CroatiaElectronic Communications Act (Zakon o elektroničkim komunikacijama), Article 43, Paragraphs 1 to 3, Secrecy of Electronic Communications
Čl. 43. st. 1.-3. Zakona o elektroničkim komunikacijama
In force since .
An interception and recording consent rule binding public and private bodies.
- Obligation class
- Prohibition, Security
As of .
What it requires
- Do not listen to, tap, store or otherwise intercept or monitor electronic communications or the associated traffic data in public communications networks or publicly available communications services, except as article 52 or a special law allows (article 43, paragraph 1).
- Technical storage necessary for the transmission of a communication, and action necessary to maintain or restore the security of networks and services or to detect technical faults, errors, security risks or attacks, falls outside the prohibition if it respects the principles of data secrecy (article 43, paragraph 2).
- Record communications and associated traffic data during lawful business transactions only where the law authorizes it, and only to provide evidence of commercial transactions or other business communications (article 43, paragraph 3).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Article 170, paragraph 1 fines a legal person EUR 13,270 to EUR 132,720, paragraph 2 the responsible person in it EUR 2,650 to EUR 13,270, and paragraph 3 a natural person EUR 1,320 to EUR 6,630.
- Rule
- Fixed only
- As of
- Minimum
- 13,270
- Currency
- EUR
- Fixed cap
- 132,720
Who enforces it
Enforcement body
The Agency (Agencija), the Croatian Regulatory Authority for Network Industries, or the authority competent for personal data protection may order an end to breaches of articles 41 to 50 (article 51, paragraph 1).
Settledness
- As of
- Open questions
- Which law makes a recording of communications "zakonski ovlašteno" under Article 43, paragraph 3 of the Electronic Communications Act, so that a business may record communications and the associated traffic data during lawful business transactions to provide evidence?
What this law does
Article 43, paragraph 1 of the Electronic Communications Act prohibits, to ensure the secrecy of electronic communications and associated traffic data in public communications networks and publicly available communications services, listening, tapping, storing and any form of interception or surveillance of electronic communications and associated traffic data, except in the cases in article 52 and cases laid down by special laws.
Article 43, paragraph 2 excludes from that prohibition technical storage necessary for the transmission of the communication, and cases where it is necessary to maintain or restore the security of electronic communications networks and services or to detect technical faults, errors, security risks or attacks, without infringing the principles of data secrecy.
Article 43, paragraph 3 provides that paragraphs 1 and 2 do not apply to legally authorized recording of communications and associated traffic data during lawful business transactions to provide evidence of commercial transactions or other business communications. Article 170, paragraph 1 punishes a legal person that does not ensure the secrecy of electronic communications or associated traffic data in the prescribed manner with a fine of EUR 13,270 to EUR 132,720 as a misdemeanor.
Article 170, paragraphs 2 and 3 fine the responsible person in the legal person EUR 2,650 to EUR 13,270 and a natural person EUR 1,320 to EUR 6,630 for the same misdemeanor. Article 51, paragraph 1 lets the Agency (Agencija) or the authority competent for personal data protection order an end to breaches of articles 41 to 50.
Article 7, paragraph 1 makes the Croatian Regulatory Authority for Network Industries (Hrvatska regulatorna agencija za mrežne djelatnosti, the Agency) the national regulatory authority. Article 29 of the amending Act NN 45/2026 renumbers the points of article 170, paragraph 1 that list these breaches. Article 187 provides that the Act takes effect on the eighth day after its publication, except articles 169 to 172, which take effect on the day the euro is introduced.
When LexLint raises it
When your app profile says your app records calls, records text chat or processes voice recordings.