Croatian DPA Fines Zagrebački Holding €25,000 for GDPR Transparency and Identity Verification Failures

Zagrebački Holding violated GDPR by failing to clearly inform users how their ID copies were being processed and by using an inadequate identity verification method when delivering bills via email. These failures breached core GDPR transparency obligations (Articles 13(1)(c) and 13(2)(a/e)) and the data protection by design and by default principle (Article 25(2)). The case highlights that organizations must not only collect data lawfully but must also communicate processing activities clearly and implement proportionate, fit-for-purpose verification mechanisms. Regulators are increasingly scrutinizing everyday operational processes — such as billing and customer onboarding — not just large-scale data breaches. A €25,000 fine and adverse court ruling serve as a reminder that procedural GDPR compliance is enforceable and costly to ignore.

Tactical Insight

Immediate actions

Audit all customer-facing data collection points (forms, emails, portals) to ensure GDPR-compliant privacy notices are present and cover all processing purposes.
Replace or strengthen identity verification procedures for email-based document delivery to meet minimum adequacy standards under GDPR Article 25(2).

Long-term improvements

Embed a Data Protection by Design review into the development and procurement lifecycle for any process that handles personal data or identity documents.
Establish a periodic GDPR compliance review programme covering Articles 13/14 notices across all business units and customer touchpoints.
Train operational and customer-service staff on transparency obligations and the lawful handling of identity documents under GDPR.

Detection & governance measures

Appoint or empower a Data Protection Officer (DPO) to conduct regular internal audits of data processing disclosures and verification workflows.
Implement a compliance monitoring dashboard to track open GDPR obligations, outstanding privacy notice updates, and DPA correspondence.

Framework References

GDPR Article 13(1)(c) — information on purposes and legal basis of processingGDPR Article 13(2)(a) — retention period informationGDPR Article 13(2)(e) — right to lodge a complaint with a supervisory authorityGDPR Article 25(2) — Data Protection by DefaultNIST SP 800-53 PT-2 (Authority to Process Personally Identifiable Information)NIST SP 800-53 PT-5 (Privacy Notice)NIST Privacy Framework PR.PO-P1 (Policies and procedures for data processing transparency)CIS Control 3 — Data ProtectionISO/IEC 29100:2011 — Privacy Framework (Principle 6: Openness, Transparency and Notice)ITIL — Service Design: Information Security and Compliance Management

Source

ThreatNoir coverageUS Zagreb - Us I-4772/2023-10 Read originalUS Zagreb - Us I-4772/2023-10

PublishedAug 14, 2026