Content type · 52 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Country: Croatia (50) Clear filter
Filter by Topic Supervisory Authorities3518 Processing Agreement2798 Processing2594 Personal Data2548 Controllers2165 Data Controller1854 Law Enforcement1541 IP Address1278 Security1007 Supervision854 Monitoring523 Consent498
azop · €20,000 Telecommunicatiebedrijf: Onvoldoende juridische basis voor gegevensverwerking. De Kroatische gegevensbeschermingsautoriteit (DPA) heeft een telecombedrijf een boete van 20.000 euro opgelegd. Een betrokkene had een klacht ingediend bij de DPA, waarin hij… Accuracy Processing Personal Data NL Dec 30, 2025
azop · €20,000 Telecommunications company: Insufficient legal basis for data processing The Croatian DPA (azop) has imposed a fine of EUR 20,000 on a telecommunications company. A data subject had filed a complaint with the DPA claiming that the company was still… Accuracy Personal Data Telecommunications Dec 30, 2025
azop · €1,500,000 Bank: Non-compliance with general data processing principles Croatian Data Protection Authority (azop) fined Bank €1,500,000 on 2025-12-18 for: Non-compliance with general data processing principles. IP Address Human Resources Processing Dec 18, 2025
azop · €4,500,000 Telecommunicatiebedrijf (exploitant van elektronische communicatienetwerken en -diensten): Overtreding van de algemene principes van gegevensverwerking. Een boete van 4.500.000 euro - opgelegd door de Kroatische Autoriteit voor Gegevensbescherming (AZOP). Whistleblower Protection Processors Data Processor NL Nov 24, 2025
azop · €4,500,000 Telecommunications operator (operator of electronic communications networks and services): Non-compliance with general data processing principles Following an ex officio investigation, AZOP imposed a EUR 4.5 million fine on a telecommunications operator for multiple GDPR infringements. The controller transferred customer… Processors Processing Agreement Controllers Nov 24, 2025
azop · €2,000 Primary School: Insufficient legal basis for data processing Croatian Data Protection Authority (azop) fined Primary School €2,000 on 2025-09-01 for: Insufficient legal basis for data processing. Education Public Authority Human Resources Sep 1, 2025
azop · €50,000 Information and Communication Company: Insufficient technical and organisational measures to ensure information security Croatian Data Protection Authority (azop) fined Information and Communication Company €50,000 on 2025-07-22 for: Insufficient technical and organisational measures to ensure… Security Human Resources Supervisory Authorities Jul 22, 2025
azop · €320,000 HEP-Toplinarstvo: Insufficient technical and organisational measures to ensure information security Croatian Data Protection Authority (azop) fined HEP-Toplinarstvo €320,000 on 2025-07-22 for: Insufficient technical and organisational measures to ensure information security. Security Human Resources Supervisory Authorities Jul 22, 2025
azop · €101,000 Croatian Insurance Bureau: Insufficient technical and organisational measures to ensure information security Croatian Data Protection Authority (azop) fined Croatian Insurance Bureau €101,000 on 2025-07-02 for: Insufficient technical and organisational measures to ensure information… Security Public Sector Education Jul 2, 2025
azop · €175,000 FAVORIT SPORTSKA KLADIONICA d.o.o.: Insufficient technical and organisational measures to ensure information security Croatian Data Protection Authority (azop) fined FAVORIT SPORTSKA KLADIONICA d.o.o. €175,000 on 2025-07-02 for: Insufficient technical and organisational measures to ensure… Security Human Resources Supervisory Authorities Jul 2, 2025
azop · €10,000 Oil and fat manufacturer: Lack of appointment of data protection officer The Croatian DPA (AZOP) has imposed a fine of EUR 10,000 on an oil and fat manufacturer for for failing to appoint and designate a data protection officer. Supervisory Authorities Processing Agreement Mar 24, 2025
azop · €40,000 Bedrijf: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 40.000 euro - opgelegd door de Kroatische Autoriteit voor Gegevensbescherming (AZOP). Notified Body Responsibilities and Operational Obligations Processing Personal Data NL Mar 24, 2025
azop · €4,000 Ziekenhuis: Niet-naleving van de algemene principes voor gegevensverwerking. 4.000 euro boete - Kroatische Autoriteit voor Gegevensbescherming (AZOP). Health Data Healthcare Personal Data NL Mar 24, 2025
azop · €3,000 Hospital: Insufficient technical and organisational measures to ensure information security The Croation DPA (AZOP) has imposed a fine of EUR 3,000 on a hospital. Despite the extensive and high-risk processing of health data, the hospital had not implemented sufficient… Healthcare Integrity and Confidentiality Principle Health Data Mar 24, 2025
azop · €40,000 Company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 40,000 on a company that published personal data of sole traders on its website. The data originated from public sources and from… Notified Body Responsibilities and Operational Obligations Processing Agreement Processing Mar 24, 2025
azop · €80,000 Company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 80,000 on a company. The company was responsible for monitoring parking lots at several supermarkets and a hospital. However, it… Audit Logs Processing Agreement Monitoring Mar 24, 2025
azop · €12,000 Casino: Lack of appointment of data protection officer The Croatian DPA (AZOP) has imposed a fine of EUR 12,000 on a casino for for failing to appoint and designate a data protection officer. Supervisory Authorities Processing Agreement Mar 24, 2025
azop · €4,000 Hospital: Non-compliance with general data processing principles The Croation DPA (AZOP) has imposed a fine of EUR 4,000 on a hospital. The AZOP found that the hospital used a company which automatically retrieved personal data of vehicle… Fines Healthcare Personal Data Mar 24, 2025
azop · €20,000 Hospital: Insufficient technical and organisational measures to ensure information security The Croatian DPA (AZOP) imposed a fine of EUR 20,000 on a hospital for failing to implement adequate technical and organizational measures to protect personal data in line with… Data Breaches Security Healthcare Mar 24, 2025
azop · €45,000 Hotel: €45,000 fine The Croatian DPA (AZOP) has imposed a fine of EUR 45,000 on two hotels for unlawfully processing personal data through the use of cookies. Cookies Personal Data Human Resources Sep 13, 2024
azop · €35,700 Company: €35,700 fine The Croatian DPA (AZOP) has imposed fines totaling EUR 35,700 on nine companies for failing to adequately indicate their video surveillance areas and for failing to provide all… Video Surveillance Fines Monitoring Sep 13, 2024
azop · €190,000 Hospital: Insufficient technical and organisational measures to ensure information security The Croatian DPA (AZOP) has imposed a fine of EUR 190,000 on a hospital. The hospital had suffered a data breach in which radiological image files were irrevocably lost. AZOP had… Data Breaches Healthcare Processing Agreement Sep 13, 2024
azop · €20,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 20,000 on a data controller operating in the gambling and betting sector. The data controller collected and processed personal… Fairness & Transparency Cookies Direct Marketing Apr 22, 2024
azop CROATIA DPA: Insufficient fulfilment of information obligations The Croatian DPA (AZOP) has imposed seven fines totaling EUR 16,000 on data controllers for failing to adequately mark video-monitored areas. This lack of marking resulted in… Video Surveillance Fines Controllers Apr 22, 2024
azop · €15,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 15,000 on a data controller operating in the gambling and betting sector. The data controller collected and processed personal… Cookies Fairness & Transparency Direct Marketing Apr 22, 2024
azop · €20,000 Company: Insufficient legal basis for data processing Croatian Data Protection Authority (azop) fined Company €20,000 on 2024-02-26 for: Insufficient legal basis for data processing. Human Resources Processing Supervisory Authorities Feb 26, 2024
azop · €5,470,000 Debt collection company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed of fine of EUR 5,470,000 to a debt collection company. The investigation was triggered by an anonymous complaint stating that controller… Controllers Legitimate Interest Whistleblower Protection Oct 5, 2023
azop · €15,000 Hotel: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed of fine of EUR 15,000 to a hotel. The hotel was collecting personal data from guests in excess of what would have been necessary for the… Notified Body Responsibilities and Operational Obligations Controllers IP Address Sep 26, 2023
azop · €30,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 30,000 on a company engaged in gambling and betting activities due to three identified violations of the GDPR. As noted by AZOP,… Cookies Processing Agreement Personal Data Sep 14, 2023
azop · €20,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 20,000 on a company engaged in gambling and betting activities due to three identified violations of the GDPR. As noted by AZOP,… Cookies Controllers Retention Period Sep 14, 2023
azop · €25,000 Zagreb Holding d.o.o.: Insufficient fulfilment of information obligations The Croatian DPA (AZOP) has imposed a fine of EUR 25,000 on Zagreb Holding d.o.o., utilities company owned by the city of Zagreb. The DPA had received a complaint from a citizen… Controllers Public Authority Education Sep 13, 2023
Croatia · €2,000,030,000 AZOP (Croatia) - Decision 14-09-2023 Facts — The two companies in question, as controllers, made use of cookies on their websites, but failed to inform data subjects visiting their web pages about the legal basis for… Cookies Fines Consent Sep 1, 2023
azop · €380,000 Sports betting operator: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 380,000 on a sports betting operator. AZOP had received a complaint from a data subject, stating that the controller had obtained… Controllers Security Storage Limitation May 18, 2023
azop · €2,265,000 Debt collection agency: Insufficient technical and organisational measures to ensure information security The Croatian DPA (AZOP) has imposed a fine of EUR 2,265,000 on a debt collection agency. The fine is the highest ever imposed by AZOP. AZOP had received an anonymous complaint in… Controllers Security Processors May 4, 2023
azop · €2,654 Jewelry manufacturer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a jewelry manufacturer. The controller had installed a video surveillance system in its premises, however the DPA found… Video Surveillance Monitoring Corrective Actions and Duty of Information Framework Dec 8, 2022
azop · €2,654 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… Video Surveillance Monitoring Corrective Actions and Duty of Information Framework Dec 8, 2022
azop · €2,654 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… Video Surveillance Monitoring Controllers Dec 7, 2022
azop · €1,991 Fish market: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a fish market. The controller had installed a video surveillance system in its premises, however the DPA found that the… Video Surveillance Monitoring Corrective Actions and Duty of Information Framework Dec 7, 2022
azop · €3,185 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 3,185 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… Video Surveillance Monitoring Controllers Dec 6, 2022
azop · €1,991 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… Video Surveillance Monitoring Corrective Actions and Duty of Information Framework Dec 6, 2022
azop · €3,583 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 3,583 on a retailer. The controller had installed a video surveillance system in their premises, however the DPA found that the… Video Surveillance Monitoring Controllers Dec 5, 2022
azop · €1,991 Betting place: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a betting place. The controller had installed a video surveillance system in its premises, however the DPA found that… Video Surveillance Monitoring Corrective Actions and Duty of Information Framework Dec 5, 2022
azop · €1,991 Betting place: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a betting place. The controller had installed a video surveillance system in its premises, however the DPA found that… Video Surveillance Monitoring Corrective Actions and Duty of Information Framework Nov 25, 2022
azop · €1,991 Company in the hospitality industry: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a company in the hospitality industry. The controller had installed a video surveillance system in its premises, however… Video Surveillance Monitoring Corrective Actions and Duty of Information Framework Nov 25, 2022
azop · €285,000 Telecommunications company: Insufficient technical and organisational measures to ensure information security The Croatian DPA has fined a telecommunications company EUR 285,000. The company had suffered a data breach. Attackers had managed to access data from about 100,000 data subjects.… Data Breaches Security Telecommunications Jul 21, 2022
azop · €4,000 Car dealership: Insufficient fulfilment of information obligations The Croatian DPA has fined a car dealership EUR 4,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… Video Surveillance Monitoring Controllers Jul 21, 2022
azop · €89,250 Retail company (name not available at the moment): Insufficient technical and organisational measures to ensure information security A retail company, i.e. the data controller, reported the breach of personal data to the DPA informing that its employees have recorded video surveillance footage via mobile phone… Data Breaches Integrity and Confidentiality Principle Security Mar 8, 2022
azop · €124,245 Energy company (name not available at the moment): Insufficient fulfilment of data subjects rights The fined energy company owns petrol stations and sells fuel to customers. The data subject is a customer who filed a consumer complaint relating to inaccurate measuring and… Video Surveillance Accuracy Personal Data Mar 8, 2022
azop IT services company: Insufficient technical and organisational measures to ensure information security A Croatian IT company provides IT services to entities such as mobile operators, banks and state institutions in Croatia, as well as to companies abroad (USA, Great Britain, the… Security Processors Data Breaches Jul 5, 2021
azop Insurance company: Insufficient fulfilment of information obligations The DPA has ex officio, without prior notice, conducted a direct supervision over an insurance company based in Zagreb. Upon inspection of its business facility for carrying out… Insurance Video Surveillance Monitoring Jul 5, 2021