CCTV at a rental property in Croatia: GDPR, signage and where cameras may point (AZOP)

Cameras at a holiday rental (apartman za iznajmljivanje) are CCTV (video nadzor) in the legal sense. The rules are in Articles 25 to 32 of Croatia’s Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka, NN 42/2018), in force since 25 May 2018, and AZOP, the Croatian Personal Data Protection Agency, publishes guidance and decisions on them. This is what they mean at a rental.

Where may cameras at a rental property point?

At your own property and nothing else: your entrance, your own stairwell, yard or terrace. The Act reserves the monitoring of public areas, the street included, for public authorities and bodies with public powers, and AZOP’s guide for homes says a private owner may never cover a neighbour’s property or public space.

The starting point is Article 26: cameras are allowed only for a purpose that is necessary and justified to protect people and property, where the interests of the people recorded do not prevail, and only over premises or the outside surface of a building whose monitoring that purpose needs. Article 32 lets only public authorities and bodies with public powers or performing a public service monitor public areas (javne površine), and only where the law provides for it. The European Data Protection Board (EDPB) adds, in its guidelines on video devices, that the household exemption does not cover a system that records continuously and takes in even part of a public space.

AZOP’s guide for private houses and apartment buildings goes further: a camera that turns or is steered from an app must be set so that in no direction of rotation does it see public space or someone else’s property, for example with a software privacy mask (softverska maska privatnosti) that blanks out part of the picture. In a decision published in October 2023, AZOP rejected a complaint about a co-owner’s three cameras: software masks limited their view of the public road and the neighbouring property, they otherwise covered only the owner’s garage approach, staircase and entrance, and a notice was on display.

In a decision of 7 February 2020, AZOP found that two facade cameras of an apartment-rental owner’s six-camera system recorded part of a public street, prohibited that recording and ordered the footage securely deleted within 15 days, although the sign, the 24-day overwrite, the password-protected recorder in a locked cabinet and the written CCTV rules were all in order. In the Old Town’s narrow streets a camera above a front door faces public space almost by default, so its angle and masks are settled on site.

What must the CCTV sign say?

At least three things, with a simple picture: that the area is under video surveillance, who the controller is, and how to contact them to exercise their rights. Under Article 27 the sign must also be visible at the latest as someone enters the recorded area, so it goes before the camera’s view, not inside it.

A sticker with only a camera symbol therefore falls short. AZOP’s forms page offers a free notice template (Obavijest o videonadzoru) and a sample sign, with a template for the legitimate-interest proportionality test. AZOP fines incomplete signs, not only missing ones: ten gambling, hospitality and retail controllers in December 2022, nine of them for signs without required information such as the controller’s identity and contact details; seven hotels, hospitality venues and shops in April 2024; and nine controllers, chiefly shops, in September 2024, for signs that were missing, not visible on entry or incomplete. For minor violations by private individuals, AZOP’s CCTV FAQ says it may issue a warning instead of a fine.

How long may footage be kept, and who may see it?

Six months at most, unless another law requires longer or the footage is evidence in court or similar proceedings. Access is limited to the controller’s responsible person and the people they authorise, and the system must keep an automatic log of who looked at the footage, when and where.

Six months is a ceiling, not a target. The EDPB guidelines say footage should in most cases be erased, ideally automatically, after a few days, and that keeping it beyond 72 hours needs stronger justification; they are EU guidance, while Article 29 sets the Croatian legal limit. For a rental, the useful question is how long it takes you to notice a problem and ask for the footage. The recorder (snimač, NVR) and network storage (mrežna pohrana, NAS) are then sized for that period and set to overwrite automatically.

Article 28 limits access to the controller’s responsible person (odgovorna osoba) and the people they authorise, forbids using footage against the purpose the cameras serve, and gives competent state bodies access within their powers. The system must be protected from unauthorised access, with an automatic log (automatizirani sustav zapisa) of the time and place of each access and of who viewed the footage. In practice that means an account for each viewer rather than one shared password, and phone-app access only for the people who need it. If a camera catches a break-in, AZOP’s guide says the footage goes to the police rather than being published online.

What changes in an apartment building or with staff on site?

Two extra rules. In a residential or mixed building, cameras need the consent of co-owners holding at least two-thirds of the ownership shares, and may cover only the approaches to entrances and exits and the common rooms. Staff you employ must be told in advance, and rest, changing and hygiene rooms are off limits.

Article 31 of the Act also forbids using building cameras to monitor the work of caretakers, cleaners and others working in the building. A host with one flat in a block cannot add a camera on the shared stairwell alone, and AZOP’s guide rules out a camera above a flat’s door that takes in the shared staircase and another flat’s entrance: its view has to be limited to the owner’s property, for example with a privacy mask. Talk to the co-owners (suvlasnici) and the building manager (upravitelj zgrade) first, as for a reader on the shared street door in keyless entry for holiday rentals.

If you employ cleaners or a caretaker, Article 30 allows cameras that cover employees only if the occupational-safety conditions are met and the employees were informed in advance, and never in rooms for rest, personal hygiene or changing. Article 43 of the Occupational Safety Act (Zakon o zaštiti na radu) limits surveillance devices to controlling entry to and exit from work premises and reducing workers’ exposure to robbery, burglary, violence, theft and similar events, and requires each worker to be told in writing at hiring that they will be monitored.

Do dummy cameras and video doorbells count?

A dummy camera does not, because it processes no personal data. A camera that can record does, even with recording switched off: AZOP’s guide treats any camera that can store footage on a memory card, in an app or in the cloud as CCTV. We found no AZOP guidance that names video doorbells, so we apply the general rules.

A doorbell or intercom camera may see your doorstep but not the lane, needs a sign, and keeps footage only as long as the purpose needs. Sound is separate: the guide says a legal basis for video does not extend to audio, which needs its own basis under Article 6 of the GDPR, and that in most cases AZOP finds none, so keep microphone recording off. AZOP also notes that it cannot order cameras to be removed, but it can prohibit recording or restrict the field of view by decision.

How should cameras at a rental be set up?

Cameras aimed and masked so they see only your property, a sign at each way in, a recorder in a locked cabinet with passwords and its access log switched on, a retention period you have chosen, audio off, and remote viewing limited to the people who need it. Most of that is set at installation.

The reason for the cameras, the wording of the sign and the choice of who may view stay with the controller; in the 2020 rental decision, AZOP treated the apartment owner as the controller. Cameras high on an Old Town facade can be fitted from ropes, as facade lighting and cameras in the Old Town explains; cameras, door readers and network cabling are best planned together; and holiday-rental electrical safety covers the owner’s electrical duties.

To plan cameras for a rental, send the address or district, photos of each entrance and whether it is a house or a flat in a block, on WhatsApp, by phone on +385 95 506 8145 or through the quote form, and you receive a written quote or a time for a site visit. What we install is described under CCTV for homes, rentals and venues.