CroatiaZakon o kibernetičkoj sigurnosti and Uredba o kibernetičkoj sigurnosti, Incident and Cyber-Threat Reporting Obligations
Zakon o kibernetičkoj sigurnosti Narodne novine, broj 14/2024, čl. 37.-44.; Uredba o kibernetičkoj sigurnosti, Narodne novine, broj 135/2024, čl. 64.-71. i 85.
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds you where you are an essential or important entity designated under the Cybersecurity Act, whose Annex III lists providers of digital services as a sector and whose definitions clause names a provider of an online marketplace, an online search engine, or a social networking services platform expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management-and-governance row.
- Notify the competent computer security incident response team (CSIRT) of every significant incident on this clock, set by the Cybersecurity Regulation rather than the Act itself: an early warning without delay and no later than 24 hours after becoming aware of it (24 hours also for a trust service provider's initial notification), an initial notification no later than 72 hours otherwise, an interim report if the CSIRT requests one, and a final report no later than 30 days after your initial notification, or, if the incident is still unresolved at that point, a progress report instead, repeated every 30 days once the incident has run past 60 days, followed by a final report within 30 days of your last progress report.NIST CSF 2.0RS.CO-02
- Submit an interim report to the CSIRT when it requests one, within the period the CSIRT sets, of no less than 48 hours and no more than seven days from receipt of the request.NIST CSF 2.0RS.CO-03
- Notify the recipients of your service, without delay and no later than 72 hours after you become aware of a significant incident likely to affect them, in a clear and easily verifiable way, and send them any details that were not yet known within 72 hours of sending that notice. Separately notify them of a serious cyber threat and of any protective measures or remedies they can take.NIST CSF 2.0RS.CO-02
- If you are newly categorized as an essential or important entity, you have 30 days from the date you receive your Article 19(1) categorization notice before these notification duties bind you.
- Same fine tiers and misdemeanor-prosecution mechanism as this jurisdiction's companion risk-management-and-governance row: EUR 10,000 to EUR 10,000,000 or 0.5 to 2 percent of worldwide turnover for an essential entity, EUR 5,000 to EUR 7,000,000 or 0.2 to 1.4 percent for an important entity, whichever amount is higher, referred to the state attorney for misdemeanor prosecution rather than imposed directly by the competent authority.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Chapter Nine of the Act makes an Article 37 or 38 reporting failure a prekrsaj (misdemeanor) rather than a kazneno djelo (criminal offense) under the Kazneni zakon. As with the companion risk-management duty, the competent authority does not impose this fine itself: Article 104 requires it to report a suspected failure to the competent state attorney, who prosecutes it as a misdemeanor before the misdemeanor court.
Penalty structure
Article 101(1) sets an essential entity's fine for a reporting failure at EUR 10,000 to EUR 10,000,000, or 0.5 percent to 2 percent of worldwide annual turnover for the preceding financial year, whichever amount is higher; this is the same penalty provision that governs the companion risk-management-and-governance row. Article 102(1) sets an important entity's fine at EUR 5,000 to EUR 7,000,000, or 0.2 percent to 1.4 percent, whichever is higher, not separately structured here since this field holds one tier. As with the companion row, none of these fines is imposed by the competent authority directly: Article 104 routes a suspected violation to the competent state attorney, who prosecutes it as a misdemeanor before the misdemeanor court.
- Rule
- Higher of
- As of
- Minimum
- 10,000
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The central state body for cybersecurity (Središnje državno tijelo za kibernetičku sigurnost) as the competent authority, with notifications received by the competent CSIRT Annex III names per sector (the National Cybersecurity Centre for a digital service provider). A suspected reporting failure is referred to the competent state attorney (Article 104), who prosecutes it as a misdemeanor before the misdemeanor court. For a public electronic-communications provider the authorized prosecutor is instead the regulatory body for network activities, and for a trust service provider the state administration body responsible for digital society development (Article 104(3)-(4)).
Settledness
- As of
- Open questions
- Regulation Article 116 exempts only its own Articles 104 and 105 from the standard eighth-day commencement, deferring them to , and their numbering sits well past the incident-reporting chapter documented here (Articles 64 to 71 and 85). Do Articles 104 and 105 touch the incident-reporting duties documented here at all, or are they unrelated?
- Article 69(3) lets the competent CSIRT set the interim-report deadline anywhere from 48 hours to 7 days depending on the request's scope and complexity. Has the competent CSIRT published sector-specific guidance narrowing that range for any particular sector?
What this law does
Article 37 of the Cybersecurity Act requires every essential and important entity to notify the competent computer security incident response team (CSIRT) of every incident with a significant effect on the availability, integrity, confidentiality or authenticity of data material to the entity's business or on the continuity of the services it provides (a significant incident), and Article 38 requires it to notify the recipients of its services of a significant incident likely to affect them and, on a serious cyber threat, of protective measures or remedies those recipients can take.
Neither article states the notification clock itself: Article 44 delegates the criteria for a significant incident, the type and content of every notification under Articles 37 to 40, and the deadlines for their submission to the implementing regulation Article 24 authorizes. That regulation, the Cybersecurity Regulation (Narodne novine No. 135/2024), sets the clock in its Articles 64 to 71.
An early warning to the competent CSIRT is due without delay and no later than 24 hours after becoming aware of a significant incident (Article 66). An initial notification is due no later than 72 hours (Article 67). A trust service provider's initial notification is due no later than 24 hours instead (Article 68). An interim report is due on the CSIRT's request, within a period the CSIRT sets of 48 hours to 7 days (Article 69).
A final report is due no later than 30 days after the initial notification (Article 70). Where the incident is still ongoing at that point, a progress report takes the place of the final report and is repeated every 30 days once the incident has run past 60 days, followed by a final report within 30 days of the last progress report (Article 71).
The Regulation's Article 85 sets a parallel 72-hour clock, running from the entity's own awareness of the incident, for notifying affected service recipients under the Act's Article 38. Article 37(4) and Article 38(3) of the Act each separately give a newly categorized entity 30 days from the date it receives its Article 19(1) categorization notice before these notification duties bind it, a grace period distinct from the per-incident clock the Regulation sets.
The same Chapter Nine penalty structure documented on this jurisdiction's companion risk-management-and-governance row applies to a reporting failure: an essential entity's fine of EUR 10,000 to EUR 10,000,000 or 0.5 to 2 percent of worldwide turnover, an important entity's fine of EUR 5,000 to EUR 7,000,000 or 0.2 to 1.4 percent, whichever is higher in each case, referred by the competent authority to the competent state attorney for misdemeanor prosecution rather than imposed directly.
Article 8(1) applies the corresponding provisions of a special law, including those on supervision, to an essential or important entity of a sector in Annex I or II for which that special law sets requirements that match this Act's cybersecurity requirements in content and purpose or are stricter. Article 4(1) names the Croatian National Bank and the Croatian Financial Services Supervisory Agency, with the Croatian Civil Aviation Agency, as the authorities competent to apply those special laws.
Annex III names no authority implementing this Act's cybersecurity requirements for the banking and financial-market-infrastructure sectors, and names the Croatian National Bank and the Croatian Financial Services Supervisory Agency as the authorities implementing their special laws.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .