Croatia interview recording laws: Criminal Code Article 143, the GDPR and AZOP's call-recording fines

Recording a job interview with a candidate in Croatia without their agreement risks a criminal offense. Article 143 of the Criminal Code punishes with up to three years in prison anyone who "without authorization makes an audio recording of the non-publicly spoken words of another," and that part of the article is not limited to words meant for someone else. The GDPR governs the recording and the transcript, Croatia's implementing act adds rules mainly for video surveillance, and the data protection authority, AZOP, has fined organizations for recording phone calls without a legal basis, clear notice or retention periods. Ask before you record. This is the position as of November 2026.

This page adds Croatia to our country series alongside Germany, Austria and Italy. It is for recruiters, agency consultants and hiring managers who interview candidates located in Croatia by video or phone, including from the US. Quotations from Croatian sources are our translations.

Croatia's rules at a glance

Is it a crime to record a job interview in Croatia?

It can be, if the candidate has not agreed. Article 143 of the Criminal Code, headed "unauthorized audio recording and eavesdropping," reads in paragraph 1: "Whoever without authorization makes an audio recording of the non-publicly spoken words of another, or whoever by special devices without authorization eavesdrops on the non-publicly spoken words of another that are not intended for them, shall be punished by imprisonment of up to three years." Only the eavesdropping half requires the words to be "not intended for them." The recording half covers any unauthorized recording of words spoken in private, including in a conversation the recorder takes part in, which is the same structure as section 201 of Germany's Criminal Code (see recording job interviews in Germany). The candidate's agreement is what makes the recording authorized.

The rest of the article matters to recruiters too:

• Sharing (paragraph 2). The same penalty applies to anyone who "uses the recorded words ... or makes them available to a third person." An agency that forwards an interview recording to a client needs the candidate's agreement to that sharing.
• Prevailing interest (paragraph 4). There is no offense where the acts were done "in the public interest or another interest that outweighs the interest in protecting the privacy" of the person recorded. That is a defense for exceptional cases, not a basis for routine interview recording.
• Prosecution (paragraphs 5 and 6). The offenses are prosecuted on the victim's motion, and recordings and devices used are confiscated.

The Constitution sits behind these rules: Article 36 guarantees "the freedom and secrecy of correspondence and of all other forms of communication," and Article 37 guarantees "the security and secrecy of personal data."

What does the GDPR cover, and what does Croatian law add?

The GDPR applies in full to the recording and the transcript: a lawful basis under Article 6, the Article 13 information when the recording starts, data minimization, a retention limit, the candidate's rights, and Article 22 on decisions based solely on automated processing. For the lawful basis, see legitimate interest in recruitment.

Croatia's Act on the Implementation of the General Data Protection Regulation adds rules on biometric data and a chapter on video surveillance, which it allows only for purposes "necessary and justified for the protection of persons and property." Article 30 lets employers use video surveillance of employees only if staff were informed in advance and before the decision to install it. The act has no provision on audio recording or on recruitment, so for interviews the GDPR and Article 143 do the work.

On consent, AZOP's opinion on processing in the employment context says that, because of the dependence in the employment relationship, "it is unlikely that an employee could freely respond to their employer's request for consent," so for most workplace processing the lawful basis "cannot and should not be" consent. A candidate is in a similar position. In practice that means two layers: get the candidate's agreement to the recording itself, which Article 143 requires, and document a separate GDPR basis, such as legitimate interests, for keeping and using it.

What has AZOP decided about recorded phone calls?

Two published decisions involve recorded calls:

• A hospital call center (2024). AZOP fined a special hospital in the Rijeka area 190,000 euros for a series of violations. Among them, it recorded call-center telephone calls "without a legal basis under Article 6(1)" and "did not even know what the legal basis for recording telephone calls was"; it did not inform callers in clear and plain language when the call connected, and its privacy policy did not say calls were recorded; and it "did not properly set retention periods" for the recordings, contrary to Article 5(1)(e) (announcement, September 2024).
• A debt collector (2023). In fining EOS Matrix 5.47 million euros for several violations, including security failures, AZOP also found that it "did not inform data subjects in an understandable and clear way" that telephone calls were recorded. It rejected the argument that health details debtors mentioned on calls could be recorded because they had volunteered them, describing a telephone conversation between two people as "a type of confidential conversation" (announcement, October 2023).

Read together, they are a checklist for interviews: know your legal basis before you press record, say clearly at the start that the call is recorded, set a retention period, and leave out of your notes health or other sensitive details a candidate mentions.

Can candidates get the recording?

Yes. Under Article 15 GDPR the candidate can ask for a copy of their personal data, including a recording or transcript, and Article 12(3) requires an answer within one month, extendable only where the GDPR allows. AZOP's employment opinion also lists the information you must give at collection, including retention periods, transfers outside the EU and the right to complain to AZOP. Our candidate data access requests guide has a workflow.

How long can you keep recordings and transcripts?

We found no Croatian rule that fixes a period for candidate recordings. The hospital decision shows that leaving the period open is itself a breach of the GDPR's storage-limitation principle. Set a period tied to the hiring decision and any dispute window, keep written notes longer than audio if you need a record, document why, and delete on schedule. Our retention policy template gives the structure.

What if you interview a candidate in Croatia from the US?

An employer or agency established in the EU is covered by the GDPR under Article 3(1); a US company with no EU establishment is covered only where Article 3(2) applies. Article 143 protects the candidate's words wherever the recorder sits, and your own state's law governs your side of the call; see two-party consent states. AZOP's page on transfers to the United States explains that the Commission's adequacy decision of July 10, 2023 covers only organizations on the Data Privacy Framework List; transfers to other US recipients need safeguards such as standard data protection clauses or binding corporate rules.

Can you use AI note takers or transcription?

Yes, with the candidate's agreement, notice of the tool, a processor contract and short retention. AZOP's recommendation on large language models (May 2026) names the risk directly: "a particular problem arises when an employee enters into such a tool data of ... job candidates ... without a clear legal basis, without informing the data subjects and without a contractually regulated relationship with the AI service provider." It tells organizations to check the terms of use, privacy settings, retention, the location of processing and whether data may be used to train the model. Its recommendation on Article 22 names automated CV filtering and candidate ranking as risky and adds that "human review must be real: the authorized person should understand the system's limitations, consider the relevant circumstances and be able to change the outcome." A tool that scores candidates is also likely to be high-risk under the EU AI Act. Interview Signal, for example, runs on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews in Croatia

Prije nego što počnemo: želio/željela bih [snimati naš razgovor /
koristiti program koji razgovor pretvara u tekst] kako bih točno
zabilježio/zabilježila Vaše odgovore. [Snimku / Zapis] koristit ćemo
samo u ovom postupku odabira, podijelit ćemo ga samo s [klijentom /
voditeljem zapošljavanja] i obrisati [rok] nakon završetka postupka.
Pristajete li? Možete odbiti ili me u bilo kojem trenutku zamoliti da
prekinem, bez ikakvih posljedica za Vašu prijavu.

(Before we start: I'd like to [record our conversation / use software
that turns the conversation into text] so I capture your answers
accurately. We'll use the [recording / notes] only in this selection
process, share them only with [client / hiring manager] and delete
them [period] after the process ends. Do you agree? You can say no or
ask me to stop at any time, with no consequences for your
application.)

The sharing line reflects Article 143(2). Put the same information, with the Article 13 GDPR details, in the invitation and your candidate privacy notice. More wording is in the interview recording consent script.

Checklist before you record interviews in Croatia

• Candidate's agreement obtained before recording or live transcription starts, and noted.
• Agreement covers any sharing with a client or colleague who was not on the call.
• GDPR basis documented; recording announced clearly at the start; privacy notice mentions it.
• Retention period set and followed; sensitive details left out of notes.
• No candidate data in public AI chatbots; vendor contract checked for retention, location and training use.
• Real human review of any automated score; EU AI Act duties checked.
• US vendors on the Data Privacy Framework List or covered by standard data protection clauses.

Interviewing elsewhere in the region? Compare Bulgaria, Austria and the Czech Republic.