Costa Rica
Law No. 8968 on the Protection of the Person with Regard to the Processing of Personal Data
Authority
Agency for the Protection of Individuals with Regard to the Processing of Personal Data (PRODHAB)
Overview
Costa Rica’s data protection framework rests on Law No. 8968 of 2011, supervised by the Agency for the Protection of the Inhabitants’ Data (PRODHAB), an administrative body attached to the Ministry of Justice. The law grants data subjects robust access, rectification, cancellation, and opposition rights, enforceable within five business days. International transfers are governed by a consent-centric rule: transferring personal data of Costa Rican citizens or foreign residents to third-country databases without the data subject’s consent constitutes a “most serious offense,” punishable by fines of 15 to 30 base judicial salaries and suspension of the database for one to six months. The 2013 implementing regulation further requires unequivocal consent for any transfer, with narrow exceptions. However, PRODHAB’s enforcement capacity has been constrained by chronic underfunding and staffing shortages; its own 2022 institutional report acknowledged severely weakened credibility and backlogs dating to 2018. Organizations processing Costa Rican data should treat consent-based transfer authorization as a hard compliance requirement while recognizing that PRODHAB’s practical oversight may lag behind the statute’s formal demands.