The Croatia Whistleblower Protection Act

Croatia Whistleblower Protection Law overview

Croatia enacted amendments to the country’s existing whistleblower protection laws in April 2022. Those amendments transposed the EU Whistleblower Protection Directive’s requirements into Croatian law. Formally known as the Whistleblower Protection Act, the law consolidates whistleblower protections that previously existed across numerous other Croatian laws, but had never been codified in a single statute. It expands the scope of the EU Directive to protect not just reports of breaches of Union law, but also Croatian national law and unethical behavior.

The Whistleblower Protection Act covers all organizations with at least 50 employees (including both full- and part-time employees), as well as government agencies and private organizations that receive public funding, such as those operating in healthcare, education or transportation. 

The law requires employers to establish internal reporting channels and to provide training to employees on the protection of whistleblowers. Employers must also appoint a person or department responsible for receiving and processing reports of wrongdoing. The law protects whistleblowers and those assisting them from retaliation for submitting a report, and allows them to report their concerns through external channels (primarily the national Ombudsman) as well.

What does the Croatian Whistleblower Protection Act cover?

The Act adopts the minimum standards for whistleblower protection outlined in the EU Whistleblower Protection Directive. These requirements include: 

• A secure and confidential channel for receiving whistleblower reports must be in place. 
• Acknowledgment of the receipt of every whistleblowing report must be provided to the whistleblower within seven days. 
• An impartial person or department must be appointed to follow up on the reports.
• Records must be kept of every report received in compliance with confidentiality requirements. 
• There must be diligent follow-up of the report by the designated person or department. 
• Feedback on the follow-up or investigation must be given to the whistleblower within three months of receiving the report. 
• All processing of personal data must be done in accordance with GDPR

All covered business must meet the following basic requirements

The Act requires all covered businesses to 

1. Set up a whistleblowing channel with comprehensive whistleblower protection
2. Adopt a policy on reporting legal violations and other misconduct
3. Designate a “person of confidence” who can receive internal reports.

Confidentiality, retaliation and disclosures

The whistleblower protections include confidentiality, a prohibition against retaliation and no liability for disclosing necessary information to the report. The law also provides whistleblowers the right to legal assistance and emotional support. 

The “person of confidence” who receives internal reports can be either a direct employee of the company, such as an HR or compliance officer; or an outside third party such as a service provider. In all cases, the person of confidence must protect the whistleblower’s identity and other personal information at all times

Anonymous report intake and management

The Croatian whistleblower law requires that all whistleblower reports must include the name of the person submitting the report, the name of the organization discussed in the report, and relevant details about the misconduct being reported. As such, this means the law does not recognize anonymous reports, although the identity of the whistleblower is supposed to be kept confidential. Moreover, if someone does submit a report anonymously and their identity is then later determined anyway, the law’s whistleblower protections will then still cover that formerly anonymous reporter.

What are the risks of non-compliance?

Whistleblowers who suffer retaliation can seek damages against the offending company in court. The company can also be subject to regulatory fines generally ranging from €4,000 to €6,700, and the retaliating manager can be liable for fines of €400 to €4,000 as well.