Free flow of non-personal data in the European Union
The free flow of data is a fundamental prerequisite for the functioning of the digital single market and the data economy. Data must move freely and without obstacles across borders and across different information systems.
Following the General Data Protection Regulation (GDPR), which ensures that the free flow of personal data is protected and facilitated, Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union continues to remove barriers to the movement of data in the EU.
In order to ensure the free flow of non-personal data within the EU, the Regulation lays down rules concerning data localisation requirements (free storage and processing of data anywhere in the EU), the availability of data for competent authorities (competent authorities cannot be refused access to data on the grounds that they are processed in another Member State) and the transfer of data for professional users (facilitating switching between cloud service providers and transferring data between individual providers).
Localisation requirements in the Republic of Croatia
Member States are obliged to remove any unjustified data localisation requirements laid down in laws/regulations. All justified data localisation requests shall be made publicly available via the National Single Information Point and notified to the European Commission.
According to an analysis of the applicable national legislation in the Republic of Croatia, a data localisation requirement has been laid down in the Decree on organisational and technical standards for connection to the state information infrastructure (official gazette of the Republic of Croatia Narodne novine No 60/2017). As the (new) National Information Infrastructure Act (Narodne novine No 72/2025) entered into force on 1 May 2025, a new decree on the conditions and methods of use of the government information infrastructure will be adopted within six months of the entry into force, removing the data localisation requirement.
National Single Point of Contact
The Ministry of Justice, Public Administration and Digital Transformation shall act as a single point of contact for the application of this Decree.