Costa Rica. Comprehensive data protection. Law
Law 8968Law No. 8968 on the Protection of the Person in the Processing of Personal Data (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales)
In force
Partly verified
Medium confidence.Fine cap and exact dates from general knowledge.
§1Summary
- Synopsis
Costa Rica's data protection law requiring informed, express consent, data quality and security, and registration of databases that are commercialised. PRODHAB handles complaints and sanctions.
- Key themes
- Unique features
Five-business-day breach notification deadline in the regulation; registration only for databases distributed or commercialised.
- SaaS relevance
SaaS processing Costa Rican data must obtain written consent for transfers (service providers exempted) and notify breaches quickly.
§2Obligations
- Extraterritorial
- No
- Breach notification
- PRODHAB and data subjects within 5 business days
- DPO
- No
- Cross-border transfers
- Prior express consent; service-provider/group exceptions
- Maximum penalty
- Fines up to 30 base salaries; database suspension
§3Dates
- Key dates
- Adopted
- In force
- Regulation Decree 37554-JP (2013), amended Decree 40008-JP (2016); GDPR-aligned reform bill pending since 2021
§4Text and authority
- Text
- Authoritative text pgrweb.go.cr
- Authority
- Agencia de Protección de Datos de los Habitantes (PRODHAB)
§5Where it applies
- Domestic law of
- Costa Rica
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Fine cap and exact dates from general knowledge.