Compliance Node Overview
Costa Rica's Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (Personal Data Protection Law) - Law No. 8968 of 5 July 2011, published in La Gaceta (official gazette) No. 170 on 5 September 2011 and entered into force on 5 March 2012 - is Costa Rica's primary personal data protection legislation. The implementing regulation, Executive Decree No. 37554-JP of 30 October 2012, provides detailed rules for compliance. Law No. 9736 of 14 July 2020 amended Law No. 8968 to introduce mandatory breach notification obligations. The supervisory authority is the Agencia de Protección de Datos de los Habitantes (PRODHAB - Agency for the Protection of Residents' Data), an independent public body operating under the Ministry of Justice and Peace of Costa Rica. PRODHAB registers personal data databases, investigates complaints, and enforces Law No. 8968. Key features of Costa Rica's Law No. 8968: (1) Scope - applies to any individual or legal entity that collects, stores, transfers, or uses personal data of natural persons (habitantes) in Costa Rica; (2) Data processing principles - the law requires compliance with: purpose limitation; proportionality; informed consent; quality (accuracy); security; confidentiality; and transparency; (3) Sensitive personal data - the law establishes heightened protection for data revealing: racial or ethnic origin; political opinions; religious convictions; trade union membership; health status; sex life; (4) ARCO rights - data subjects (habitantes) have the rights of Acceso (access), Rectificación (rectification), Cancelación (cancellation/deletion), and Oposición (opposition); (5) Consent - processing personal data generally requires the data subject's free, informed, specific, and express consent; specific exceptions apply (legal obligation, contract necessity, vital interests, public interest); (6) Database registration - any individual or legal entity maintaining a personal data database must register it with PRODHAB through the Registro Nacional de Bases de Datos (National Database Registry) before processing commences; (7) Breach notification - Law No. 9736 of 2020 introduced mandatory notification to PRODHAB when a security breach occurs that may harm the fundamental rights of data subjects; notification must be made within five business days of discovering the breach; data subjects must also be notified; (8) Cross-border transfers - personal data may only be transferred to countries or organisations providing equivalent or superior protection; transfers to non-adequate countries require PRODHAB authorisation; (9) Administrative sanctions - PRODHAB may impose fines ranging from one to seventy-five base wages (salarios base, the Costa Rican judicial base salary unit) for violations of Law No. 8968; (10) Criminal penalties - violations of data protection rights may give rise to criminal liability under applicable criminal law provisions. Costa Rica occupies a significant position in Central American data governance as the most advanced economy in the region, with a growing technology sector, significant medical devices and pharmaceutical manufacturing, and an established free trade zone economy that processes large volumes of personal data of regional and international data subjects.
Pillar: Cybersecurity · Authority: Agencia de Protección de Datos de los Habitantes (PRODHAB, Costa Rica) · Version: 1.0.0 · Last updated:
Primary source: https://www.prodhab.go.cr/
SHA-256 integrity: 2dbb8cfc86cb1ca56588868762114bd30c9d8ba8a1a87bf77b02af8019756c1f
Primary Citations — 7 traced to source
- Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (Law No. 8968, Costa Rica) - published La Gaceta No. 170 on 5 September 2011; entered into force 5 March 2012; data processing principles: purpose limitation, proportionality, informed consent, quality, security, confidentiality, transparency; sensitive data: racial/ethnic origin, political opinions, religious convictions, trade union membership, health, sex life; ARCO rights: acceso (8 business days), rectificación and cancelación (5 business days), oposición; mandatory PRODHAB database registration; administrative fines from 1 to 75 judicial base wages
- Law No. 9736 of 14 July 2020 (Costa Rica) - amends Law No. 8968 to introduce mandatory breach notification; data controllers must notify PRODHAB within five business days of discovering a security breach that may harm the fundamental rights of data subjects; data subject notification required; establishes breach notification as a legal obligation for all registered database controllers
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access