I have cameras in my premises: what must I do?

Cameras may record only rooms, parts of rooms and the outside surface of the building where necessary to protect people and property, never public areas. At the entrance, before entering the recorded area, there must be a sign with a picture and text: that the area is under video surveillance, who the controller is and a contact for data subject rights. Recordings are kept for 6 months at most, only authorised people may access them, with an automatic log of who accessed them and when. Employees must be informed in advance; rest, hygiene and changing rooms are not recorded. Checked by AZOP.

Who must?

Every business with cameras in Croatia: bar, shop, salon, office, yard.

What to do?

1. Put a sign at every entrance to the recorded area: camera pictogram + "area under video surveillance", controller name, contact (art. 27).
2. Set the system to delete recordings after 6 months at most (art. 29) and to log every access: time, place, who (art. 28(4)).
3. Inform employees in writing before installing and respect the safety-at-work rules (art. 30); check camera angles: not public areas (art. 32), not neighbours (AZOP guidance), not rest and changing rooms (art. 30(2)).

Where to file?

Nothing is filed, no permit is needed; the sign and the access log stay with you.

Who checks?

AZOP (Croatian Personal Data Protection Agency)

Fine

Administrative fine up to 50,000 kuna (about 6,636 €) for an unmarked area, no access log or use of recordings against the purpose (Croatian GDPR Implementation Act art. 51; the text is still in kuna). Other breaches fall under the GDPR amounts (art. 83).

What if I am already late?

Print the sign today (generator below), set the deletion period in the recorder; it is an hour of work.