{
 "jurisdiction_id": "CR",
 "jurisdiction": "Costa Rica",
 "url": "https://dataprotection.gi/jurisdictions/costa-rica/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-05",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 34,
  "sub_modules": 57,
  "source_register": 9
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "green",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "Core regulator, statute and implementing decree are well corroborated across independent secondary sources; only territorial-scope detail is unconfirmed.",
   "claims": [
    {
     "statement": "PRODHAB (Agencia de Proteccion de Datos de los Habitantes) is Costa Rica's data protection authority, structured as a maximum-decentralization body attached to the Ministry of Justice and Peace, and is responsible for enforcing Law No. 8968.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Law No. 8968 of 2011 has been enforceable in relation to organizations and individuals since July 7, 2012, and is complemented by Executive Decree No. 37554-JP of October 30, 2012, as amended by Decree No. 40008-JP of December 6, 2016.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Two additional bills, No. 22.388 (a reform of the existing Law) and No. 23.097 (a new data protection law), were pending before the Legislative Assembly as of the most recent secondary-source review in April 2026, with neither yet enacted.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Law No. 8968 is applicable to personal data contained in automated or manual databases.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Following the 2016 reform, only databases administered for the purpose of distributing or disseminating personal data with commercial intent, or those that directly commercialize such data, must be registered with PRODHAB; internal databases are exempt from registration though still subject to the Law.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Databases of financial entities subject to the functional oversight of the Superintendencia General de Entidades Financieras (SUGEF) are exempt from the PRODHAB registration duty, without prejudice to remaining subject to PRODHAB's general control and oversight.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "amber",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "Consent-centric lawful basis is well evidenced; special-categories and pseudonymisation sub-modules carry unresolved gaps requiring primary-text verification.",
   "claims": [
    {
     "statement": "Law No. 8968 establishes express consent of the data subject as a central lawful basis for processing, alongside a duty on controllers and processors to maintain adequate security safeguards.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Controllers, illustrated in the regulated fintech sector, must obtain individualized, specific, informed and freely given written consent disclosing the database's purpose, recipients, transfer arrangements and the data subject's rights.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/fintech-in-costa-rica-the-regulatory-landscape-and-privacy-as-a-priority",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The 2016 regulatory reform (Decree No. 40008-JP) refined the statutory definitions of database, consent, technological intermediary, data transfer and the right to be forgotten.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/news/costa-rica-government-reforms-data-protection",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "amber",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "Access/rectification/erasure rights are confirmed and in force; portability and opt-out remain proposed-only; deadlines are unconfirmed.",
   "claims": [
    {
     "statement": "Law No. 8968 grants data subjects the right to access personal data held about them in registered databases.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Law No. 8968 grants rights to rectify or delete personal data; the associated 'right to be forgotten' concept was further refined by the 2016 regulatory reform.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/news/costa-rica-government-reforms-data-protection",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Data subjects may revoke consent previously given for processing, and controllers must facilitate the exercise of this right alongside access and modification rights.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/fintech-in-costa-rica-the-regulatory-landscape-and-privacy-as-a-priority",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Data portability is proposed, not currently in force: pending Bill No. 23097, introduced March 10, 2023, would introduce a portability right and a right to opt out of processing.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/notes/costa-rica-data-subject-rights",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Costa Rica's pending AI-regulation bill (analysed February 2026) would expressly reinforce data subjects' ARCO rights (access, rectification, cancellation and opposition) in AI-driven processing contexts, conditioning such processing on informed consent.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/analisis-del-proyecto-de-ley-de-regulacion-de-la-inteligencia-artificial-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Security-safeguard and accountability/registration duties are confirmed and in force; breach notification, DPO and retention/disposal sub-modules are unconfirmed gaps.",
   "claims": [
    {
     "statement": "The 2016 regulatory reform reinforced the accountability principle by more precisely delimiting the content of Article 21 of Law No. 8968, which governs which databases must be registered with PRODHAB.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "PRODHAB's Departamento de Archivo y Registro de Bases de Datos maintains a registry of qualifying databases, functioning as Costa Rica's equivalent to a records-of-processing filing mechanism.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The 2016 reform introduced the concept of a 'grupo de interes economico' (economic-interest group), permitting continuous and natural transfer of personal data among affiliates of multinational or local corporate groups for internal purposes without requiring registration of 'internal' databases.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Law No. 8968 requires that controllers and processors ensure adequate security safeguards to protect personal data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "Only the general transfer-conditions reform is confirmed; five of six sub-modules (adequacy received/granted, SCCs/BCRs, TIA, localisation) carry unresolved gaps.",
   "claims": [
    {
     "statement": "The 2016 regulatory reform amended the conditions governing personal-data transfers under Law No. 8968, seeking greater fluidity in transfer and commercialization of personal data while preserving PRODHAB's oversight competences.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "No general data-localisation mandate applicable to corporate-group data transfers under Costa Rican law was identified; the 2016 GIE provisions instead facilitate continuous intra-group cross-border transfer.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Financial-sector overlay is well evidenced (statute plus a concrete 2023 enforcement precedent); other sector sub-modules are unconfirmed gaps.",
   "claims": [
    {
     "statement": "Databases of SUGEF-supervised financial entities are exempt from PRODHAB's registration duty while remaining subject to PRODHAB's general control and enforcement powers.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "On August 28, 2023, PRODHAB issued Resolution No. 697-2023, a precautionary measure suspending the Banco Central de Costa Rica's request for comprehensive credit-operation data, including identification documents, from supervised financial intermediaries, following a complaint by consumer association Asodidcu.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/medida-cautelar-un-precedente-importante-establecido-por-la-agencia-de-proteccion-de-datos-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Costa Rica's pending AI-regulation bill, analysed in February 2026, may include provisions related to protecting the privacy of telecommunications-service users, though no enacted telecoms/ePrivacy-specific regime currently exists.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/analisis-del-proyecto-de-ley-de-regulacion-de-la-inteligencia-artificial-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The 2023 Banco Central/PRODHAB dispute concerned personal credit-operation data supplied by supervised financial intermediaries, illustrating PRODHAB's jurisdiction over credit-data flows in the absence of a dedicated credit-reporting statute.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/medida-cautelar-un-precedente-importante-establecido-por-la-agencia-de-proteccion-de-datos-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "No on-point sources found across any of the six declared sub-modules despite targeted search; this is treated as a genuine regulatory gap pending primary-text verification.",
   "claims": [
    {
     "statement": "No dedicated direct-marketing consent or suppression statute was identified for Costa Rica; marketing databases would fall under Law No. 8968's general consent and registration requirements absent a marketing-specific rule.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "No current in-force ADM/biometric/AI-specific regime exists, but an active, recently-analysed 2026 AI bill directly targets this module, warranting amber rather than red.",
   "claims": [
    {
     "statement": "Costa Rica's pending AI-regulation bill would condition personal-data processing on informed consent and expressly reinforce ARCO rights (access, rectification, cancellation and opposition) in AI-driven processing.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/analisis-del-proyecto-de-ley-de-regulacion-de-la-inteligencia-artificial-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The pending AI-regulation bill contemplates creating an Autoridad Reguladora de Inteligencia Artificial (ARIA) to supervise compliance and set technical/ethical AI guidelines, with proportional and dissuasive sanctions including fines and temporary or permanent prohibitions for non-compliance.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/analisis-del-proyecto-de-ley-de-regulacion-de-la-inteligencia-artificial-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "red",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Genuine absence of findings across all five declared sub-modules; flagged explicitly rather than silently omitted.",
   "claims": []
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "green",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/costa-rica/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Regulator powers, a concrete 2023 enforcement precedent, a constitutional private-right-of-action route, and a within-180-day AI-bill development are all confirmed; funding/capacity and collective-redress detail remain thinner.",
   "claims": [
    {
     "statement": "Failure to comply with Law No. 8968 and its consent/registration obligations could lead to administrative fines imposed by PRODHAB.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/fintech-in-costa-rica-the-regulatory-landscape-and-privacy-as-a-priority",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Under Law No. 8968, PRODHAB may issue precautionary measures (medidas cautelares) when necessary to secure the effective outcome of a rights-protection proceeding.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/medida-cautelar-un-precedente-importante-establecido-por-la-agencia-de-proteccion-de-datos-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "PRODHAB's Resolution No. 697-2023, issued August 28, 2023, granting a precautionary measure against the Banco Central de Costa Rica, is described as marking a significant precedent for data protection enforcement in the country.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/medida-cautelar-un-precedente-importante-establecido-por-la-agencia-de-proteccion-de-datos-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The complaint underlying Resolution No. 697-2023 was filed by the consumer association Asodidcu on behalf of affected financial-sector data subjects, indicating associative complaints to PRODHAB are a practical avenue for collective redress, though no dedicated statutory class-action mechanism was confirmed.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/medida-cautelar-un-precedente-importante-establecido-por-la-agencia-de-proteccion-de-datos-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The right to data protection has been recognized and protected in Costa Rica by the Constitutional Court since the 1990s on the basis of Article 24 of the Political Constitution, providing a constitutional remedy independent of the PRODHAB administrative process.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/notes/costa-rica-privacy-overview",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "IAPP published an analysis on February 17, 2026 of Costa Rica's proposed AI-regulation bill, which would create an AI Regulatory Authority (ARIA) and directly interfaces with the existing data protection framework via informed consent and ARCO-rights provisions.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "International Association of Privacy Professionals",
     "source_url": "https://iapp.org/news/a/analisis-del-proyecto-de-ley-de-regulacion-de-la-inteligencia-artificial-en-costa-rica",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "As of an April 2026 secondary-source review, Bill No. 23097 (introduced March 10, 2023), which would add data portability and opt-out rights, remained pending before the Legislative Assembly with no indication of enactment.",
     "regulatory_stage": "proposed",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance/OneTrust",
     "source_url": "https://www.dataguidance.com/notes/costa-rica-data-subject-rights",
     "source_tier": null,
     "observed_at": null
    }
   ]
  }
 ]
}