Croatia

HEP-Toplinarstvo

320,000 €

GDPR enforcement action by Croatian Data Protection Authority (azop) on 2025-07-22.

Rank · Sector

#44

of 167 in Transportation and Energy

Rank · Croatia

of 43

Rank · All fines

#291

of 3,050

Case details

Authority: Croatian Data Protection Authority (azop)
Date: 2025-07-22
Controller / Processor: HEP-Toplinarstvo
Sector: Transportation and Energy
Quoted Articles: Art. 31 GDPR, Art. 32 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Croatian DPA has imposed a fine of EUR 320,000 on HEP-Toplinarstvo. The controller failed to implement sufficient technical and organisational measures to ensure data security. When a data subject requested a new password for the controller's online platform, the controller transmitted the old password rather than a new, temporary password. Additionally, the controller stored their customers' passwords in readable form without encryption. Furthermore, the controller failed to cooperate adequately with the supervisory authority.

Open original source Links to the regulator's original publication or another source.