Croatia Recording Laws: All-Party Consent Rules and Penalties (2026)

Overview of Croatia Recording Laws

Croatia enforces strict all-party consent requirements for recording private conversations. The legal framework protecting the privacy of communications is built on multiple layers: the Croatian Constitution, the Criminal Code (Kazneni zakon), the EU General Data Protection Regulation (GDPR), and the national Act on Implementation of the GDPR.

Anyone who records a private conversation without the consent of all participants faces criminal prosecution under Article 143 of the Kazneni zakon (Criminal Code, Official Gazette No. 125/11, as amended). Croatia treats unauthorized recording as a serious criminal offense against personal privacy, not merely a regulatory violation.

For visitors, residents, and businesses operating in Croatia, understanding these laws is essential. Violations can result in imprisonment, substantial fines under GDPR, and civil liability for damages.

Constitutional Foundation for Privacy

The Croatian Constitution establishes the fundamental right to privacy of communications through several articles.

Article 35 guarantees all citizens respect for and legal protection of personal and family life, dignity, reputation, and honor. This broad privacy protection serves as the constitutional basis for all recording restrictions.

Article 36 is the most directly relevant provision. It states that the freedom and secrecy of correspondence and all other forms of communication are guaranteed and inviolable. Only restrictions necessary for the protection of national security or the conduct of criminal proceedings may be prescribed, and only by law.

Article 37 further guarantees the safety and secrecy of personal data. Without the consent of the person concerned, personal data may only be collected, processed, and used under conditions specified by law. The use of personal data contrary to the purpose of their collection is expressly prohibited.

These three constitutional articles create a strong baseline protection that the Criminal Code and data protection laws build upon. Any law permitting recording must be balanced against these constitutional guarantees, and Croatian courts apply proportionality analysis when evaluating whether a recording violated these rights.

Criminal Code Article 143: Unauthorized Audio Recording and Eavesdropping

Article 143 of the Kazneni zakon (Neovlasteno zvucno snimanje i prisluskivanje) is the primary criminal statute governing unauthorized audio recording in Croatia. It is located in Chapter XIV of the Criminal Code, which covers criminal offenses against privacy.

Paragraph 1: Basic Offense

Anyone who unlawfully makes an audio recording of words spoken in private by another person, or who unlawfully eavesdrops on words spoken in private by another person using special devices not intended for them, faces imprisonment of up to three years.

The key elements of this offense are:

• The words must be privately spoken (nejavno izgovorene rijeci). Public statements, speeches at public events, or statements made in a public forum are not protected.
• The recording or eavesdropping must be unauthorized (neovlasteno). This means it was done without the consent of the person whose words were recorded.
• For eavesdropping specifically, the perpetrator must use special devices (posebne naprave) to intercept words not intended for them.

This paragraph criminalizes both the act of recording and the act of listening in. You do not need to make a permanent recording to commit this offense. Simply using a device to listen to a conversation you are not part of is sufficient.

Paragraph 2: Dissemination of Recordings

The same penalty of up to three years of imprisonment applies to anyone who uses the recorded words, makes them available to a third party, or publicly states the eavesdropped words verbatim or in their essential features.

This means that even if you did not make the original recording, you can face criminal liability for:

• Playing a recording for someone else
• Sharing a recording file through any medium
• Publishing the content of an eavesdropped conversation
• Repeating the substance of what was overheard to others

Paragraph 3: Official Misconduct Enhancement

If a public official (sluzbenica osoba) commits the offense described in paragraphs 1 or 2 in the course of performing official duties or exercising public authority, the penalty increases to imprisonment from six months to five years.

This enhanced penalty targets government employees, police officers, and other officials who abuse their positions to conduct unauthorized surveillance. The minimum sentence of six months reflects the heightened trust placed in public officials and the greater harm caused when that trust is violated.

Paragraph 4: Public Interest Defense

There is no criminal offense if the actions described in paragraphs 1 and 2 were undertaken in the public interest or in another interest that is predominant over the interest of protecting the privacy of the recorded or eavesdropped person.

This defense is narrowly interpreted by Croatian courts. It does not give blanket permission to record whenever someone believes the information is important. The court must weigh the specific public interest served by the recording against the privacy rights of the person recorded. Situations where this defense has been recognized include:

• Documenting serious criminal activity
• Gathering evidence of corruption by public officials
• Protecting against imminent threats to safety

The burden of proving that the public interest outweighs the privacy interest falls on the person who made the recording.

Article 144: Unauthorized Visual Recording

Article 144 (Neovlasteno slikovno snimanje) addresses unauthorized visual recording, including photography and video. While the penalties differ slightly from audio recording, the structure is similar.

Unauthorized visual recording of a person in their private space or private life carries imprisonment of up to one year for the basic offense. If the images are shared with third parties or made public, the penalty increases to up to three years.

As with audio recording, the offense requires that the recording be unauthorized and that the subject had a reasonable expectation of privacy. Photographing or filming someone in a public place engaged in public activities generally does not fall under this provision.

Phone Call Recording Laws

Recording telephone conversations in Croatia follows the same all-party consent framework established by Article 143. Because phone calls are considered private communications, all parties to the call must consent to the recording.

If you are a participant in a phone call and you record it without telling the other person, you are committing a criminal offense under Croatian law. This applies whether the call is made from a landline, a mobile phone, or through a Voice over Internet Protocol (VoIP) service.

The Electronic Communications Act (Zakon o elektronickim komunikacijama) provides additional protections for telecommunications. Service providers are required to ensure the confidentiality of communications transmitted through their networks. Interception of communications content is prohibited except where authorized by law.

For businesses that record customer calls, the GDPR adds further requirements beyond criminal law consent. Under GDPR Article 6(1), the business must identify a valid legal basis for processing the personal data contained in the call recording. AZOP has specifically enforced this requirement, as demonstrated by enforcement actions against organizations that recorded calls without proper legal basis.

In-Person Conversation Recording

Recording face-to-face conversations in Croatia carries the same legal requirements as recording phone calls. All participants must consent to the recording for it to be lawful.

The concept of "privately spoken words" (nejavno izgovorene rijeci) is central to understanding when Article 143 applies to in-person conversations. Words are considered privately spoken when they are directed to a specific person or group in circumstances where the speaker has a reasonable expectation that only the intended audience will hear them.

Examples of privately spoken words include:

• A conversation between two people in a private office
• A discussion at a dinner table among friends
• A consultation between a client and a professional
• A phone call in any setting

Conversations in the following contexts are generally not considered "privately spoken":

• Public speeches or presentations
• Statements made at public meetings or government proceedings
• Comments shouted in a public space where anyone can hear

The distinction matters because Article 143 only applies to privately spoken words. Recording a politician's speech at a public rally, for example, would not trigger criminal liability under this article.

Workplace Recording and Surveillance

Croatia regulates workplace recording through the intersection of criminal law, labor law, and data protection law. Employers face specific obligations when implementing any form of workplace monitoring.

Video Surveillance

The Act on Implementation of the GDPR (Zakon o provedbi Opce uredbe o zastiti podataka, Official Gazette No. 42/18) contains specific provisions for workplace video surveillance. Employers may install video surveillance cameras only if the following conditions are met:

• The surveillance complies with the Law on Occupational Health and Safety
• Employees have been informed in advance about the surveillance
• A written notice was provided to employees before the decision to install the system
• The surveillance does not cover premises intended for resting, personal hygiene, or changing clothes

Works Council Requirements

Employers who wish to monitor employees at work must obtain the approval of their works council (radnicko vijece). If the works council or trade union representative does not consent, the employer can seek a decision from an arbitration tribunal.

Additionally, employers are obligated to give written notice about workplace surveillance to workers at the time of hiring. This requirement ensures that employees are aware of monitoring practices from the start of their employment.

Audio Recording Restrictions

Audio recording in the workplace is subject to the same criminal law restrictions as any other private recording. An employer who records employee conversations without consent can face prosecution under Article 143. The workplace does not create an exception to the all-party consent requirement.

AZOP has enforced this principle directly. In a notable 2024 enforcement action, a hospital in the Rijeka area received a EUR 190,000 fine for, among other violations, recording telephone conversations through its call center without demonstrating a valid legal basis (violating GDPR Articles 6(1) and 5(2)), failing to inform data subjects about the recording (violating GDPR Articles 12(1) and 13), not defining retention periods for recordings (violating GDPR Article 5(1)(e)), and not involving the Data Protection Officer in the matter (violating GDPR Article 38(1)).

Data Security for Recordings

Employers who conduct any authorized recording or surveillance are prohibited from broadcasting the footage and must prevent unauthorized access to it. However, employers are required to allow access to authorized inspectors and regulatory authorities.

GDPR and Data Protection Framework

As an EU member state, Croatia is subject to the General Data Protection Regulation (GDPR), which adds a comprehensive layer of data protection requirements on top of criminal law.

AZOP: The Supervisory Authority

The Croatian Personal Data Protection Agency (Agencija za zastitu osobnih podataka, or AZOP) is the national supervisory authority responsible for monitoring the application of the GDPR and the Act on Implementation of the GDPR. AZOP has the power to investigate complaints, conduct audits, and impose administrative fines for GDPR violations.

AZOP has demonstrated increasing enforcement activity. In 2025, the agency imposed a series of penalties totaling nearly EUR 7 million across sectors ranging from telecommunications and banking to energy production and insurance. The largest single fine in 2025 was EUR 4.5 million imposed on a telecommunications operator for violations including transfer of personal data to third countries without a valid transfer instrument, lack of transparency to data subjects, and processing of employee identity cards and criminal records without legal basis.

Recording as Data Processing

Any recording of a person constitutes processing of personal data under the GDPR. This means that even where criminal law consent has been obtained, the recorder must also comply with GDPR requirements:

• Legal basis (Article 6): The recorder must identify a valid legal basis for processing, such as consent, legitimate interest, or legal obligation.
• Transparency (Articles 12-13): Data subjects must be informed about the recording, its purpose, the legal basis, retention period, and their rights.
• Purpose limitation (Article 5(1)(b)): Recordings may only be used for the specific purpose for which they were collected.
• Storage limitation (Article 5(1)(e)): Recordings must not be kept longer than necessary for their stated purpose.
• Security (Article 32): Appropriate technical and organizational measures must be in place to protect recorded data.

GDPR Fines

GDPR violations related to recording can result in administrative fines of up to EUR 20 million or 4% of annual global turnover, whichever is higher. AZOP has shown a willingness to impose significant fines, and the European Data Protection Board has identified transparency as a central enforcement priority for 2026.

Recording in Public Spaces

Recording in public spaces in Croatia occupies a gray area between criminal privacy protections and practical freedom.

Article 143 specifically protects "privately spoken words." Conversations held in public where the speakers make no effort to keep their words private may not be protected under this provision. However, the analysis is fact-specific. Two people having a quiet conversation on a park bench may still have a reasonable expectation of privacy even though they are in a public space.

Photography and video recording in public spaces are generally permitted when they capture public activities and do not target specific individuals in a way that invades their privacy. However, GDPR obligations still apply if the recording captures identifiable individuals.

Recording police officers and public officials performing their duties in public has not been specifically addressed by Croatian statute. The public interest defense in Article 143(4) could potentially apply to recordings that document official misconduct, but this has not been tested extensively in Croatian courts. The safest approach is to exercise caution and understand that recording anyone without consent in Croatia carries legal risk.

Law Enforcement and Lawful Interception

Croatian law provides a framework for lawful interception of communications by law enforcement, but only under strict judicial oversight.

The Criminal Procedure Act (Zakon o kaznenom postupku) governs special investigative measures, including interception of communications. Under Article 332 of the Criminal Procedure Act, special evidentiary actions may be authorized for serious criminal offenses, including crimes against the Republic of Croatia, crimes against values protected by international law, sexual offenses, and other offenses carrying a prison sentence of five or more years.

Key requirements for lawful interception include:

• Judicial authorization: A judge must approve the interception. Police are not empowered to conduct interception of communications content independently.
• Prosecutorial request: The interception must be requested by the State Attorney (Drzavno odvjetnistvo) and conducted in accordance with instructions from both the State Attorney and the courts.
• Proportionality: The surveillance must be proportionate to the seriousness of the crime under investigation.
• Time limits: Authorization is granted for a specific period and must be renewed if the investigation requires continued surveillance.

The Croatian Supreme Court addressed the admissibility of secretly recorded conversations in a landmark ruling involving the former Mayor of Zagreb, Milan Bandic. The Court ruled that secretly recorded telephone calls and text messages were legally admissible when proper judicial authorization had been obtained during the investigation, overturning a lower court decision that had deemed the evidence illegally obtained.

Penalties Summary

Croatia imposes the following penalties for unauthorized recording:

Offense	Penalty	Legal Basis
Unauthorized audio recording of private words	Up to 3 years imprisonment	Criminal Code Art. 143(1)
Eavesdropping using special devices	Up to 3 years imprisonment	Criminal Code Art. 143(1)
Disseminating or using unauthorized recordings	Up to 3 years imprisonment	Criminal Code Art. 143(2)
Unauthorized recording by a public official	6 months to 5 years imprisonment	Criminal Code Art. 143(3)
Unauthorized visual recording in private settings	Up to 1 year imprisonment	Criminal Code Art. 144
Disseminating unauthorized visual recordings	Up to 3 years imprisonment	Criminal Code Art. 144
GDPR violations related to recording	Up to EUR 20 million or 4% of global turnover	GDPR Art. 83

These penalties can apply concurrently. A person who illegally records a conversation and then publishes it could face both criminal prosecution under Article 143 and administrative sanctions under the GDPR.

Business Compliance for Recording in Croatia

Businesses operating in Croatia that record communications or conduct surveillance must establish comprehensive compliance frameworks.

Call Recording

Businesses that record customer or employee phone calls must:

• Identify a valid legal basis under GDPR Article 6(1) before beginning any recording
• Inform callers clearly and prominently at the start of the call that the conversation is being recorded
• State the purpose of the recording (quality assurance, compliance, training, dispute resolution)
• Define and document a retention period for all recordings
• Involve the Data Protection Officer in decisions about recording practices
• Provide a privacy notice that covers all required GDPR Article 13 information
• Implement appropriate security measures to protect recorded data

AZOP has specifically targeted call recording violations in enforcement actions, making this a high-priority compliance area.

Video Surveillance for Businesses

Businesses using CCTV or other video surveillance must comply with the Act on Implementation of the GDPR, which requires:

• Visible signage informing visitors and employees that surveillance is in operation
• A documented purpose for the surveillance (security, safety, asset protection)
• Restriction of camera placement to avoid private areas
• A defined retention period, typically no longer than necessary for the stated purpose
• Access controls to prevent unauthorized viewing of footage

Cross-Border Considerations

For multinational businesses, Croatian recording laws apply to any recording activity that takes place on Croatian territory or involves data subjects located in Croatia. A foreign company recording calls with Croatian customers must comply with both the Criminal Code and GDPR requirements, regardless of where the company is headquartered.

Comparison With Other European Countries

Croatia's all-party consent framework is stricter than many European countries but is not unique.

Countries like Germany and Switzerland also require all-party consent for recording private conversations. In contrast, countries like Italy allow participant recording under the "participation in the dialogue" principle, meaning one party to a conversation can record it without informing the others.

Croatia's penalties are broadly in line with other EU member states. The maximum 3-year sentence for basic unauthorized recording is comparable to penalties in Germany and Austria. The enhanced penalty for public officials (up to 5 years) reflects Croatia's emphasis on preventing abuse of official power.

The GDPR creates a uniform baseline for data protection enforcement across all EU member states, meaning that GDPR-related penalties for unauthorized recording are consistent regardless of the country within the EU.

Practical Tips for Recording in Croatia

Here are guidelines for staying within the law when recording in Croatia:

• Always obtain consent from all parties. Croatia is an all-party consent jurisdiction. Recording any private conversation without the knowledge and agreement of everyone involved is a criminal offense.
• Put consent in writing when possible. For business recordings, written consent or a clear recorded verbal consent at the start of a call provides the strongest legal protection.
• Understand the public interest defense is narrow. Do not rely on the public interest exception unless the circumstances clearly involve serious misconduct or imminent danger.
• Businesses must go beyond consent. Even with consent, GDPR requires a documented legal basis, a privacy notice, defined retention periods, and appropriate security measures.
• Never record in private areas of a workplace. Rest rooms, changing areas, and hygiene facilities are strictly off-limits for any form of surveillance.
• Consult a Croatian lawyer for complex situations. The interplay between criminal law, GDPR, and labor law creates nuanced requirements that may require professional legal advice.
• Keep recordings secure. Whether authorized or not, any recording containing personal data must be protected against unauthorized access, loss, or disclosure.

Conclusion

Croatia maintains one of Europe's stricter recording consent frameworks, requiring all-party consent for any recording of private conversations. The Criminal Code backs this requirement with meaningful penalties, including up to three years of imprisonment for basic offenses and up to five years when a public official is involved. The GDPR adds another enforcement layer through AZOP, which has demonstrated a willingness to impose multi-million-euro fines for data processing violations including unauthorized recording.

For individuals, the message is clear: never record a private conversation in Croatia without the consent of everyone involved. For businesses, compliance requires not just obtaining consent but building comprehensive data protection frameworks that satisfy both criminal law and GDPR requirements. Anyone operating in Croatia should take these obligations seriously, as enforcement activity by both prosecutors and AZOP continues to increase.