Costa Rica Personal Data Protection Law — Law No. 8968

Why does it matter?

Law 8968 makes informed, written consent the rule for collecting personal data in Costa Rica, sets short deadlines for data subject requests, and backs both with a regulator that can fine and suspend databases. Its penalties are graded as minor, serious and very serious faults (articles 28 to 31).

Key benefits include:

• Written, informed consent

A person must be told, expressly, precisely and unambiguously, eight things before data is collected, and must give written consent that can be revoked in the same way without retroactive effect (article 5).

• Five business days for requests

The controller must meet requests for access, rectification or deletion free of charge and resolve them within five business days of receipt (article 7).

• Sensitive data barred by default

Nobody is obliged to provide sensitive data, and processing data on racial or ethnic origin, political opinions, religious or philosophical beliefs, health or sexual life is prohibited, with four exceptions (article 9). For private persons, processing sensitive data is a very serious fault (article 31).

• Registration with PRODHAB

Databases kept for distribution, diffusion or commercialization must be registered. Processing without registration is a very serious fault (articles 21 and 31).

• Fines graded by fault

Fines run up to five base salaries for minor faults, five to twenty for serious faults and fifteen to thirty for very serious faults, which can also bring suspension of the database for one to six months (article 28).

How does it work?

The law has six chapters: general provisions (articles 1 to 3); principles and rights, security and confidentiality (4 to 13); transfer of personal data (14); the PRODHAB agency (15 to 22); procedures, including complaints and sanctions (23 to 32); and fees (33 and 34). Transitional provision I gave existing database owners one year from PRODHAB's creation to adapt their procedures and databases.

Before collecting data, the controller informs the data subject of the database, its purposes, the recipients, whether answers are mandatory, the treatment, the consequences of refusing, the rights available and the controller's identity and address (article 5.1). Consent must be free, specific, informed, unequivocal and individualized, and the controller carries the burden of proving it (Regulation, articles 4 and 6). Revocation must be actioned within five business days, and recipients of earlier transfers are told within the same period (Regulation, article 8).

Any person with a subjective right or legitimate interest may complain to PRODHAB (article 24). The respondent has three business days to answer under oath, PRODHAB issues its final decision within a month of the complaint, and reconsideration is available within three days (article 25). PRODHAB can also open sanction proceedings on its own initiative under the ordinary procedure of the Ley General de la Administración Pública (article 27).

Key Elements

• Informed consent and exceptions (articles 5 and 9)

Express consent is not needed when a court order or legislative investigative commission requires the data, when the data is unrestricted-access data from general public sources, or when a constitutional or legal provision requires it. Collecting data by fraudulent, unfair or unlawful means is prohibited.

• Data quality and the ten-year limit (article 6)

Data must be current, truthful, accurate and adequate to the purpose. Personal data that can affect its subject may not be kept more than ten years after the facts recorded unless a special rule says otherwise, and data kept longer must be dissociated from the person (article 6.1). The Regulation counts ten years from the end of the purpose of the processing, with exceptions (article 11).

• Rights of access, rectification and deletion (article 7)

Data subjects may confirm whether their data is held, receive a complete report free of coded terms, learn the system used to process it, and obtain rectification, updating or deletion. For deceased persons the heirs may exercise these rights.

• Security, confidentiality and action protocols (articles 10 to 12)

Controllers adopt technical and organizational measures against alteration, loss, unauthorized access and processing. A registered action protocol raises a rebuttable presumption of compliance. Under the Regulation, a security vulnerability must be notified to affected data subjects within five business days (articles 38 and 39).

• Transfers (article 14)

Controllers may transfer data only when the data subject has expressly and validly authorized the transfer. The Regulation requires a contract with the recipient that carries at least the same obligations (article 43). Transferring data to databases in third countries without consent is a very serious fault (article 31).

• Registration and fees (articles 21 and 33)

Databases administered for distribution, diffusion or commercialization register with PRODHAB, which charges an annual fee of USD 200, payable in January under the Regulation (articles 78 and 79). PRODHAB's FAQ says databases of entities supervised by SUGEF need not register but remain subject to the law.

What does it cover?

The law covers personal data held in automated or manual databases of public and private bodies, and any later use of that data (article 2). It protects any person regardless of nationality, residence or domicile (article 1). Databases maintained by individuals or legal entities for exclusively internal, personal or domestic purposes are outside it as long as they are not sold or otherwise commercialized. PRODHAB's FAQ states that a database that need not be registered is still subject to the law.

What are its objectives?

The law protects the fundamental right of informational self-determination and gives data subjects enforceable rights.

Guarantee every person's right to informational self-determination in automated and manual processing (articles 1 and 4).

Require informed, written consent and prohibit collection by fraudulent, unfair or unlawful means (article 5).

Keep data current, truthful, accurate and adequate to its purpose (article 6).

Give data subjects free access, rectification and deletion within five business days (article 7).

Protect security and confidentiality and limit transfers to those authorized by the data subject (articles 10, 11 and 14).

Supervise compliance through PRODHAB's register, complaints procedure and graded sanctions (articles 16 and 21 to 31).

Framework in Context

Law 8968 is Costa Rica's general data protection statute for public and private databases, supervised by PRODHAB. Credit behavior data also follows the rules of the national financial system (article 9.4). Unlike regimes with several lawful bases, it makes express written consent the rule, with the exceptions listed in article 5. The Regulation adds the security incident notice and the consent criteria that the law does not state.

Common Framework Mappings

Organizations map Law 8968 to international privacy and security frameworks to compare consent, data subject rights, security and transfer controls across jurisdictions.

Mapped frameworks include:

APEC PF

LGPD

Convention 108+

GDPR

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines