Costa Rica
SubstantialLaw No. 8968 on the Protection of the Person against the Processing of their Personal Data
Authority: Agency for the Protection of Inhabitants' Data (PRODHAB) | Enforcement: Active | Enacted: September 2011
Overview
Costa Rica has had comprehensive data protection since 2011. PRODHAB is the autonomous agency overseeing compliance. The law covers consent, data subject rights, and database registration. Costa Rica is considered one of the stronger frameworks in Central America.
14-Topic Coverage
Data Protection Authority
Fully AddressedPRODHAB oversees compliance, maintains database registry, and handles complaints.
Consent Requirements
Fully AddressedInformed consent required. Must be express for sensitive data.
Data Subject Rights
Fully AddressedRights to access, rectification, cancellation, and opposition.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with consent.
Breach Notification
Partially AddressedNo explicit statutory requirement. PRODHAB guidance developing.
DPO Requirements
Partially AddressedMust register databases with PRODHAB.
Children's Data
Partially AddressedGeneral provisions apply. Child and Adolescent Code provides additional protections.
Penalties & Enforcement
Fully AddressedFines from 5 to 30 base salaries. Active enforcement by PRODHAB.
Sector-Specific Rules
Partially AddressedSUGEF financial data rules, health data regulations.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Fully AddressedLaw applies to both public and private sector.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Costa Rica's regulations.
Book a Consultation