officials and the greater harm caused when that trust is violated.

Paragraph 4: Public Interest Defense

There is no criminal offense if the actions were undertaken in the public interest or in another interest that is predominant over the privacy interest of the recorded person.

Croatian courts interpret this defense narrowly. The court must weigh the specific public interest served by the recording against the privacy rights of the person recorded. Situations where this defense has been recognized include documenting serious criminal activity, gathering evidence of corruption by public officials, and protecting against imminent threats to safety. The burden of proof falls on the person who made the recording.

Article 144: Unauthorized Visual Recording

Article 144 (Neovlasteno slikovno snimanje) addresses unauthorized visual recording, including photography and video. Unauthorized visual recording of a person in their private space or private life carries imprisonment of up to one year for the basic offense. If the images are shared with third parties or made public, the penalty increases to up to three years.

As with audio recording, the offense requires that the recording be unauthorized and that the subject had a reasonable expectation of privacy. Photographing or filming someone in a public place engaged in public activities generally does not fall under this provision.

Voyeurism and Non-Consensual Intimate Imagery

Croatia's Criminal Code addresses two distinct categories of visual privacy offenses that go beyond the basic Article 144 prohibition.

Article 144a: Non-Consensual Sharing of Intimate Recordings

Article 144a was added to the Criminal Code to address the distribution of intimate recordings without consent (non-consensual intimate images, sometimes called revenge porn). The provision covers anyone who, abusing a relationship of trust and without the consent of the filmed person, makes available to a third party a recording of sexually explicit content that was originally taken with the subject's consent for personal use, thereby violating that person's privacy. The penalty is imprisonment of up to one year.

This offense is prosecuted only upon the victim's complaint (privatno kaznena prijava), meaning the criminal process will not begin without the victim's active initiative. The key elements distinguishing Article 144a from the basic Article 144 offense are: (1) the original recording was consensual; (2) the perpetrator abused a position of trust; and (3) the distribution occurred without consent.

Article 144a does not cover situations where the underlying recording was itself non-consensual. If someone secretly films intimate content without consent, that act falls under Article 144 (unauthorized visual recording in private settings). Article 144a addresses the distinct harm of weaponizing previously consensual content.

Intersection with GDPR

Distribution of intimate imagery also constitutes processing of sensitive personal data under GDPR, which means the distributor faces both criminal liability under Article 144a and potential GDPR administrative sanctions. AZOP can impose fines independently of any criminal proceeding.

Phone Call Recording Laws

Recording telephone conversations in Croatia follows the same all-party consent framework as Article 143. Phone calls are considered private communications, and all parties must consent to the recording.

If you participate in a phone call and record it without informing the other person, you are committing a criminal offense under Croatian law. This applies whether the call is made from a landline, a mobile phone, or through a Voice over Internet Protocol (VoIP) service.

The Electronic Communications Act (Zakon o elektronickim komunikacijama, NN 76/22) entered into force on 12 July 2022, replacing the prior 2008 Act. It implements the European Electronic Communications Code (Directive 2018/1972) and expressly governs the confidentiality of electronic communications. Unauthorized interception is prohibited under the Act; fines for breach of confidentiality provisions reach up to EUR 132,720.

For businesses that record customer calls, the GDPR adds further requirements beyond criminal law consent. Under GDPR Article 6(1), the business must identify a valid legal basis for processing the personal data contained in the call recording. AZOP has specifically enforced this requirement, most visibly in its September 2024 decision imposing EUR 190,000 on a hospital for recording call center conversations without a valid legal basis and without informing callers.

In-Person Conversation Recording

Recording face-to-face conversations in Croatia carries the same legal requirements as recording phone calls. All participants must consent to the recording for it to be lawful.

The concept of "privately spoken words" (nejavno izgovorene rijeci) is central to when Article 143 applies. Words are considered privately spoken when they are directed to a specific person or group in circumstances where the speaker has a reasonable expectation that only the intended audience will hear them.

Examples of privately spoken words include:

• A conversation between two people in a private office
• A discussion at a dinner table among friends
• A consultation between a client and a professional
• A meeting in a conference room, even if the door is unlocked

Conversations in the following contexts are generally not considered "privately spoken":

• Public speeches or presentations
• Statements made at public meetings or government proceedings
• Comments made in a public space where anyone can hear without effort

The distinction matters because Article 143 applies only to privately spoken words. Recording a politician's speech at a public rally does not trigger criminal liability under this article. However, approaching that politician afterward for a private conversation and recording it without consent would.

Workplace Recording and Surveillance

Croatia regulates workplace recording through the intersection of criminal law, the Labour Act (Zakon o radu, NN 93/14 and subsequent amendments), and data protection law. Employers face specific obligations when implementing any form of workplace monitoring.

Video Surveillance

The Act on Implementation of the GDPR (Zakon o provedbi Opce uredbe o zastiti podataka, NN 42/18) contains specific provisions for workplace video surveillance. Employers may install video surveillance cameras only if:

• The surveillance complies with the Law on Occupational Health and Safety
• Employees have been informed in advance about the surveillance
• A written notice was provided to employees before the decision to install the system
• The surveillance does not cover premises intended for resting, personal hygiene, or changing clothes

Works Council Requirements

Under the Labour Act, employers who wish to monitor employees must obtain the approval of their works council (radnicko vijece). If the works council or trade union representative does not consent, the employer can seek a decision from an arbitration tribunal. Employers must give written notice about surveillance practices to workers at the time of hiring.

In April 2024, AZOP imposed fines of EUR 500 to EUR 4,000 on seven controllers that failed to clearly notify data subjects of video surveillance. This enforcement series illustrates that even technically lawful surveillance programs can draw administrative penalties when notice requirements are not met.

Audio Recording Restrictions

Audio recording in the workplace is subject to the same criminal law restrictions as any other private recording. An employer who records employee conversations without consent faces prosecution under Article 143. The workplace does not create an exception to the all-party consent requirement.

AZOP enforced this principle in its September 2024 decision imposing EUR 190,000 on a Rijeka-area hospital for recording telephone conversations through its call center without demonstrating a valid legal basis (GDPR Arts. 6(1) and 5(2)), failing to inform callers about the recording (GDPR Arts. 12(1) and 13), not defining retention periods (GDPR Art. 5(1)(e)), and not involving the Data Protection Officer in the matter (GDPR Art. 38(1)).

Data Security for Recordings

Employers who conduct any authorized recording or surveillance must prevent unauthorized access to recordings and are prohibited from broadcasting footage. They are required to allow access to authorized inspectors and regulatory authorities upon request.

GDPR and Data Protection Framework

As an EU member state, Croatia is subject to the General Data Protection Regulation (GDPR, Regulation 2016/679), which adds a comprehensive data protection layer on top of criminal law.

AZOP: The Supervisory Authority

The Croatian Personal Data Protection Agency (Agencija za zastitu osobnih podataka, AZOP) is the national supervisory authority responsible for GDPR enforcement in Croatia. AZOP investigates complaints, conducts audits, and imposes administrative fines.

AZOP demonstrated sharply increasing enforcement intensity in 2025. The agency imposed twelve administrative fines totaling EUR 900,500 (excluding the EUR 4.5M telecom decision), with the overall enforcement year reaching nearly EUR 7 million across telecoms, banking, insurance, energy production, and sports betting. The largest single fine in 2025 was EUR 4.5 million imposed on a telecommunications operator for transferring personal data to third countries without a valid transfer instrument, lack of transparency to data subjects, processing employee identity cards and criminal records without legal basis, and failure to carry out appropriate prior checks of a processor.

A bank was separately fined EUR 1.5 million for processing personal data of 433,922 users without a legal basis.

Recording as Data Processing

Any recording of an identifiable person constitutes processing of personal data under the GDPR. This means that even where criminal law consent has been obtained, the recorder must also comply with GDPR requirements:

• Legal basis (Article 6): A valid legal basis must exist, such as consent, legitimate interest, or legal obligation.
• Transparency (Articles 12-13): Data subjects must be informed about the recording, its purpose, the legal basis, retention period, and their rights.
• Purpose limitation (Article 5(1)(b)): Recordings may only be used for the specific stated purpose.
• Storage limitation (Article 5(1)(e)): Recordings must not be kept longer than necessary.
• Security (Article 32): Appropriate technical and organizational measures must protect recorded data.

GDPR Fines

GDPR violations related to recording can result in administrative fines of up to EUR 20 million or 4% of annual global turnover, whichever is higher. AZOP's 2025 record demonstrates that these are not theoretical maximums.

Deepfake and AI-Generated Content

The EU AI Act (Regulation (EU) 2024/1689), which entered into force on 1 August 2024, introduces new obligations directly relevant to AI-generated or AI-manipulated recordings.

Prohibited Practices (in force from 2 February 2025)

Article 5 of the AI Act prohibits certain AI applications outright in all EU member states including Croatia. Prohibited practices relevant to recording include:

• Real-time remote biometric identification in publicly accessible spaces by law enforcement authorities, with narrow exceptions for serious crimes and missing persons (subject to further transition under biometric-specific provisions extended to August 2027).
• Untargeted scraping of facial images from the internet or CCTV footage to create or expand facial recognition databases.

Transparency for Synthetic Content (in force from 2 August 2026)

Article 50 of the AI Act requires that any AI system generating or substantially manipulating audio or video content must disclose that the output is AI-generated. Specifically:

• Providers of AI systems that generate deepfake video or synthetic audio must ensure the content is clearly marked as artificially generated or manipulated.
• This disclosure requirement applies to any content that a reasonable person could mistake for authentic recordings of real persons.
• Penalties for violating prohibited practices reach EUR 35 million or 7% of global annual turnover.

The high-risk AI system rules (which cover many biometric surveillance systems) arrive on 2 December 2027 for the Annex III use cases, and on 2 August 2028 for AI built into regulated products under Annex I. Those dates were 2 August 2026 and 2 August 2027 until Regulation (EU) 2026/1744, the July 2026 Digital Omnibus on AI, moved them.

Domestic Criminal Law Interaction

The EU AI Act does not supersede Croatian criminal law. An AI-generated recording designed to falsely depict a person saying something they never said could simultaneously violate: Article 144 (unauthorized visual/audio reproduction in private settings), defamation provisions of the Criminal Code, and AI Act Article 50. The most protective layer applies.

Practical Implications for Businesses in Croatia

Any Croatian or foreign business using AI tools to generate synthetic audio or video content depicting Croatian residents must implement disclosure mechanisms compliant with Article 50. Tools that generate meeting summaries, voice clones, or video avatars fall within the scope of these obligations when the output could be mistaken for a real recording.

Recording Police and Public Officials

Recording police officers and other public officials performing their duties in Croatia does not benefit from a specific statutory permission. No Croatian law expressly authorizes or prohibits citizens from recording officers during the exercise of their public functions.

The public interest defense in Article 143(4) of the Criminal Code provides the most relevant legal hook for such recordings. A citizen recording a police officer's use of force, for example, could argue that the public interest in accountability outweighs the officer's privacy interest in their conduct while performing official duties. Croatian courts have not established a definitive body of case law on this precise scenario.

Several principles from existing law apply:

• Police officers exercising public powers in public have a reduced expectation of privacy in their official conduct under the proportionality principle derived from Arts. 35-37 of the Constitution.
• Words spoken by an officer in a purely public context (public address, announcements) are not "privately spoken" within the meaning of Article 143 and do not attract criminal protection.
• Words spoken by an officer in what they reasonably believe to be a private communication (e.g., speaking quietly to a colleague) retain the Article 143 protection.
• A recording made purely to harass or intimidate an officer without any genuine accountability purpose would not qualify for the Article 143(4) defense.

The ECHR case Vuckovic v. Croatia (Application No. 58521/18, judgment 2022) concerned media freedom and official conduct, providing relevant European Convention context. Anyone relying on the public interest defense should document the accountability purpose of the recording before relying on it as a defense.

The safest practical approach: in any situation involving police, be transparent that you are recording, state that you are doing so in the public interest, and stop recording if ordered to do so by a court order or lawful directive (not merely a preference of the officer).

Law Enforcement and Lawful Interception

Croatian law provides a framework for lawful interception of communications by law enforcement, but only under strict judicial oversight governed by the Criminal Procedure Act (Zakon o kaznenom postupku).

Under Article 332 of the Criminal Procedure Act, special evidentiary actions, including interception of communications, may be authorized for serious criminal offenses carrying a prison sentence of five or more years.

Key requirements include:

• Judicial authorization: A judge must approve the interception in advance.
• Prosecutorial request: The interception must be requested by the State Attorney (Drzavno odvjetnistvo) and conducted in accordance with instructions from both the State Attorney and the courts.
• Proportionality: The surveillance must be proportionate to the seriousness of the crime under investigation.
• Time limits: Authorization is granted for a specific period and must be renewed if the investigation requires continued surveillance.

The Croatian Supreme Court (VSRH) addressed the admissibility of judicially authorized interceptions in its ruling of 9 December 2016 in the Agram corruption case involving former Zagreb Mayor Milan Bandic. The Court ruled that secretly recorded telephone calls and text messages were legally admissible, reversing a Zagreb County Court decision that had deemed the evidence illegally obtained, because proper judicial authorization had been obtained by USKOK (the Office for Suppression of Corruption and Organized Crime). This ruling confirms that judicially authorized interceptions comply with Article 36 of the Constitution even when the subject was not aware of the surveillance at the time.

Civil Liability and Damages

Unauthorized recording in Croatia creates civil liability alongside any criminal exposure.

Under GDPR Article 82, any person who suffers material or non-material damage as a result of a GDPR violation has the right to receive compensation from the controller or processor responsible. Croatian courts have not yet issued judicial guidelines establishing quantum ranges for GDPR-related damages. No minimum threshold of seriousness applies before compensation becomes available; even non-material harm, such as distress caused by discovering that a private conversation was recorded, can ground a claim.

Beyond GDPR, the general civil law framework under the Zakon o obveznim odnosima (Law on Obligations) provides a basis for claiming non-material damages for violations of personality rights including privacy. A claimant who proves unauthorized recording damaged their reputation, caused emotional distress, or exposed private information can seek compensation under this framework independently of the GDPR route.

Criminal proceedings and civil damages claims can run in parallel. A person convicted of an Article 143 offense may simultaneously face a civil damages claim by the victim. The victim may also join the civil claim to the criminal proceeding as a party through the Croatian system of adjunctive claims (imovinskopravni zahtjev u kaznenom postupku), which avoids the need to file a separate civil suit.

Penalties Summary

Croatia imposes the following penalties for unauthorized recording:

These penalties can apply concurrently. A person who secretly records a private conversation and then shares it publicly could face criminal prosecution under Article 143, an administrative fine from AZOP under the GDPR, and a civil damages claim from the recorded person.

Business Compliance for Recording in Croatia

Businesses operating in Croatia that record communications or conduct surveillance must establish comprehensive compliance frameworks spanning criminal law, GDPR, and sectoral regulation.

Call Recording

Businesses that record customer or employee phone calls must:

• Identify a valid legal basis under GDPR Article 6(1) before beginning any recording
• Inform callers clearly and prominently at the start of the call that the conversation is being recorded
• State the purpose of the recording (quality assurance, compliance, training, dispute resolution)
• Define and document a retention period for all recordings
• Involve the Data Protection Officer in decisions about recording practices
• Provide a privacy notice covering all required GDPR Article 13 information
• Implement appropriate security measures to protect recorded data

AZOP has specifically targeted call recording violations, making this a high-priority compliance area.

Video Surveillance for Businesses

Businesses using CCTV or other video surveillance must:

• Display visible signage informing visitors and employees that surveillance is in operation
• Document a purpose for the surveillance (security, safety, asset protection)
• Restrict camera placement to avoid private areas
• Define a retention period, typically no longer than necessary for the stated purpose
• Implement access controls to prevent unauthorized viewing of footage

Cybersecurity Act Obligations for Essential Entities

For telecommunications providers, energy operators, and other entities classified as essential or important under the Cybersecurity Act (NN 14/24), additional obligations apply to the security of communications infrastructure. Essential entities must implement security measures defined in the Cybersecurity Regulation and are subject to supervision by the National Cyber Security Centre (NCSC).

Cross-Border and Eurozone Considerations

Croatian recording laws apply to any recording activity that takes place on Croatian territory or involves data subjects located in Croatia. Croatia joined the Eurozone on 1 January 2023. Financial services firms subject to MiFID II and MiFIR call recording obligations must comply both with those EU-level requirements and with Croatian criminal law consent requirements when recording calls with Croatian clients.

Cross-Border Recording Rules

Recording activities that span borders require analysis at multiple levels.

For tourists and short-term visitors to Croatia, Croatian criminal law applies to recordings made on Croatian territory regardless of the visitor's nationality or residence. A German or American tourist who records a private conversation in Dubrovnik without the other party's consent is subject to Articles 143 and 144 of the Croatian Criminal Code.

For businesses, GDPR's territorial scope extends to any processing of personal data of individuals who are in Croatia, regardless of where the business is established. A US company conducting remote interviews with Croatian applicants and recording those interviews without adequate disclosure is subject to GDPR enforcement by AZOP.

For cross-border calls where one party is in Croatia and the other is abroad, Croatian law applies to the Croatian participant's obligations. The foreign participant's obligations are governed by their own jurisdiction's law. Both sets of rules can apply simultaneously; the more restrictive rule governs the Croatian party's conduct.

The ePrivacy Directive (2002/58/EC), implemented in Croatia through the Electronic Communications Act, applies to confidentiality of electronic communications within the EU regardless of where the communicating parties are physically located, as long as the communications pass through EU networks.

Comparison With Other European Countries

Croatia's all-party consent framework is stricter than many European countries but is not unique within the EU.

Countries like Germany (Section 201 of the Strafgesetzbuch) and Switzerland also require all-party consent for recording private conversations. In contrast, Italy applies a "participation in the dialogue" principle that allows a conversation participant to record without informing the others.

Croatia's criminal penalties are broadly in line with other EU member states. The maximum three-year sentence for basic unauthorized recording is comparable to Germany and Austria. The enhanced penalty for public officials (up to five years) reflects Croatia's emphasis on preventing abuse of official power.

The GDPR creates a uniform baseline for administrative enforcement across all EU member states. Under the GDPR's one-stop-shop mechanism, companies whose main EU establishment is in another member state may be primarily supervised by that state's DPA, but AZOP retains jurisdiction over local Croatian data subjects and can act independently in urgent cases.

Practical Tips for Recording in Croatia

• Obtain consent from all parties before recording. Croatia is an all-party consent jurisdiction. Recording any private conversation without the knowledge and agreement of everyone involved is a criminal offense under Article 143.
• Put consent in writing when possible. For business recordings, written consent or a clearly recorded verbal acknowledgment at the start of a call provides the strongest legal protection.
• Update your ECA compliance. The old 2008 Electronic Communications Act was replaced by NN 76/22 in July 2022. If your compliance documentation still references the 2008 Act, update it.
• The public interest defense is narrow. Do not rely on Article 143(4) unless the circumstances clearly involve serious misconduct or imminent danger, and document your purpose before recording.
• Businesses must go beyond consent. Even with consent, GDPR requires a documented legal basis, a privacy notice, defined retention periods, and appropriate security measures.
• Disclose AI-generated content. From 2 August 2026, EU AI Act Article 50 requires disclosure when audio or video content is AI-generated or substantially manipulated. Systems already on the market before that date have until 2 December 2026 to add the machine-readable marking. Failure to disclose carries penalties up to EUR 35 million or 7% of global turnover.
• Never record in private areas of a workplace. Rest rooms, changing areas, and hygiene facilities are strictly off-limits for any form of surveillance.
• Consult a Croatian lawyer for complex situations. The interplay between criminal law, GDPR, the Labour Act, and the AI Act creates nuanced requirements that may require professional legal advice.
• Keep recordings secure. Any recording containing personal data must be protected against unauthorized access, loss, or disclosure under GDPR Article 32.

Conclusion

Croatia maintains one of Europe's stricter recording consent frameworks, requiring all-party consent for any recording of private conversations. The Criminal Code backs this requirement with meaningful criminal penalties: up to three years of imprisonment for basic offenses and up to five years when a public official is involved. The 2023 addition of Article 144a extended criminal liability to the non-consensual distribution of intimate recordings, addressing a gap that other European jurisdictions have also moved to close in recent years.

The GDPR adds a parallel enforcement layer through AZOP. The agency's 2025 enforcement activity, which reached nearly EUR 7 million in total administrative fines including a single EUR 4.5M record against a telecommunications operator, demonstrates that AZOP is one of the more active data protection authorities in Central and Eastern Europe. The EU AI Act adds a third layer, with deepfake disclosure obligations effective from 2 August 2026 and the high-risk AI rules arriving on 2 December 2027 for Annex III use cases and 2 August 2028 for AI in regulated products.

For individuals, the message is clear: never record a private conversation in Croatia without the consent of everyone involved. For businesses, compliance requires building comprehensive frameworks that satisfy criminal law, GDPR, and sectoral requirements simultaneously. Enforcement activity by both prosecutors and AZOP continues to increase, and the addition of AI Act obligations means the compliance landscape will continue to evolve through 2028, when the last block of high-risk rules takes effect.