On this page
Check the actual company, not its group name
AZOP’s 2023 explanation points to the public participant list. The reviewed Commission adequacy list has the same qualification: establish the receiving legal entity, participation and covered data. No organisation’s certification was checked here.
For a Zagreb business using both an American affiliate and a software provider, each recipient needs its own assessment. The provider’s marketing assurance does not establish the affiliate’s route, or the other way round.
If participation does not cover it, assess another route
AZOP discusses other Chapter V tools and safeguards where relevant adequacy does not apply. Assess the actual route, its conditions and any additional measures before relying on it. Purposes, access, contracts, security, information to people and onward disclosures still matter.
Scope
- AZOP’s general article was updated 6 September 2022, before the July 2023 framework; it remains historical context, not exclusive current advice. Croatian interpretation was AI-assisted. No actual transfer or full GDPR review is completed.
Next step
Identify the actual U.S. recipient and assess its relevant participation or another applicable transfer route before access.
Sources & review notes
Croatian Personal Data Protection Agency (AZOP)
Passage, dates and research notes
official-guidance · Chapter V explanation and historical Schrems II / Privacy Shield account
Ažurirano: 6.9.2022.
Actual full body read. This page expressly predates the July 2023 framework and cannot by itself establish present U.S. transfer options. Current 2026 related-news widgets do not update the 2022 article body. Used only as historical context with later AZOP guidance and the live Commission list. Croatian interpreted with AI assistance.
Croatian Personal Data Protection Agency (AZOP)
Passage, dates and research notes
official-guidance · Scope of participating U.S. organizations; questions 1, 3 and 6–7
poduzećima iz SAD-a koja sudjeluju u okviru za zaštitu podataka između EU-a i SAD-a.
Actual country-regulator article read, including participating-organization scope, certification and the public-list check. Its account is from 2023 and was corroborated against the live Commission adequacy list. No actual company certification or subsequent litigation survey is claimed. Croatian interpreted with AI assistance.
European Commission
Passage, dates and research notes
official-guidance · Current adequacy list: United States limited to participating commercial organizations
(commercial organisations participating in the EU-US Data Privacy Framework)
Actual current page read, including its qualified U.S. list entry and later review references. This shared EU source corroborates the country-regulator account; it is not counted as an independent Croatian-specific rule or as a specific recipient check.
Detailed rule records (1)
Establish the actual data recipient and a current GDPR Chapter V transfer route. AZOP’s later 2023 explanation limits the EU-U.S. adequacy route to participating U.S. organizations, corroborated by the Commission’s live list. The 2022 Privacy Shield discussion is historical and does not by itself state all present U.S. transfer options.
AZOP third-country transfer guidance, updated September 6, 2022 AZOP: July 10, 2023 adoption of the EU-U.S. adequacy decision Data protection adequacy for non-EU countriesKeep this reading in your learning library.
Progress privacy
Off by default. Without remembering, changes last on this page. If enabled, only public content identifiers and self-reported progress are stored in this browser profile. Anyone using the same profile could see them. No plan inputs or contact details are included. Reset or export in learning settings.
This is a reading aid, not evidence of disclosure delivery, expertise or legal approval.