CroatiaAct on the Implementation of the General Data Protection Regulation
Zakon o provedbi Opce uredbe o zastiti podataka, Narodne novine (Official Gazette) br. 42/18
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Croatia, following the Act's institutional and procedural rules.
These lines are LexLint's reading of the law's text. Also read by: Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, judgment of (Ninth Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0621
- Case citation
- Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, judgment of (Ninth Chamber)
- Open questions
- Which commercial interests of a controller can be 'legitimate interests' under Article 6(1)(f) of Regulation (EU) 2016/679, and when is a disclosure of personal data for consideration 'strictly necessary' for one, as Case C-621/22 requires?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 28(4) requires the controller and processor to set up an automated log of access to video surveillance recordings, holding the time and place of access and the identity of the persons who accessed the data. Article 29 caps how long the recordings may be kept (six months, unless another law or proceedings require longer), which is a limit on the recordings and not on the log. Article 51 fines a controller or processor that does not set up the log. The Agency may carry out announced or unannounced supervision of the Act's application (Article 36) and may copy documents and the contents of storage systems (Article 37).
- Kind
- Explicit
- As of
- Provision
- Act on the Implementation of the General Data Protection Regulation, Article 28(4)
- Trigger
- personal_data_processing
What this law does
Croatia gives the General Data Protection Regulation (GDPR) domestic effect through the Act on the Implementation of the General Data Protection Regulation, Narodne novine 42/18, enacted and effective . AZOP (Agencija za zastitu osobnih podataka) is the supervisory authority.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .