Croatia is among Europe’s top tourist destinations, welcoming over 20 million visitors annually. Hotels across cities like Dubrovnik, Split, Zadar, and Zagreb are central to this booming sector, processing enormous volumes of sensitive guest data: full names, passport details, emails, payment information, and even medical preferences. This makes the hospitality sector a high-value target for cybercriminals and regulatory bodies enforcing data protection standards.

The shift to digital solutions — online bookings, mobile check-ins, guest Wi-Fi, and cloud-based PMS (property management systems) — increases efficiency but also exposes vulnerabilities. Yet many hotels in Croatia still rely on outdated security protocols or no dedicated cybersecurity software at all. This leaves them wide open to breaches, ransomware attacks, and GDPR violations.

GDPR Fines: What Hotels Need to Know 

Since the implementation of the General Data Protection Regulation (GDPR) in 2018, every business that processes personal data of EU citizens is legally bound to uphold strict data protection principles. For Croatian hotels, this means ensuring that all guest data is collected lawfully, stored securely, and deleted or anonymized when no longer needed.

Under GDPR, hotels are considered “data controllers” and must:

Provide clear information to guests on how their data will be used

Obtain explicit consent where needed (e.g., marketing)

Ensure data is accessible only to authorized personnel

Implement appropriate technical and organizational measures

Report data breaches to authorities within 72 hours

Failure to comply can result in significant penalties. GDPR fines are divided into two tiers:

Up to €10 million or 2% of annual global turnover

Up to €20 million or 4% of annual global turnover (whichever is higher)

The severity of fines depends on several factors:

Nature, gravity, and duration of the infringement

Whether the breach was intentional or due to negligence

How quickly and effectively the organization responded

Previous compliance history

For hotels, even minor breaches like sending a booking confirmation to the wrong guest or leaving printed guest lists unsecured at the reception desk can trigger investigations and fines. More serious offenses, such as data leaks from poorly secured booking engines, can lead to six-figure penalties.

Additionally, under GDPR, affected individuals have the right to lodge complaints with national data protection authorities. In Croatia, this body is AZOP (Agencija za zastitu osobnih podataka), which actively monitors and enforces compliance.

AZOP has issued multiple fines to businesses in various sectors, including hospitality, for inadequate data protection practices. These fines are often public, leading to reputational damage that can far outweigh the monetary penalty itself.

Cybersecurity software can dramatically reduce these risks by enforcing encryption, managing access control, logging data processing activities, and ensuring that hotels have the systems in place to detect and report breaches swiftly.

Historical Cases: GDPR Fines and Ransomware Attacks on Hotels

Hotels have been particularly vulnerable to data breaches and ransomware attacks over the last decade, with several high-profile cases serving as stark warnings to the industry.

One of the most notable GDPR fines in the hospitality sector was levied against Marriott International. In 2020, the UK’s Information Commissioner’s Office fined Marriott £18.4 million for failing to protect the data of over 300 million guests globally. The breach originated from a system compromise dating back to 2014, which was only discovered in 2018 after GDPR came into force. The leaked information included names, email addresses, phone numbers, passport numbers, and travel details.

Although Marriott is a global chain, the case highlighted the responsibility of all hotels — regardless of size — to audit third-party systems and mergers. Croatian hotels using international booking platforms or cloud PMS systems must ensure their partners are also GDPR compliant.

On the ransomware front, the Romantik Seehotel Jägerwirt attack in Austria is perhaps the most infamous. In 2017, hackers infiltrated the hotel’s IT system and locked guests out of their rooms by taking control of the electronic key system. The hotel was forced to pay a ransom in Bitcoin to restore access. This attack, while occurring before GDPR enforcement, demonstrated how disruptive ransomware can be to guest experience and operations.

More recently, in 2022, a hotel group in Spain faced operational shutdown after a ransomware attack encrypted their PMS and booking records. The hotel had no proper backups and lost weeks of data. Guests had to be manually checked in, and future bookings were lost due to system outages.

The hospitality sector has unique vulnerabilities:

Public Wi-Fi networks often lack encryption and segmentation

Staff turnover can lead to inconsistent training on data handling

Many properties rely on outdated or unsupported software systems

Croatian hotels, especially smaller boutique properties, often outsource IT or operate on limited budgets, making them prime targets for cybercriminals. A single phishing email opened by a receptionist can provide attackers with access to the entire network.

Cybersecurity software tailored for hotels can mitigate these risks by providing:

Anti-phishing and ransomware protection

Automated backups and disaster recovery plans

GDPR compliance monitoring and reporting

Role-based access control for different departments

Real-time threat detection and alerts

Implementing these measures not only reduces the risk of fines and attacks but also builds guest trust. In an age where digital security is part of customer experience, being able to guarantee data privacy is a competitive advantage.

Conclusion: A Wake-Up Call for Croatian Hotels

Croatian hotels cannot afford to ignore cybersecurity. With GDPR fines growing and ransomware attackers targeting the hospitality industry, the cost of inaction is far greater than the cost of prevention. Cybersecurity software is not just a technical add-on — it’s a critical part of running a legally compliant, secure, and guest-focused operation in 2025 and beyond.

Now is the time to act. Protect your guests. Protect your reputation. Protect your business.