Croatia Recording Laws: All-Party Consent, GDPR & Penalties (2026)

Croatia is an all-party consent jurisdiction: recording privately spoken words without consent is a criminal offense under Article 143 of the Kazneni zakon (Criminal Code, NN 125/11), punishable by up to three years in prison. GDPR enforcement through AZOP adds administrative fines on top of any criminal exposure.

Overview of Croatia Recording Laws

Croatia requires all-party consent before recording any private conversation. Under Article 143 of the Kazneni zakon (Criminal Code, Official Gazette NN 125/11, as amended through NN 144/12, 56/15, 61/15, 101/17, 118/18, 126/19, 84/21, 114/22, 114/23, 36/24 and 136/25), recording privately spoken words of another person without consent is a criminal offense punishable by up to three years of imprisonment. Croatia is not a jurisdiction where being a participant in a conversation gives you the right to record it. In a final 2020 judgment, the Varaždin County Court held that the offense also covers a person who records their own conversation with another person without that person's consent (Kž-553/2019-8).

The rule has limits. Words spoken publicly are not covered, there is no offense where the recording serves the public interest or another interest that outweighs the privacy of the person recorded (Art. 143(4)), and the offenses in paragraphs 1 and 2 are prosecuted only on the victim's motion (Art. 143(5)).

Jurisdiction scope: This article addresses recording laws in Croatia, covering the Kazneni zakon (Criminal Code), the Constitution of the Republic of Croatia, the Act on Implementation of the GDPR (NN 42/2018), the Electronic Communications Act (NN 76/22), the Cybersecurity Act (NN 14/24), the Criminal Procedure Act, and EU Regulation 2016/679 (GDPR). It does not address other EU member states individually; for a broader comparison, see EU recording laws.

The legal framework operates at four layers: constitutional privacy rights (Articles 35, 36, 37 of the Constitution), criminal law penalties (Criminal Code Articles 143, 144, and 144a), data protection obligations under the GDPR and its Croatian implementing act, and the EU AI Act overlay that became partly applicable in 2025. AZOP, the national data protection authority, is an active enforcer that imposed more than EUR 6.7 million in administrative fines in 2025.

For visitors, residents, and businesses operating in Croatia, understanding this layered framework is essential. A single unauthorized recording can simultaneously trigger criminal prosecution, GDPR administrative fines, and civil damages claims.

Constitutional Foundation for Privacy

The Croatian Constitution establishes the fundamental right to privacy of communications through three interlocking articles that courts use as the interpretive foundation for all recording restrictions.

Article 35 guarantees everyone respect for and legal protection of their personal and family life, dignity, reputation, and honor. This broad privacy protection serves as the constitutional basis for recording restrictions across the Criminal Code and data protection statutes.

Article 36 is the most directly relevant provision. It states that the freedom and secrecy of correspondence and all other forms of communication are guaranteed and inviolable. Only restrictions necessary for the protection of national security or the conduct of criminal proceedings may be prescribed, and only by law.

Article 37 further guarantees the safety and secrecy of personal data. Without the consent of the person concerned, personal data may only be collected, processed, and used under conditions specified by law. The use of personal data contrary to the purpose of their collection is expressly prohibited.

These three constitutional articles create a strong baseline protection that the Criminal Code and data protection laws build upon. Croatian courts apply proportionality analysis when evaluating whether a recording violated these rights, weighing the privacy interest against any competing interest such as public accountability or safety.

Criminal Code Article 143: Unauthorized Audio Recording and Eavesdropping

Article 143 of the Kazneni zakon (Neovlasteno zvucno snimanje i prisluskivanje) is the primary criminal statute governing unauthorized audio recording in Croatia. It sits in Chapter XIV of the Criminal Code, covering criminal offenses against privacy.

Paragraph 1: Basic Offense

Anyone who unlawfully makes an audio recording of words spoken in private by another person, or who unlawfully eavesdrops on words spoken in private by another person using special devices not intended for them, faces imprisonment of up to three years.

The key elements of this offense are:

• The words must be privately spoken (nejavno izgovorene rijeci). Public statements, speeches at public events, or statements made in a public forum are not protected.
• The recording or eavesdropping must be unauthorized (neovlasteno). This means it was done without the consent of the person whose words were recorded.
• For eavesdropping specifically, the perpetrator must use special devices (posebne naprave) to intercept words not intended for them.

This paragraph criminalizes both the act of recording and the act of listening in. Simply using a device to monitor a conversation you are not a party to is sufficient to commit this offense, even without creating a permanent file.

Paragraph 2: Dissemination of Recordings

The same penalty of up to three years applies to anyone who uses unauthorized recordings, makes them available to a third party, or publicly states the eavesdropped words verbatim or in their essential features.

Even if you did not make the original recording, you can face criminal liability for:

• Playing a recording for someone else
• Sharing a recording file through any medium, including messaging apps
• Publishing the content of an eavesdropped conversation
• Publicly disclosing what was overheard through eavesdropping, word for word or in substance

Paragraph 3: Official Misconduct Enhancement

If an official (sluzbena osoba) commits the offense while performing official duties, or a responsible person commits it while exercising public authority, the penalty increases to imprisonment from six months to five years.

This enhanced penalty targets government employees, police officers, and other officials who abuse their positions to conduct unauthorized surveillance. The minimum six-month sentence reflects the heightened trust placed in public officials and the greater harm caused when that trust is violated.

Paragraph 4: Public Interest Defense

There is no criminal offense if the actions were undertaken in the public interest or in another interest that is predominant over the privacy interest of the recorded person.

Whether the defense applies is decided case by case, by weighing the interest the recording served against the privacy of the person recorded. As a general rule in Croatian criminal cases, the burden of proof rests on the prosecutor unless a law provides otherwise (Criminal Procedure Act, Art. 3(2)), but anyone relying on the defense should be able to show the specific interest the recording served.

Offenses under paragraphs 1 and 2 are prosecuted only on the victim's motion (Art. 143(5)), and the recordings and special devices used are confiscated (Art. 143(6)).

Article 144: Unauthorized Visual Recording

Article 144 (Neovlasteno slikovno snimanje) addresses unauthorized visual recording, including photography and video. It is an offense to make an unauthorized image recording of a person who is in a dwelling or a space specially protected from view, or to use such a recording or make it available to a third person, where this violates their privacy. The penalty is up to one year in prison.

The penalty rises to up to three years if an official commits the offense while performing official duties, or a responsible person while exercising public authority, or if the recording is made available to a larger number of people (Art. 144(2)-(3)). The basic offense is prosecuted only on the victim's motion (Art. 144(4)).

Because Article 144 protects only people in a dwelling or a space specially protected from view, photographing or filming someone in a public place generally does not fall under this provision.

Voyeurism and Non-Consensual Intimate Imagery

Croatia's Criminal Code addresses two distinct categories of visual privacy offenses that go beyond the basic Article 144 prohibition.

Article 144a: Non-Consensual Sharing of Intimate Recordings

Article 144a (Zlouporaba snimke spolno eksplicitnog sadrzaja) was added to the Criminal Code in 2021 by NN 84/21 to address the misuse of sexually explicit recordings (non-consensual intimate images, sometimes called revenge porn). Paragraph 1 covers anyone who, abusing a relationship of trust and without the consent of the filmed person, makes available to a third party a recording of sexually explicit content that was originally taken with the subject's consent for personal use, thereby violating that person's privacy. The penalty is imprisonment of up to one year.

Paragraph 2 imposes the same penalty on anyone who, using a computer system or otherwise, creates a new sexually explicit recording or alters an existing one and uses it as real, violating the privacy of the person shown. Under paragraph 3, either offense carries up to three years in prison when committed through a computer system or network, or otherwise in a way that makes the recording available to a larger number of people.

These offenses are prosecuted only on the victim's motion (po prijedlogu, Art. 144a(4)), meaning the criminal process will not begin without the victim's initiative. The key elements distinguishing Article 144a(1) from the basic Article 144 offense are: (1) the original recording was consensual; (2) the perpetrator abused a relationship of trust; and (3) the distribution occurred without consent.

Article 144a(1) does not cover situations where the underlying recording was itself non-consensual. If someone secretly films intimate content without consent of a person in a dwelling or a space specially protected from view, that act falls under Article 144. Fabricated or altered sexually explicit recordings fall under Article 144a(2).

Intersection with GDPR

Distribution of intimate imagery also constitutes processing of sensitive personal data under GDPR, which means the distributor faces both criminal liability under Article 144a and potential GDPR administrative sanctions. AZOP can impose fines independently of any criminal proceeding.

Phone Call Recording Laws

Recording telephone conversations in Croatia follows the same all-party consent framework as Article 143. Phone calls are considered private communications, and all parties must consent to the recording.

If you participate in a phone call and record it without informing the other person, you are committing a criminal offense under Croatian law. This applies whether the call is made from a landline, a mobile phone, or through a Voice over Internet Protocol (VoIP) service.

The Electronic Communications Act (Zakon o elektronickim komunikacijama, NN 76/22) entered into force on 12 July 2022, replacing the prior 2008 Act. It implements the European Electronic Communications Code (Directive 2018/1972) and expressly governs the confidentiality of electronic communications. Unauthorized interception is prohibited under the Act; fines for breach of confidentiality provisions reach up to EUR 132,720.

For businesses that record customer calls, the GDPR adds further requirements beyond criminal law consent. Under GDPR Article 6(1), the business must identify a valid legal basis for processing the personal data contained in the call recording. AZOP has specifically enforced this requirement, most visibly in its September 2024 decision imposing EUR 190,000 on a Rijeka-area special hospital for a series of GDPR violations, including recording call center conversations without a demonstrated legal basis and without informing callers.

In-Person Conversation Recording

Recording face-to-face conversations in Croatia carries the same legal requirements as recording phone calls. All participants must consent to the recording for it to be lawful.

The concept of "privately spoken words" (nejavno izgovorene rijeci) is central to when Article 143 applies. Words are considered privately spoken when they are directed to a specific person or group in circumstances where the speaker has a reasonable expectation that only the intended audience will hear them.

Examples of privately spoken words include:

• A conversation between two people in a private office
• A discussion at a dinner table among friends
• A consultation between a client and a professional
• A meeting in a conference room, even if the door is unlocked

Conversations in the following contexts are generally not considered "privately spoken":

• Public speeches or presentations
• Statements made at public meetings or government proceedings
• Comments made in a public space where anyone can hear without effort

The distinction matters because Article 143 applies only to privately spoken words. Recording a politician's speech at a public rally does not trigger criminal liability under this article. However, approaching that politician afterward for a private conversation and recording it without consent would.

Workplace Recording and Surveillance

Croatia regulates workplace recording through the intersection of criminal law, the Labour Act (Zakon o radu, NN 93/14 and subsequent amendments), and data protection law. Employers face specific obligations when implementing any form of workplace monitoring.

Video Surveillance

The Act on Implementation of the GDPR (Zakon o provedbi Opce uredbe o zastiti podataka, NN 42/18) contains specific provisions for workplace video surveillance. Employers may install video surveillance cameras only if:

• The surveillance complies with the Law on Occupational Health and Safety
• Employees have been informed in advance about the surveillance
• The employer informed employees before deciding to install the system
• The surveillance does not cover premises intended for resting, personal hygiene, or changing clothes

Works Council Requirements

Under Article 43 of the Occupational Safety and Health Act (Zakon o zastiti na radu, NN 71/14 as amended), an employer whose surveillance devices follow all of a worker's movements throughout working time, or keep workers in view throughout their working time, may use them only with the prior consent of the works council (radnicko vijece), or of a union representative who holds its powers. If consent is refused, the employer can ask for a court or arbitration decision to replace it. Employers must also tell workers in writing, when they are hired, that they will be monitored by audio or video devices. The Labour Act separately requires works council consent for decisions on collecting and processing workers' personal data (Art. 151(1)(7)).

In April 2024, AZOP imposed fines of EUR 500 to EUR 4,000 on seven controllers (hotels, catering businesses and shops) that failed to clearly notify data subjects of video surveillance. This enforcement series illustrates that even technically lawful surveillance programs can draw administrative penalties when notice requirements are not met.

Audio Recording Restrictions

Audio recording in the workplace is subject to the same criminal law restrictions as any other private recording. An employer who records employee conversations without consent faces prosecution under Article 143. The workplace does not create an exception to the all-party consent requirement.

Data protection law adds its own limits. AZOP's September 2024 decision imposing EUR 190,000 on a Rijeka-area special hospital covered a series of GDPR violations, including recording telephone conversations through its call center without demonstrating a valid legal basis (GDPR Arts. 6(1) and 5(2)), failing to inform callers about the recording (GDPR Arts. 12(1) and 13), not defining retention periods for the recordings (GDPR Art. 5(1)(e)), and not involving the Data Protection Officer in the matter (GDPR Art. 38(1)).

Data Security for Recordings

Employers who conduct any authorized recording or surveillance must prevent unauthorized access to recordings and are prohibited from broadcasting footage. They are required to allow access to authorized inspectors and regulatory authorities upon request.

GDPR and Data Protection Framework

As an EU member state, Croatia is subject to the General Data Protection Regulation (GDPR, Regulation 2016/679), which adds a comprehensive data protection layer on top of criminal law.

AZOP: The Supervisory Authority

The Croatian Personal Data Protection Agency (Agencija za zastitu osobnih podataka, AZOP) is the national supervisory authority responsible for GDPR enforcement in Croatia. AZOP investigates complaints, conducts audits, and imposes administrative fines.

AZOP demonstrated sharply increasing enforcement intensity in 2025. By 18 December 2025, the agency had imposed thirteen administrative fines in 2025, totaling EUR 6,723,000. The largest single fine in 2025 was EUR 4.5 million imposed on a telecommunications operator for transferring personal data to third countries without a valid transfer instrument, lack of transparency to data subjects, processing copies of employees' identity cards and certificates of no criminal proceedings without a legal basis, and failure to carry out appropriate prior checks of a processor.

A bank was separately fined EUR 1.5 million in December 2025 for processing personal data of 433,922 mobile banking users without a legal basis.

Recording as Data Processing

Any recording of an identifiable person constitutes processing of personal data under the GDPR. This means that even where criminal law consent has been obtained, the recorder must also comply with GDPR requirements:

• Legal basis (Article 6): A valid legal basis must exist, such as consent, legitimate interest, or legal obligation.
• Transparency (Articles 12-13): Data subjects must be informed about the recording, its purpose, the legal basis, retention period, and their rights.
• Purpose limitation (Article 5(1)(b)): Recordings may only be used for the specific stated purpose.
• Storage limitation (Article 5(1)(e)): Recordings must not be kept longer than necessary.
• Security (Article 32): Appropriate technical and organizational measures must protect recorded data.

GDPR Fines

GDPR violations related to recording can result in administrative fines of up to EUR 20 million or 4% of annual global turnover, whichever is higher. AZOP's 2025 record demonstrates that these are not theoretical maximums.

Deepfake and AI-Generated Content

The EU AI Act (Regulation (EU) 2024/1689), which entered into force on 1 August 2024, introduces new obligations directly relevant to AI-generated or AI-manipulated recordings.

Prohibited Practices (in force from 2 February 2025)

Article 5 of the AI Act prohibits certain AI applications outright in all EU member states including Croatia. Prohibited practices relevant to recording include:

• Real-time remote biometric identification in publicly accessible spaces by law enforcement authorities, with narrow exceptions for serious crimes and missing persons.
• Untargeted scraping of facial images from the internet or CCTV footage to create or expand facial recognition databases.

Transparency for Synthetic Content (in force from 2 August 2026)

Article 50 of the AI Act requires that any AI system generating or substantially manipulating audio or video content must disclose that the output is AI-generated. Specifically:

• Providers of AI systems that generate deepfake video or synthetic audio must ensure the content is clearly marked as artificially generated or manipulated.
• This disclosure requirement applies to any content that a reasonable person could mistake for authentic recordings of real persons.
• Breaches of Article 50 transparency duties carry fines of up to EUR 15 million or, for companies, up to 3% of global annual turnover (Article 99(4)).

The high-risk AI system rules (which cover many biometric surveillance systems) arrive on 2 December 2027 for the Annex III use cases, and on 2 August 2028 for AI built into regulated products under Annex I. Those dates were 2 August 2026 and 2 August 2027 until Regulation (EU) 2026/1744, the July 2026 Digital Omnibus on AI, moved them.

Domestic Criminal Law Interaction

The EU AI Act does not supersede Croatian criminal law. Creating or altering a sexually explicit recording of a real person, including with AI, and using it as real is a crime under Article 144a(2) of the Criminal Code where it violates the privacy of the person shown, with up to three years in prison if it spreads through a computer network or to many people. A non-sexual fake that falsely depicts a person saying something they never said may raise defamation issues, and either kind of fake can also engage AI Act Article 50 transparency duties.

From 2 December 2026, the AI Act also bans, subject to conditions set out in a new Article 5(1a), placing on the market, putting into service or using AI systems that generate or manipulate realistic images, videos or audio of an identifiable person's intimate parts, or of an identifiable person engaged in sexually explicit activities, without that person's explicit consent. This new Article 5(1)(ba) was added by Regulation (EU) 2026/1744.

Practical Implications for Businesses in Croatia

Any Croatian or foreign business using AI tools to generate synthetic audio or video content depicting Croatian residents must implement disclosure mechanisms compliant with Article 50. Tools that generate meeting summaries, voice clones, or video avatars fall within the scope of these obligations when the output could be mistaken for a real recording.

Recording Police and Public Officials

Recording police officers and other public officials performing their duties in Croatia does not benefit from a specific statutory permission. No Croatian law expressly authorizes or prohibits citizens from recording officers during the exercise of their public functions.

The public interest defense in Article 143(4) of the Criminal Code provides the most relevant legal hook for such recordings. A citizen recording a police officer's use of force, for example, could argue that the public interest in accountability outweighs the officer's privacy interest in their conduct while performing official duties. Croatian courts have not established a definitive body of case law on this precise scenario.

Several principles from existing law apply:

• Police officers exercising public powers in public have a reduced expectation of privacy in their official conduct under the proportionality principle derived from Arts. 35-37 of the Constitution.
• Words spoken by an officer in a purely public context (public address, announcements) are not "privately spoken" within the meaning of Article 143 and do not attract criminal protection.
• Words spoken by an officer in what they reasonably believe to be a private communication (e.g., speaking quietly to a colleague) retain the Article 143 protection.
• A recording made purely to harass or intimidate an officer without any genuine accountability purpose would not qualify for the Article 143(4) defense.

Anyone relying on the public interest defense should document the accountability purpose of the recording before relying on it as a defense.

The safest practical approach: in any situation involving police, be transparent that you are recording, state that you are doing so in the public interest, and stop recording if ordered to do so by a court order or lawful directive (not merely a preference of the officer).

Law Enforcement and Lawful Interception

Croatian law provides a framework for lawful interception of communications by law enforcement, but only under strict judicial oversight governed by the Criminal Procedure Act (Zakon o kaznenom postupku).

Under Article 332 of the Criminal Procedure Act, the investigating judge (sudac istrage) may, on the State Attorney's written reasoned request, order special evidentiary actions, including monitoring and recording of telephone calls and other remote communications. This is allowed only for the offenses listed in Article 334 of the Act, and only where the inquiry could not be carried out in another way, or only with disproportionate difficulty.

Key requirements include:

• Judicial authorization: The investigating judge orders the measure in a written, reasoned order. In urgent cases the State Attorney may issue an order valid for 24 hours, which the judge then reviews.
• Prosecutorial request: The interception must be requested by the State Attorney (Drzavno odvjetnistvo) and conducted in accordance with instructions from both the State Attorney and the courts.
• Proportionality: The surveillance must be proportionate to the seriousness of the crime under investigation.
• Time limits: Authorization is granted for a specific period and must be renewed if the investigation requires continued surveillance.

Civil Liability and Damages

Unauthorized recording in Croatia creates civil liability alongside any criminal exposure.

Under GDPR Article 82, any person who suffers material or non-material damage as a result of a GDPR violation has the right to receive compensation from the controller or processor responsible. Croatian courts have not yet issued judicial guidelines establishing quantum ranges for GDPR-related damages. No minimum threshold of seriousness applies before compensation becomes available; even non-material harm, such as distress caused by discovering that a private conversation was recorded, can ground a claim.

Beyond GDPR, the general civil law framework under the Zakon o obveznim odnosima (Law on Obligations) provides a basis for claiming non-material damages for violations of personality rights including privacy. A claimant who proves unauthorized recording damaged their reputation, caused emotional distress, or exposed private information can seek compensation under this framework independently of the GDPR route.

Criminal proceedings and civil damages claims can run in parallel. A person convicted of an Article 143 offense may simultaneously face a civil damages claim by the victim. The victim may also join the civil claim to the criminal proceeding as a party through the Croatian system of adjunctive claims (imovinskopravni zahtjev u kaznenom postupku), which avoids the need to file a separate civil suit.

Penalties Summary

Croatia imposes the following penalties for unauthorized recording:

These penalties can apply concurrently. A person who secretly records a private conversation and then shares it publicly could face criminal prosecution under Article 143, an administrative fine from AZOP under the GDPR, and a civil damages claim from the recorded person.

Business Compliance for Recording in Croatia

Businesses operating in Croatia that record communications or conduct surveillance must establish comprehensive compliance frameworks spanning criminal law, GDPR, and sectoral regulation.

Call Recording

Businesses that record customer or employee phone calls must:

• Identify a valid legal basis under GDPR Article 6(1) before beginning any recording
• Inform callers clearly and prominently at the start of the call that the conversation is being recorded
• State the purpose of the recording (quality assurance, compliance, training, dispute resolution)
• Define and document a retention period for all recordings
• Involve the Data Protection Officer in decisions about recording practices
• Provide a privacy notice covering all required GDPR Article 13 information
• Implement appropriate security measures to protect recorded data

AZOP has specifically targeted call recording violations, making this a high-priority compliance area.

Video Surveillance for Businesses

Businesses using CCTV or other video surveillance must:

• Display visible signage informing visitors and employees that surveillance is in operation
• Document a purpose for the surveillance (security, safety, asset protection)
• Restrict camera placement to avoid private areas
• Define a retention period, typically no longer than necessary for the stated purpose
• Implement access controls to prevent unauthorized viewing of footage

Cybersecurity Act Obligations for Essential Entities

For telecommunications providers, energy operators, and other entities classified as essential or important under the Cybersecurity Act (NN 14/24), additional obligations apply to the security of communications infrastructure. Essential entities must implement security measures defined in the Cybersecurity Regulation and are subject to supervision by the National Cyber Security Centre (NCSC).

Cross-Border and Eurozone Considerations

Croatian recording laws apply to any recording activity that takes place on Croatian territory or involves data subjects located in Croatia. Croatia joined the Eurozone on 1 January 2023. Financial services firms subject to MiFID II and MiFIR call recording obligations must comply both with those EU-level requirements and with Croatian criminal law consent requirements when recording calls with Croatian clients.

Cross-Border Recording Rules

Recording activities that span borders require analysis at multiple levels.

For tourists and short-term visitors to Croatia, Croatian criminal law applies to recordings made on Croatian territory regardless of the visitor's nationality or residence. A German or American tourist who records a private conversation in Dubrovnik without the other party's consent is subject to Articles 143 and 144 of the Croatian Criminal Code.

For businesses, GDPR's territorial scope extends to any processing of personal data of individuals who are in Croatia, regardless of where the business is established. A US company conducting remote interviews with Croatian applicants and recording those interviews without adequate disclosure is subject to GDPR enforcement by AZOP.

For cross-border calls where one party is in Croatia and the other is abroad, Croatian law applies to the Croatian participant's obligations. The foreign participant's obligations are governed by their own jurisdiction's law. Both sets of rules can apply simultaneously; the more restrictive rule governs the Croatian party's conduct.

The ePrivacy Directive (2002/58/EC), implemented in Croatia through the Electronic Communications Act, applies to confidentiality of electronic communications within the EU regardless of where the communicating parties are physically located, as long as the communications pass through EU networks.

Comparison With Other European Countries

Croatia's all-party consent framework is stricter than many European countries but is not unique within the EU.

Countries like Germany (Section 201 of the Strafgesetzbuch) and Switzerland also require all-party consent for recording private conversations. In contrast, Italy applies a "participation in the dialogue" principle that allows a conversation participant to record without informing the others.

Croatia's criminal penalties are broadly in line with other EU member states. The maximum three-year sentence for basic unauthorized recording is comparable to Germany. The enhanced penalty for public officials (up to five years) reflects Croatia's emphasis on preventing abuse of official power.

The GDPR creates a uniform baseline for administrative enforcement across all EU member states. Under the GDPR's one-stop-shop mechanism, companies whose main EU establishment is in another member state may be primarily supervised by that state's DPA, but AZOP retains jurisdiction over local Croatian data subjects and can act independently in urgent cases.

Practical Tips for Recording in Croatia

Obtain consent from all parties before recording. Croatia is an all-party consent jurisdiction. Recording any private conversation without the knowledge and agreement of everyone involved is a criminal offense under Article 143.

Put consent in writing when possible. For business recordings, written consent or a clearly recorded verbal acknowledgment at the start of a call provides the strongest legal protection.

Update your ECA compliance. The old 2008 Electronic Communications Act was replaced by NN 76/22 in July 2022. If your compliance documentation still references the 2008 Act, update it.

Do not count on the public interest defense. Article 143(4) applies only where the interest a recording served outweighs the privacy of the person recorded, which is decided case by case. Document your purpose before recording.

Businesses must go beyond consent. Even with consent, GDPR requires a documented legal basis, a privacy notice, defined retention periods, and appropriate security measures.

Disclose AI-generated content. From 2 August 2026, EU AI Act Article 50 requires disclosure when audio or video content is AI-generated or substantially manipulated. Systems already on the market before that date have until 2 December 2026 to add the machine-readable marking. Failure to meet Article 50 transparency duties carries fines of up to EUR 15 million or, for companies, up to 3% of global turnover.

Never record in private areas of a workplace. Rest rooms, changing areas, and hygiene facilities are strictly off-limits for any form of surveillance.

Consult a Croatian lawyer for complex situations. The interplay between criminal law, GDPR, the Labour Act, and the AI Act creates nuanced requirements that may require professional legal advice.

Keep recordings secure. Any recording containing personal data must be protected against unauthorized access, loss, or disclosure under GDPR Article 32.

Conclusion

Croatia maintains one of Europe's stricter recording consent frameworks, requiring all-party consent for any recording of private conversations. The Criminal Code backs this requirement with meaningful criminal penalties: up to three years of imprisonment for basic offenses and up to five years when a public official is involved. The 2021 addition of Article 144a (NN 84/21) extended criminal liability to the misuse of sexually explicit recordings, including fabricated ones, addressing a gap that other European jurisdictions have also moved to close in recent years.

The GDPR adds a parallel enforcement layer through AZOP. The agency's 2025 enforcement activity, which reached more than EUR 6.7 million in administrative fines including a single EUR 4.5 million fine against a telecommunications operator, shows that AZOP actively enforces the GDPR. The EU AI Act adds a third layer, with deepfake disclosure obligations effective from 2 August 2026 and the high-risk AI rules arriving on 2 December 2027 for Annex III use cases and 2 August 2028 for AI in regulated products.

For individuals, the message is clear: never record a private conversation in Croatia without the consent of everyone involved. For businesses, compliance requires building comprehensive frameworks that satisfy criminal law, GDPR, and sectoral requirements simultaneously. Enforcement activity by both prosecutors and AZOP continues to increase, and the addition of AI Act obligations means the compliance landscape will continue to evolve through 2028, when the last block of high-risk rules takes effect.

Frequently Asked Questions

Is it legal to record a phone call in Croatia?

Recording a phone call in Croatia requires the consent of all parties to the conversation. Under Article 143 of the Croatian Criminal Code (Kazneni zakon, NN 125/11 as amended), anyone who unlawfully records privately spoken words of another person faces up to three years of imprisonment. This applies to all forms of telephone communication, including landline, mobile, and VoIP calls. Businesses that record calls must also comply with GDPR requirements, including providing a valid legal basis, informing callers about the recording, defining retention periods, and involving their Data Protection Officer.

What are the penalties for illegal recording in Croatia?

Unauthorized audio recording of private conversations carries up to 3 years of imprisonment under Article 143(1) of the Criminal Code. Disseminating or using such recordings also carries up to 3 years under Article 143(2). If a public official commits the offense while performing official duties, the penalty increases to 6 months to 5 years of imprisonment under Article 143(3). Misusing sexually explicit recordings, including sharing a consensually made one or creating a fake one used as real, carries up to 1 year under Article 144a, or up to 3 years when the recording spreads through a computer network or to many people. GDPR violations related to recording can result in administrative fines of up to EUR 20 million or 4% of annual global turnover, with civil damages claims also available under GDPR Article 82.

Can an employer record employees at work in Croatia?

Employers in Croatia may install video surveillance cameras in the workplace under specific conditions: compliance with occupational health and safety law, informing employees in advance, written notice at hiring, and works council consent where cameras keep workers in view throughout their working time. Surveillance must never cover rest areas, changing rooms, or hygiene facilities. Audio recording of employee conversations without consent is prohibited under the Criminal Code regardless of the workplace context. AZOP's EUR 190,000 fine on a Rijeka-area special hospital in September 2024 covered a series of GDPR violations, including recording call center conversations without a demonstrated legal basis and without informing callers.

Does Croatia have a public interest exception for recording?

Yes. Article 143(4) of the Criminal Code provides that no criminal offense arises if the recording was undertaken in the public interest or in another interest that predominates over the privacy interest of the recorded person. Whether that interest outweighs the privacy of the person recorded is decided case by case. Offenses under Article 143(1) and (2) are also prosecuted only on the victim's motion. The defense is not a general license to record whenever the subject matter seems important.

How does GDPR affect recording laws in Croatia?

As an EU member state, Croatia is subject to the GDPR, which treats any recording of an identifiable person as processing of personal data. Recorders must identify a valid legal basis, inform data subjects about the recording and its purpose, define retention periods, and implement security measures. The Croatian data protection authority AZOP actively enforces these requirements, imposing more than EUR 6.7 million in administrative fines in 2025, including fines on a telecom operator and a bank.

Can I film police officers in Croatia?

No Croatian statute expressly permits or prohibits filming police. Recording a police officer who is publicly performing official duties may be defensible under the public interest exception in Article 143(4) of the Criminal Code, because accountability for the exercise of public power is a recognized public interest. However, Croatian courts have not issued definitive rulings on this scenario. Words spoken by an officer in a public context (announcements, public-facing instructions) are not privately spoken and fall outside Article 143 entirely. The safest approach is to be transparent about recording, state your accountability purpose, and stop if directed by a lawful court order.

What are Croatia's rules on deepfakes and AI-generated recordings?

The EU AI Act (Regulation (EU) 2024/1689) applies in Croatia as in all EU member states. Article 50 requires that AI-generated or substantially AI-manipulated audio and video content (deepfakes) be disclosed as such from 2 August 2026, a date the July 2026 Digital Omnibus left in place. Real-time remote biometric identification of individuals in public spaces by law enforcement is prohibited under Article 5 since 2 February 2025, with narrow exceptions. Penalties for violating prohibited practices reach EUR 35 million or 7% of global annual turnover. Under Croatian criminal law, creating or altering a sexually explicit recording, including with AI, and using it as real is an offense under Article 144a(2) of the Criminal Code, and sharing genuine private recordings can fall under Articles 143 and 144. From 2 December 2026, the AI Act also bans, subject to conditions, AI systems used to generate non-consensual intimate or sexually explicit imagery of identifiable people (Article 5(1)(ba)).

Does Croatian recording law apply to tourists and foreign visitors?

Yes. Croatian criminal law applies to recordings made on Croatian territory regardless of the recorder's nationality or country of residence. A foreign tourist who secretly records a private conversation in Croatia commits an offense under Article 143 of the Croatian Criminal Code. GDPR also applies to the processing of personal data of individuals who are in Croatia, regardless of where the business or individual processing the data is established. Foreign businesses recording calls with Croatian clients or applicants must comply with both the Criminal Code and GDPR requirements.