Croatia

Croatian Insurance Bureau

101,000 €

GDPR enforcement action by Croatian Data Protection Authority (azop) on 2025-07-02.

Rank · Sector

#41

of 357 in Public Sector and Education

Rank · Croatia

#12

of 43

Rank · All fines

#459

of 3,050

Case details

Authority: Croatian Data Protection Authority (azop)
Date: 2025-07-02
Controller / Processor: Croatian Insurance Bureau
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) e) GDPR, Art. 32 (2), (4) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Croatian DPA has imposed a fine of EUR 101,000 on the Croatian Insurance Bureau. The controller failed to implement sufficient technical and organisational measures to ensure data security, resulting in the leak of the personal data from over a million vehicle owners. In determining the amount of the fine, the DPA took into account, that according to local regulations, fines imposed on public entities must not jepordice the fined entity's performance.

Open original source Links to the regulator's original publication or another source.