The Personal Data Protection Agency (AZOP), the Croatian supervisory authority, has published guidelines on the certification mechanisms provided for by the GDPR, clarifying their scope, benefits, and associated procedures.

Certification is a voluntary process allowing controllers and processors to demonstrate the compliance of their specific processing operations with the requirements of the GDPR, in accordance with Article 42 and Article 43. A certificate, valid for a maximum of three years, does not cover an entire organization but only the evaluated operations, products, or services. It does not reduce the legal liability of the entity but may be taken into account by the supervisory authority when imposing sanctions, under Article 83, paragraph 2, point j). There are two types of mechanisms: national mechanisms, approved by the national supervisory authority after consultation with the European Data Protection Board (EDPB), and the European Data Protection Seal, approved directly by the EDPB for recognition throughout the European Union.

AZOP specifies that to date, no national certification mechanism has been approved in Croatia and the Croatian Accreditation Agency (HAA) has not accredited any certification bodies. Croatian organizations wishing to obtain certification must therefore turn to a European Data Protection Seal and contact a certification body accredited in another Member State, provided that it is authorized to provide its services in Croatia. ISO-type certificates are not considered certifications within the meaning of the GDPR, unless issued under an approved mechanism. Similarly, certification can only serve as a tool for data transfers to third countries if the mechanism has been specifically approved for this purpose, in accordance with Article 46, paragraph 2, point f).