INTRA/HRCroatia

What the record establishes for Croatia, measure by measure, and what each source requires of the measure it governs.

Binding: 19
Recommended: 0
Reported: 0
Measures touched: 19 of 110
Sources cited: 7

Control	Source	What it establishes	Prerequisite or recommendation
19Mandatory
AW001/HR Workforce awareness on insider riskMandatory	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the persons responsible for the measures follow suitable training and enable the employees to follow suitable training, and basic cyber hygiene and cybersecurity training are among the measures.
AW002/HR Transparency notice on what is observedMandatory	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026Smjernice o obradi osobnih podataka u radnim odnosimaAgencija za zaštitu osobnih podataka (AZOP) · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	At hiring, the employer informs the worker in writing that audio or video surveillance devices will observe them. Premises under video surveillance are marked visibly before the recording perimeter is entered, with the article 13 information, in particular that the space is under surveillance, the controller, and the contact for exercising rights; employees are informed in an appropriate way beforehand and before the decision to install. Workers are informed of a GPS system in vehicles by written internal rules available to all, an oral notice being insufficient.
CP005/HR Referral to law enforcementMandatory	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the notification of a significant incident is also delivered to the law enforcement bodies where there are grounds to suspect that it arose from a criminal offence.
DP001/HR Identification of critical assetsMandatory	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the measures include the management of software and hardware assets with a regularly updated inventory.
DP004/HR Access control and least privilegeMandatory	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026Uredba o kibernetičkoj sigurnostiVlada Republike Hrvatske · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the measures include access control policies and multi-factor or continuous authentication where needed. For key and important entities, an owner is defined for each application and each role, the owner approves the assignment of rights, and a record is kept of who approved the assignment, with rights assigned, changed, revoked, and documented under the access control policy.
DP005/HR Privileged access managementMandatory	Uredba o kibernetičkoj sigurnostiVlada Republike Hrvatske · read 5 Oct 2026	For key and important entities, that candidates are checked before hiring according to the significance of the post, that a record is kept of every login and activity on critical systems for a forensic trail with at least the last 90 days of logs, synchronized time, and named log types, that security-relevant events are copied to a central store within 24 hours with anomaly detection and, where possible, an administrator other than the source system’s, that an owner approves the assignment of access rights and the approval is recorded, that privileged and administrator accounts follow written rules (dedicated accounts, individualized and limited privileges, use only for administration, strong authentication), that user and entity behaviour analytics is in the catalogue, and that a significant incident is notified in an early warning within 24 hours and an initial notification within 72 hours.	For key and important entities, privileged and administrator accounts follow written rules: dedicated accounts used only for administration, individualized and limited administrative privileges, use of privileged accounts only to connect to administration systems, and strong authentication such as multi-factor.
DP012/HR Retention and disposal of program recordsMandatory	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	Video surveillance recordings are kept at most six months, unless another law sets a longer period or they are evidence in judicial, administrative, arbitration, or equivalent proceedings.
GV001/HR Program charter and mandateMandatory	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the members of the management bodies answer for the implementation of the risk management measures, approve the measures the entity will apply, and control their implementation.
GV004/HR Roles and decision rightsMandatory	Zakon o radu, članci 29, 150, 151, and 153Hrvatski sabor · read 5 Oct 2026	That workers’ personal data are collected, processed, used, and transmitted only where a law provides or where needed for the rights and obligations of the employment, that the employer sets out in advance in the work rules which data and for what purpose, that an employer with at least twenty workers appoints a person trusted by the workers to oversee that processing, that the employer consults the works council before an important decision, the introduction of new technology among them, and that a decision on collecting, processing, using, and transmitting data on the worker, and on appointing the overseeing person, needs the works council’s prior consent, replaceable by a court or arbitration decision.	An employer with at least twenty workers appoints a person who enjoys the workers’ trust and is authorized, beside the employer, to oversee whether workers’ personal data are collected, processed, used, and transmitted in accordance with the law; the appointment needs the works council’s prior consent.
GV007/HR Lawful basis registerMandatory	Zakon o radu, članci 29, 150, 151, and 153Hrvatski sabor · read 5 Oct 2026Smjernice o obradi osobnih podataka u radnim odnosimaAgencija za zaštitu osobnih podataka (AZOP) · read 5 Oct 2026	That workers’ personal data are collected, processed, used, and transmitted only where a law provides or where needed for the rights and obligations of the employment, that the employer sets out in advance in the work rules which data and for what purpose, that an employer with at least twenty workers appoints a person trusted by the workers to oversee that processing, that the employer consults the works council before an important decision, the introduction of new technology among them, and that a decision on collecting, processing, using, and transmitting data on the worker, and on appointing the overseeing person, needs the works council’s prior consent, replaceable by a court or arbitration decision.	Workers’ personal data are collected, processed, used, and transmitted only where this or another law provides or where needed for the rights and obligations of the employment, and the employer sets out in advance in the work rules which data are collected for that purpose and for what; only the employer or a person it specially authorizes processes them. Consent is seldom an adequate basis for processing workers’ data, the dependence of the worker standing in the way; the employer relies on another basis, such as contract or a demonstrated legitimate interest.
GV010/HR Worker representative engagementMandatory	Zakon o radu, članci 29, 150, 151, and 153Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti prijavitelja nepravilnosti, članci 19 to 22Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026	That workers’ personal data are collected, processed, used, and transmitted only where a law provides or where needed for the rights and obligations of the employment, that the employer sets out in advance in the work rules which data and for what purpose, that an employer with at least twenty workers appoints a person trusted by the workers to oversee that processing, that the employer consults the works council before an important decision, the introduction of new technology among them, and that a decision on collecting, processing, using, and transmitting data on the worker, and on appointing the overseeing person, needs the works council’s prior consent, replaceable by a court or arbitration decision.	A decision on collecting, processing, using, and transmitting data on the worker is taken only with the works council’s prior consent, silence for eight days counting as consent, a refusal being reasoned in writing and replaceable by a court or arbitration decision on request within fifteen days; the introduction of new technology and changes in the organization and manner of work are consulted with the council beforehand, and a decision taken without the consultation is void; where no council exists the union representative holds its rights. Surveillance devices that follow all the worker’s movements throughout working time, or keep workers in view throughout work, are used only on the works council’s prior consent, a refusal being replaceable by arbitration on request within 15 days. The confidential person for internal reports and the deputy are appointed on the proposal of the works council or the union representative holding its rights, or of at least 20 % of the workers, and dismissed without delay on their proposal.
IR006/HR Notification to a supervisory authorityMandatory	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026Uredba o kibernetičkoj sigurnostiVlada Republike Hrvatske · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, an incident with a significant effect on the availability, integrity, confidentiality, or authenticity of data of significance for the business or on the continuity of services is notified to the competent CSIRT, and recipients of services are informed of significant incidents and serious threats. For key and important entities, the early warning of a significant incident reaches the competent CSIRT without delay and within 24 hours of learning of it, and the initial notification within 72 hours; trust service providers give the initial notification within 24 hours.
IV001/HR Internal reporting channelMandatory	Zakon o zaštiti prijavitelja nepravilnosti, članci 19 to 22Hrvatski sabor · read 5 Oct 2026	That an employer with at least 50 workers establishes a system of internal reporting, that the employer adopts a general act on the procedure and appoints a confidential person and a deputy on the proposal of the works council or the union representative or of at least 20 % of the workers, that the confidential person acknowledges receipt within seven days, gives feedback as a rule within 30 and at most 90 days, keeps the identity and the data confidential, forwards unresolved matters to the competent bodies, and reports to the external body within 30 days of deciding, and that the employer does not influence the confidential person.	An employer with at least 50 workers establishes a system of internal reporting under a general act, with a confidential person and a deputy who acknowledge receipt within seven days, examine and give feedback as a rule within 30 and at most 90 days, keep the reporter’s identity and the data confidential, forward unresolved matters to the competent bodies, and report to the external body within 30 days of deciding; the employer does not influence them, and whoever else receives a report forwards it unchanged.
IV008/HR Use of records held for other purposesMandatory	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	Recordings from surveillance devices installed as a safety measure are not used for purposes other than those the article states. Those with access to video surveillance footage do not use it contrary to the purpose of protecting persons and property.
MD002/HR Log collection and centralizationMandatory	Uredba o kibernetičkoj sigurnostiVlada Republike Hrvatske · read 5 Oct 2026Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026	For key and important entities, that candidates are checked before hiring according to the significance of the post, that a record is kept of every login and activity on critical systems for a forensic trail with at least the last 90 days of logs, synchronized time, and named log types, that security-relevant events are copied to a central store within 24 hours with anomaly detection and, where possible, an administrator other than the source system’s, that an owner approves the assignment of access rights and the approval is recorded, that privileged and administrator accounts follow written rules (dedicated accounts, individualized and limited privileges, use only for administration, strong authentication), that user and entity behaviour analytics is in the catalogue, and that a significant incident is notified in an early warning within 24 hours and an initial notification within 72 hours.	For key and important entities, where technically feasible, a record is created of every login and activity on critical systems for a forensic trail, logs of at least the last 90 days are kept, all systems keep synchronized time, and the log types include network traffic metadata, access to systems, applications, and devices, creation, change, and deletion of user accounts and extension of rights, changes to backups, and records of security tools; security-relevant events are copied to a central store within 24 hours, protected against unauthorized access and change, with anomaly recognition and alerts, and where possible an administrator other than the source system’s. For key and important entities, incident handling includes the monitoring, recording, and reporting of incidents.
MD013/HR Physical access monitoringMandatory	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	Surveillance devices are permitted to control entries to and exits from work premises and spaces and to reduce the workers’ exposure to robbery, burglary, violence, theft, and similar events at or in connection with work. Every access to video surveillance footage is recorded by an automated log holding the time, the place, and the identity of the person accessing.
MD014/HR Video surveillance of the workplaceMandatory	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026Zakon o zaštiti na radu, članak 43Hrvatski sabor · read 5 Oct 2026Smjernice o obradi osobnih podataka u radnim odnosimaAgencija za zaštitu osobnih podataka (AZOP) · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	Surveillance devices are a means of occupational safety used on the conditions of the Act, barred from rooms for personal hygiene and changing, and the recordings are not used for purposes other than those of the article, not shown in public or to persons without authority over safety, and kept from unauthorized persons. Video surveillance of employees is lawful only where the conditions of the implementation act and of the occupational safety rules are met, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing; the purpose is one necessary and justified for the protection of persons and property, and access to footage belongs to the responsible person and those authorized. Video surveillance of workers needs no consent of the worker and rests on the two Acts; the employer informs the workers in an appropriate way before introducing it and before the decision to install, and seeks the works council’s prior consent where devices follow all movements throughout working time.
MD016/HR Measurement of pace and performanceMandatory	Zakon o provedbi Opće uredbe o zaštiti podataka, članci 25 to 30Hrvatski sabor · read 5 Oct 2026	That video surveillance serves only a purpose necessary and justified for the protection of persons and property, that the premises are marked before the perimeter is entered with the controller’s identity and contact for rights, that access to footage is limited to the responsible person and those authorized, that an automated log records the time, place, and person of every access to footage, that recordings are kept at most six months unless a law provides longer or they are evidence in proceedings, and that employees are processed by video surveillance only where the occupational safety conditions are met too, the employees were informed beforehand in an appropriate way and before the decision to install, and never in rooms for rest, personal hygiene, and changing.	In residential buildings, video surveillance is not used to track the work performance of caretakers, cleaners, and other persons working there.
PS001/HR Pre-employment screeningMandatory	Zakon o kibernetičkoj sigurnosti, članci 4, 29, 30, 37, and 38Hrvatski sabor · read 5 Oct 2026Uredba o kibernetičkoj sigurnostiVlada Republike Hrvatske · read 5 Oct 2026	For key and important entities, that the members of the management bodies answer for the risk management measures, approve them, control their implementation, and follow and offer employees suitable training; that the measures include human resources security, access control policies and management of software and hardware assets with a regularly updated inventory, incident handling with monitoring, recording, and reporting, cyber hygiene and training, and multi-factor or continuous authentication; that a significant incident is notified to the competent CSIRT and, where there are grounds to suspect a criminal offence, to the law enforcement bodies; and that the measures and their implementation are set by the Government’s regulation.	For key and important entities, the measures include human resources security, without the Act saying what it holds. For key and important entities, the adequacy and qualifications of candidates are checked before hiring according to the significance of the post and the applicable rules, by such means as references, validity of certificates and diplomas, written tests, and certificates of no criminal record.