--- title: "Costa Rica Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/costa-rica/ source_html: /jurisdictions/costa-rica/index.html description: "Costa Rica data protection and privacy regulation: 10 categories, 72 claims, updated 2026-10-25." generated_at: 2026-11-07T14:58:19Z content_sha256: beffc5ea344aa2928fbe5bdbcfd9a8b868ba161d326aa0aebad35dfbbda0ab5c generator: "fe-fleet/md-twin@1.0" --- # Costa Rica Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/costa-rica/), [World Payments](https://payments.gi/jurisdictions/costa-rica/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 72 claims · 36 sources in the cumulative register Download report (PDF) Expand all Costa Rica's data-protection authority, Prodhab, is engaged in an unresolved institutional confrontation with the Tribunal Supremo de Elecciones over the commercialisation of citizens' biometric data. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=COSTA-RICA)[Build Report](/reports/?j=COSTA-RICA)[Compare](/compare/?j=COSTA-RICA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority PRODHAB (Agencia de Protección de Datos de los Habitantes) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 3 Red categories 57 Sub-modules 72 Claims 0 Tier-1 sources Traffic-light mix 2 green 5 amber 3 red (sums to 10 rendered categories; click to filter) 3 categories flagged red ## Jurisdiction lead brief ###### Latest update · 25 October 2026 #### Lead Signal Costa Rica's data-protection authority, Prodhab, issued a ruling with significant implications for how biometric data is treated under the jurisdiction's 2011 data-protection statute, Law No. 8968. Resolution No. 029-2026-RF, issued in connection with the Supreme Electoral Tribunal's biometric Identity Verification System, found that biometric data generated by that system qualifies as sensitive data under Law 8968 even though biometric data is not expressly enumerated as a sensitive category in the statute's text, and that commercial exploitation of that data beyond its original electoral purpose breaches the law's purpose-limitation principle. Prodhab is understood to have ordered the Electoral Tribunal to cease commercialising the biometric data and to cancel the Civil Registry database's Prodhab inscription. The Tribunal has filed a reconsideration appeal, and the outcome remains unresolved. This ruling is best read as an extension of sensitive-data protection by regulatory interpretation rather than by legislative amendment, and its durability is accordingly uncertain pending the outcome of the pending appeal. If the Tribunal's challenge succeeds, the sensitive-data classification and the purpose-limitation finding could be narrowed or reversed; if it fails, the ruling stands as a precedent extending the reach of Law 8968's special-category protections to categories of data not explicitly named in the statute. #### Other Developments Prodhab is also understood to be investigating a separate matter concerning alleged dark-web exposure of Costa Ricans' personal data. The regulator is reported to be maintaining three open investigative files, opened in September 2026, concerning the possible breach, with no resolution reported. The files predate the current reporting window but remain active and unresolved, and they sit alongside the biometric ruling as the second of two live enforcement threads engaging Prodhab's attention at present. A new digital-services and e-commerce statute, Law No. 10946, is reported to have entered into force in June 2026, establishing a framework for digital-services and e-commerce governance. This framework reportedly includes merchant secure-payment duties and a graduated fine structure, with fines reported to range from one to ten base salaries for minor offences up to ten to forty base salaries for more serious ones. It is understood to be a consumer-protection and e-commerce instrument rather than a connected-product data-access framework comparable to the European Union's Data Act, and its data-protection relevance appears limited to the general digital-services governance context it establishes rather than to any specific data-subject-rights mechanism. #### Cross-Monitor Connections A private, non-governmental legislative proposal from an organisation referred to as CBIAT, put forward in late September 2026, is reported to cover eight bills addressing artificial intelligence, blockchain, and digital-asset governance, including identity and privacy protections alongside AI risk-governance provisions. The proposal has no confirmed legislative sponsor and has not yet reached the Legislative Assembly, so its data-protection relevance is speculative at this stage; readers tracking Costa Rica's artificial-intelligence governance posture should be aware of the same proposal as a point of overlap, since its AI risk-governance content sits outside the scope of the data-protection-specific findings in this brief. #### Outlook Two threads are unresolved and worth tracking jointly going forward: the outcome of the Electoral Tribunal's reconsideration appeal against Resolution 029-2026-RF, expected within the second half of 2026 on current indications, and the final disposition of the three open dark-web breach investigative files. The appeal outcome in particular will determine whether Costa Rica's extension of sensitive-data protection to unenumerated biometric categories becomes settled interpretive precedent or is narrowed on reconsideration, a question with direct relevance for any organisation processing biometric data of Costa Rican data subjects outside the specific electoral context at issue in the ruling. 2 earlier updates not shown here. ###### Standing brief · as of 4 October 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Costa Rica's data-protection authority, Prodhab, is engaged in an unresolved institutional confrontation with the Tribunal Supremo de Elecciones over the commercialisation of citizens' biometric data. In Resolucion N.246 029-2026-RF, issued on 4 May 2026 after a complaint that took nearly six years to resolve, Prodhab found that the TSE's Identity Verification System, known as VID, unlawfully commercialises citizens' biometric data without informed consent. Prodhab ordered the TSE to obtain informed consent within ten working days and warned that continued non-compliance could result in cancellation of the TSE's database registration. The TSE announced on 22 May 2026 that it would file a recurso de revocatoria against the resolution, and no outcome of that appeal has been located as of this reporting period. #### Other Developments Enforcement ceiling remains modest relative to the stakes of the dispute. Costa Rica's administrative fine regime under Ley 8968 caps penalties at 30 base salaries, approximately CRC 13,866,000 or roughly US$30,500, for even the most serious infractions, with suspension of a database file for one to six months as the only further sanction available to Prodhab. There is no permanent-cancellation sanction and no gazette-publication sanction built into the law or its regulation. This means that, even where Prodhab finds a violation as serious as unlawful commercialisation of biometric identity data by a state body, its own toolkit is limited to a capped fine and a temporary suspension power, short of the registration-cancellation threat it has invoked against the TSE specifically. #### Cross-Monitor Connections The biometric-verification dispute sits adjacent to financial-integrity's interest in identity-verification infrastructure used for AML/CFT customer due diligence, and to crypto's interest in identity-verification standards now relevant to Costa Rica's newly registered virtual-asset service providers; readers tracking either of those monitors should note that Costa Rica's state-run identity-verification service is itself under an active data-protection enforcement order. #### Outlook The outcome of the TSE's recurso de revocatoria is the single development most likely to clarify Costa Rica's operative biometric-data standard going forward: if the appeal fails, the TSE faces a concrete deadline-driven consent obligation backed by a cancellation threat; if it succeeds, Prodhab's authority to compel consent reforms at a state body would be narrowed. Separately, the capped nature of Prodhab's administrative fines, unchanged since Ley 8968's enactment in 2011, means that even a confirmed finding of unlawful biometric commercialisation carries limited direct financial consequence beyond the targeted suspension and cancellation levers, a structural feature of the enforcement regime that this dispute puts into sharp relief. Read full brief · 1031 words Key regulatory facts for Costa Rica Regulatory Dimension Costa Rica Standing Position Jurisdiction Costa Rica (CR) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 72 sourced findings) Regulator & Framework Core regulator, statute and implementing decree are well corroborated across independent secondary sources; only territorial-scope detail is unconfirmed. Lawful Processing & Special Data Consent-centric lawful basis is well evidenced; special-categories and pseudonymisation sub-modules carry unresolved gaps requiring primary-text verification. Data Subject Rights Access/rectification/erasure rights are confirmed and in force; portability and opt-out remain proposed-only; deadlines are unconfirmed. Controller/Processor Duties Security-safeguard and accountability/registration duties are confirmed and in force; breach notification, DPO and retention/disposal sub-modules are unconfirmed gaps. Primary Instruments Cited DataGuidance/OneTrust, International Association of Privacy Professionals, SCIJ, Costa Rica Official Instrument (prodhab.go.cr normativa), UNA Last Confirmed / Updated 2026-10-25 (36 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Costa Rica: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core regulator, statute and implementing decree are well corroborated across independent secondary sources; only territorial-scope detail is unconfirmed. Primary framework Law No. 8968 of 2011 (Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales) and Executive Decree No. 37554-JP of 2012, as amended by Decree No. 40008-JP of 2016 Supervisory authority PRODHAB (Agencia de Protección de Datos de los Habitantes) Traffic-light rationale — Green Core regulator, statute and implementing decree are well corroborated across independent secondary sources; only territorial-scope detail is unconfirmed. #### Sub-modules (5) #### Regulator And AuthorityGreen PRODHAB is the designated enforcement authority for Law No. 8968, structured as a maximum-decentralization body attached to the Ministry of Justice and Peace. Claims (4): - PRODHAB (Agencia de Proteccion de Datos de los Habitantes) is Costa Rica's data protection authority, structured as a maximum-decentralization body attached to the Ministry of Justice and Peace, and is responsible for enforcing Law No. 8968. - Ley 8968 art. 28 — Vests Prodhab with supervision, registration, inspection, complaint-resolution, corrective-order and sanctioning powers - Prodhab — Three investigative files (425-09-2026, 432-09-2026-DEN, 434-09-2026-DEN) into alleged dark-web exposure of Costa Ricans' personal data - Prodhab is Costa Rica's national data-protection authority under Ley 8968 Art. 15. #### Act And InstrumentsGreen Primary instruments are Law No. 8968 (2011), Executive Decree No. 37554-JP (2012) and its 2016 amending Decree No. 40008-JP; two reform/replacement bills remain pending. Claims (6): - Law No. 8968 of 2011 has been enforceable in relation to organizations and individuals since July 7, 2012, and is complemented by Executive Decree No. 37554-JP of October 30, 2012, as amended by Decree No. 40008-JP of December 6, 2016. - Two additional bills, No. 22.388 (a reform of the existing Law) and No. 23.097 (a new data protection law), were pending before the Legislative Assembly as of the most recent secondary-source review in April 2026, with neither yet enacted. - Prodhab — Ley No. 8968 (2011) as Costa Rica's independent data-protection supervisory authority - Ley N.246 8968 — Prodhab's own Normativa page confirms Ley 8968 has not been amended since enactment; its Reglamento (Decreto 37554-JP) has been amended twice (2016, 2019). - Ley 8968 — Has not been reformed since enactment, while its implementing Reglamento was amended by Decrees 40008-JP (2016) and 41582 (2019) - Ley N.8968, in force since 7 July 2011, establishes Prodhab as Costa Rica's data-protection authority. #### Material ScopeGreen The Law applies to personal data held in both automated and manual databases. Claims (2): - Law No. 8968 is applicable to personal data contained in automated or manual databases. - Ley 8968 art. 2 — Excludes databases maintained for exclusively internal, personal or domestic purposes, provided not sold or otherwise commercialised #### Territorial ScopeAmber No confirming evidence was located in this run describing the Law's application to controllers not established in Costa Rica. #### Regulator Registration And FilingGreen Qualifying databases (those administered for commercial distribution/dissemination or direct commercialization of personal data) must be registered with PRODHAB's Departamento de Archivo y Registro de Bases de Datos; purely internal databases and SUGEF-supervised financial-entity databases are exempt from registration (though not from PRODHAB oversight) following the 2016 reform. Claims (3): - Following the 2016 reform, only databases administered for the purpose of distributing or disseminating personal data with commercial intent, or those that directly commercialize such data, must be registered with PRODHAB; internal databases are exempt from registration though still subject to the Law. - Databases of financial entities subject to the functional oversight of the Superintendencia General de Entidades Financieras (SUGEF) are exempt from the PRODHAB registration duty, without prejudice to remaining subject to PRODHAB's general control and oversight. - Ley 8968 art. 21 — Requires registration with Prodhab of every database, public or private, administered for distribution, dissemination or commercialisation purposes; registration does not itself authorise data transfer Costa Rica operates a comprehensive omnibus data-protection regime under Law No. 8968 of 2011, enforced by PRODHAB, a decentralized body attached to the Ministry of Justice and Peace. The Law governs data protection in Costa Rica and has been enforceable in relation to organizations and individuals since July 7, 2012. Since mid-2014 PRODHAB, described as the maximum-decentralization body attached to the Ministry of Justice and Peace, has worked in practice to consolidate the rights and guarantees provided by the Law enacted in September 2011. Two further bills (No. 22.388 and No. 23.097) remain pending and would reform or replace parts of the current regime. Territorial/extraterritorial scope for non-established controllers could not be confirmed from available secondary sources in this run. No periodic updates recorded in this cycle Sources and claims (15) - [DataGuidance/OneTrust](https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention) — PRODHAB (Agencia de Proteccion de Datos de los Habitantes) is Costa Rica's data protection authority, structured as a maximum-decentralization body attached to the Ministry of Justice and Peace, and is responsible for enforcing Law No. 8968. - [DataGuidance/OneTrust](https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention) — Law No. 8968 of 2011 has been enforceable in relation to organizations and individuals since July 7, 2012, and is complemented by Executive Decree No. 37554-JP of October 30, 2012, as amended by Decree No. 40008-JP of December 6, 2016. - [DataGuidance/OneTrust](https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention) — Two additional bills, No. 22.388 (a reform of the existing Law) and No. 23.097 (a new data protection law), were pending before the Legislative Assembly as of the most recent secondary-source review in April 2026, with neither yet enacted. - [DataGuidance/OneTrust](https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention) — Law No. 8968 is applicable to personal data contained in automated or manual databases. - [International Association of Privacy Professionals](https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global) — Following the 2016 reform, only databases administered for the purpose of distributing or disseminating personal data with commercial intent, or those that directly commercialize such data, must be registered with PRODHAB; internal databases are exempt from registration though still subject to the Law. - [International Association of Privacy Professionals](https://iapp.org/news/a/Costa-Rica-dimensiona-su-normativa-en-un-entorno-global) — Databases of financial entities subject to the functional oversight of the Superintendencia General de Entidades Financieras (SUGEF) are exempt from the PRODHAB registration duty, without prejudice to remaining subject to PRODHAB's general control and oversight. - [SCIJ](https://pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=NRTC&nValor1=1&nValor2=29254) — Prodhab — Ley No. 8968 (2011) as Costa Rica's independent data-protection supervisory authority - [https://www.prodhab.go.cr/acercade/normativa/](https://www.prodhab.go.cr/acercade/normativa/) — Ley N.246 8968 — Prodhab's own Normativa page confirms Ley 8968 has not been amended since enactment; its Reglamento (Decreto 37554-JP) has been amended twice (2016, 2019). - [UNA](https://d1qqtien6gys07.cloudfront.net/wp-content/uploads/2026/04/UNA-Estado-de-la-Cyberseguridad-en-Costa-Rica-2025-v4-1.pdf) — Ley 8968 art. 28 — Vests Prodhab with supervision, registration, inspection, complaint-resolution, corrective-order and sanctioning powers - [Prodhab](https://www.prodhab.go.cr/acercade/normativa/) — Ley 8968 — Has not been reformed since enactment, while its implementing Reglamento was amended by Decrees 40008-JP (2016) and 41582 (2019) - [MICITT](https://micitt.go.cr/sites/default/files/marco_juridico_legal/08.%20Ley%20n.%C2%B0%208968%20Ley%20de%20Protecci%C3%B3n%20de%20la%20Persona%20frente%20al%20tratamiento%20de%20sus%20datos%20personales..pdf) — Ley 8968 art. 2 — Excludes databases maintained for exclusively internal, personal or domestic purposes, provided not sold or otherwise commercialised - [Bufete de Costa Rica](https://bufetedecostarica.com/ley-de-proteccion-de-la-persona-frente-al-tratamiento-de-sus-datos-personales-de-costa-rica/) — Ley 8968 art. 21 — Requires registration with Prodhab of every database, public or private, administered for distribution, dissemination or commercialisation purposes; registration does not itself authorise data transfer - [SCIJ / PGR](https://pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=NRTC&nValor1=1&nValor2=70975&nValor3=85989&strTipM=TC) — Ley N.8968, in force since 7 July 2011, establishes Prodhab as Costa Rica's data-protection authority. - [La Nación](https://www.nacion.com/el-pais/prodhab-tiene-tres-expedientes-abiertos-por/VJ2F7YZU3BFEJOWSCG6QUBHMU4/story/) — Prodhab — Three investigative files (425-09-2026, 432-09-2026-DEN, 434-09-2026-DEN) into alleged dark-web exposure of Costa Ricans' personal data - [SCIJ / PGR](https://pgrweb.go.cr/scij/Busqueda/Normativa/Normas/nrm_texto_completo.aspx?param1=NRTC&nValor1=1&nValor2=70975&nValor3=85989&strTipM=TC) — Prodhab is Costa Rica's national data-protection authority under Ley 8968 Art. 15. ### Costa Rica: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Consent-centric lawful basis is well evidenced; special-categories and pseudonymisation sub-modules carry unresolved gaps requiring primary-text verification. Primary framework Law No. 8968 of 2011 and Executive Decree No. 37554-JP (as amended by Decree No. 40008-JP of 2016) Supervisory authority PRODHAB (Agencia de Protección de Datos de los Habitantes) Traffic-light rationale — Amber Consent-centric lawful basis is well evidenced; special-categories and pseudonymisation sub-modules carry unresolved gaps requiring primary-text verification. Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data Prodhab's Resolution No. 029-2026-RF is reported to have found that biometric data generated by the Supreme Electoral Tribunal's Identity Verification System qualifies as sensitive data under Law No. 8968, notwithstanding that biometric data is not expressly enumerated as a sensitive category within the statute's own text. The ruling is further reported to have found that commercial exploitation of that biometric data beyond its original electoral purpose breaches the purpose-limitation principle embedded in the lawful-processing framework. The Electoral Tribunal has filed a reconsideration appeal against the resolution, and the outcome remains unresolved. The significance of this development lies in its interpretive method rather than in any legislative change: Law No. 8968 does not itself name biometric data among its enumerated special categories, so the resolution extends the statute's special-category protection by regulatory interpretation of the term sensitive data rather than by amendment. This is reported to be understood as a notable precedent for how special-category data is construed under Costa Rican law, though its durability is uncertain while the Electoral Tribunal's appeal is pending. Should the appeal succeed, the sensitive-data classification applied to this category of biometric data could be narrowed or reversed; should it fail, the interpretive extension stands as governing precedent for future assessments of what counts as sensitive data under the statute. #### Outlook The Electoral Tribunal's reconsideration appeal against Resolution 029-2026-RF is the central unresolved question for this area, with an expected resolution window reported in the second half of 2026, though the specific timing carries meaningful uncertainty. Organisations processing biometric data of Costa Rican data subjects outside the specific electoral context at issue in the ruling should treat the current sensitive-data classification as provisional pending the appeal's outcome, rather than as fully settled interpretive law. D2 · Lawful Processing — Full Module Record 4 sub-modules · 98 words · 7 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Costa Rica: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Access/rectification/erasure rights are confirmed and in force; portability and opt-out remain proposed-only; deadlines are unconfirmed. Primary framework Law No. 8968 of 2011 and Executive Decree No. 37554-JP (as amended) Supervisory authority PRODHAB (Agencia de Protección de Datos de los Habitantes) Traffic-light rationale — Amber Access/rectification/erasure rights are confirmed and in force; portability and opt-out remain proposed-only; deadlines are unconfirmed. #### Sub-modules (5) #### Access RightGreen Data subjects have a statutory right to access their personal data held in registered databases. Claims (1): - Law No. 8968 grants data subjects the right to access personal data held about them in registered databases. #### Rectification And ErasureGreen Rights to rectify and delete personal data, including a right-to-be-forgotten concept refined in 2016, are in force. Claims (2): - Law No. 8968 grants rights to rectify or delete personal data; the associated 'right to be forgotten' concept was further refined by the 2016 regulatory reform. - Ley 8968 art. 7.2 — Lets a data subject obtain rectification, updating, cancellation, or elimination of personal data processed in breach of the law, that is incomplete or inaccurate, or collected without authorisation #### Restriction And ObjectionAmber Data subjects may revoke previously given consent; controllers must facilitate exercise of this right. Claims (1): - Data subjects may revoke consent previously given for processing, and controllers must facilitate the exercise of this right alongside access and modification rights. #### Data PortabilityAmber Portability is not yet a statutory right; it is proposed only under pending Bill No. 23097. Claims (1): - Data portability is proposed, not currently in force: pending Bill No. 23097, introduced March 10, 2023, would introduce a portability right and a right to opt out of processing. #### Deadlines And Response WindowsRed No statutory response-window or deadline detail was confirmed from the sources reviewed. Law No. 8968 grants data subjects rights of access, rectification and deletion, plus a right to revoke consent; a pending bill (No. 23097) would add data portability and an opt-out right, and a pending AI-regulation bill would reinforce ARCO rights specifically in AI-driven processing. Bill No. 23097 for the Data Protection Law was introduced, on March 10, 2023, to the Costa Rica Legislative Assembly, and in particular introduces data subject rights such as the right to access, rectification, deletion, and data portability, as well as the right to opt-out of processing. Statutory response-window/deadline detail could not be confirmed. Sources and claims (6) - [DataGuidance/OneTrust](https://www.dataguidance.com/jurisdictions/costa-rica?topic=retention) — Law No. 8968 grants data subjects the right to access personal data held about them in registered databases. - [DataGuidance/OneTrust](https://www.dataguidance.com/news/costa-rica-government-reforms-data-protection) — Law No. 8968 grants rights to rectify or delete personal data; the associated 'right to be forgotten' concept was further refined by the 2016 regulatory reform. - [International Association of Privacy Professionals](https://iapp.org/news/a/fintech-in-costa-rica-the-regulatory-landscape-and-privacy-as-a-priority) — Data subjects may revoke consent previously given for processing, and controllers must facilitate the exercise of this right alongside access and modification rights. - [DataGuidance/OneTrust](https://www.dataguidance.com/notes/costa-rica-data-subject-rights) — Data portability is proposed, not currently in force: pending Bill No. 23097, introduced March 10, 2023, would introduce a portability right and a right to opt out of processing. - [International Association of Privacy Professionals](https://iapp.org/news/a/analisis-del-proyecto-de-ley-de-regulacion-de-la-inteligencia-artificial-en-costa-rica) — Costa Rica's pending AI-regulation bill (analysed February 2026) would expressly reinforce data subjects' ARCO rights (access, rectification, cancellation and opposition) in AI-driven processing contexts, conditioning such processing on informed consent. - [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/costa-rica-data-privacy-laws/) — Ley 8968 art. 7.2 — Lets a data subject obtain rectification, updating, cancellation, or elimination of personal data processed in breach of the law, that is incomplete or inaccurate, or collected without authorisation ### Costa Rica: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Security-safeguard and accountability/registration duties are confirmed and in force; breach notification, DPO and retention/disposal sub-modules are unconfirmed gaps. Primary framework Law No. 8968 of 2011 and Executive Decree No. 37554-JP (as amended by Decree No. 40008-JP of 2016) Supervisory authority PRODHAB (Agencia de Protección de Datos de los Habitantes) Traffic-light rationale — Amber Security-safeguard and accountability/registration duties are confirmed and in force; breach notification, DPO and retention/disposal sub-modules are unconfirmed gaps. D4 · Controller & Processor — Full Module Record 7 sub-modules · 66 words · 9 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Costa Rica: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only the general transfer-conditions reform is confirmed; five of six sub-modules (adequacy received/granted, SCCs/BCRs, TIA, localisation) carry unresolved gaps. Primary framework Law No. 8968 of 2011 and Executive Decree No. 37554-JP (as amended by Decree No. 40008-JP of 2016) Supervisory authority PRODHAB (Agencia de Protección de Datos de los Habitantes) Traffic-light rationale — Red Only the general transfer-conditions reform is confirmed; five of six sub-modules (adequacy received/granted, SCCs/BCRs, TIA, localisation) carry unresolved gaps. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 61 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Costa Rica: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector overlay is well evidenced (statute plus a concrete 2023 enforcement precedent); other sector sub-modules are unconfirmed gaps. Primary framework Law No. 8968 of 2011 and Executive Decree No. 37554-JP (as amended) Supervisory authority PRODHAB (Agencia de Protección de Datos de los Habitantes) Traffic-light rationale — Amber Financial-sector overlay is well evidenced (statute plus a concrete 2023 enforcement precedent); other sector sub-modules are unconfirmed gaps. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 94 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Costa Rica: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No on-point sources found across any of the six declared sub-modules despite targeted search; this is treated as a genuine regulatory gap pending primary-text verification. Traffic-light rationale — Red No on-point sources found across any of the six declared sub-modules despite targeted search; this is treated as a genuine regulatory gap pending primary-text verification. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 54 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Costa Rica: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ No current in-force ADM/biometric/AI-specific regime exists, but an active, recently-analysed 2026 AI bill directly targets this module, warranting amber rather than red. Traffic-light rationale — Amber No current in-force ADM/biometric/AI-specific regime exists, but an active, recently-analysed 2026 AI bill directly targets this module, warranting amber rather than red. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance The dominant development in this area remains Prodhab's Resolution No. 029-2026-RF, which found that biometric data generated by the Supreme Electoral Tribunal's Identity Verification System is sensitive data under Law No. 8968 and that its commercial exploitation beyond the electoral purpose for which it was collected breaches the purpose-limitation principle. Prodhab is reported to have ordered the Electoral Tribunal to cease commercialising the biometric data and to cancel the Civil Registry database's Prodhab inscription. The Tribunal has filed a reconsideration appeal, and the outcome remains unresolved. This is understood to be a significant precedent for biometric surveillance governance in Costa Rica, though its durability is uncertain pending the appeal. Separately, a private, non-governmental legislative proposal from an organisation referred to as CBIAT, put forward on 27 September 2026, is reported to comprise eight bills addressing artificial intelligence, blockchain, and digital-asset governance, including identity and privacy protections alongside AI risk-governance provisions. This proposal has no confirmed legislative sponsor and has not yet been introduced before the Legislative Assembly, so it should be treated as a forward-looking and currently speculative development rather than as an active legislative process. Its relevance to algorithmic and surveillance governance lies in its reported inclusion of AI risk-assessment provisions, though the proposal's non-governmental and unsponsored status means it carries materially lower weight than the Prodhab ruling discussed above. #### Outlook The Electoral Tribunal's reconsideration appeal against Resolution 029-2026-RF remains the primary matter to watch, with resolution anticipated within the second half of 2026 on current indications, carrying meaningful timing uncertainty. Separately, whether the CBIAT proposal attracts a legislative sponsor and advances toward formal introduction in the Legislative Assembly is a secondary signal worth monitoring, though it remains speculative at this stage and should not be treated as an active or binding development. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance Costa Rica's first significant biometric-governance precedent has emerged from a dispute between its data-protection authority and its electoral tribunal. Prodhab's Resolution 029-2026-RF found that the Tribunal Supremo de Elecciones' VID biometric-identification system processed fingerprint and photograph data unlawfully, absent express consent, and ordered cancellation of the Civil Registry database's Prodhab registration as a consequence. This is, on the record available, the first instance of Prodhab classifying biometric data as sensitive and taking a cancellation-level enforcement action against a major public-sector data holder over the practice. The TSE has not accepted this finding. It has announced a recurso de revocatoria, a reconsideration appeal, against the resolution, and has separately asserted, citing a 2008 Constitutional Chamber ruling (vote 2008-16852), that data available through its civil-registry web query are of a public nature with unrestricted access. This is a direct doctrinal confrontation: Prodhab's 2026 position treats TSE-held biometric identifiers as sensitive data requiring consent, while the TSE's 2008-grounded constitutional position treats the same category of civil-registry data as inherently public. The TSE has also warned of possible effects on public services arising from the resolution, suggesting the practical stakes extend beyond the immediate biometric-classification question into the operational function of Costa Rica's civil-registry and electoral-identification infrastructure. Separately, and on a smaller scale, a private draft bill associated with CBIAT proposes algorithmic-governance requirements for AI and robotic systems operating in Costa Rica, including a minimum "Estándar de Dignidad" score of 7.0 out of 10.0 with no individual criterion below 5.0 out of 10.0, and is reported to include a human-operable kill-switch requirement. As a private, unsponsored draft not yet introduced as a numbered legislative expediente, its path to enactment is uncertain and should not be read as an imminent regulatory development. #### Outlook The resolution of the TSE's appeal against Resolution 029-2026-RF will be the central determinant of Costa Rica's practical approach to biometric data governance going forward, given the direct conflict between Prodhab's sensitive-data finding and the TSE's public-data position. Until that appeal resolves, the registration-cancellation sanction's practical effect, and the broader question of whether biometric identifiers are treated as sensitive data across the Costa Rican public sector, remain open. The CBIAT draft bill remains unfiled and its prospects for formal introduction into the Legislative Assembly are unconfirmed. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 100 words · 8 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Costa Rica: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Genuine absence of findings across all five declared sub-modules; flagged explicitly rather than silently omitted. Traffic-light rationale — Red Genuine absence of findings across all five declared sub-modules; flagged explicitly rather than silently omitted. D9 · Children's Privacy — Full Module Record 5 sub-modules · 31 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Costa Rica: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Regulator powers, a concrete 2023 enforcement precedent, a constitutional private-right-of-action route, and a within-180-day AI-bill development are all confirmed; funding/capacity and collective-redress detail remain thinner. Primary framework Law No. 8968 of 2011 and Executive Decree No. 37554-JP (as amended) Supervisory authority PRODHAB (Agencia de Protección de Datos de los Habitantes) Traffic-light rationale — Green Regulator powers, a concrete 2023 enforcement precedent, a constitutional private-right-of-action route, and a within-180-day AI-bill development are all confirmed; funding/capacity and collective-redress detail remain thinner. Periodic update · new data 2026-10-25 #### Enforcement & Redress Two enforcement threads are active before Prodhab, and neither has reached resolution. The first concerns Resolution No. 029-2026-RF, under which Prodhab is reported to have ordered the Supreme Electoral Tribunal to cease commercialising biometric data from its Identity Verification System and to cancel the Civil Registry database's Prodhab inscription; the Tribunal has filed a reconsideration appeal, and the outcome is unresolved. The second concerns three open investigative files, reported to have been opened in September 2026, into an alleged dark-web exposure of Costa Ricans' personal data, with no resolution reported to date. On the question of available sanctions, Prodhab is reported, via secondary commentary, to be empowered to impose graduated fines of up to thirty base salaries, equivalent to roughly USD 30,500, together with database suspension of between one and six months for the gravest infractions under Law No. 8968. This penalty-scale information rests on secondary reporting rather than on independently re-verified primary statutory text, so the specific figures should be treated as indicative of the regime's general severity rather than as confirmed to the cent. Neither of the two active enforcement matters has yet resulted in a disclosed penalty under this scale; both remain at the investigative or appeal stage. #### Outlook The outcomes of the Electoral Tribunal's appeal and of the three dark-web investigative files are the two matters to watch for actual application of Prodhab's enforcement powers. Should either matter conclude with a formal sanction, that would be the first concrete test of the penalty framework described above as applied to a live case, providing a clearer picture of how Prodhab's stated enforcement powers translate into practice. Periodic update · new data 2026-10-18 #### Enforcement & Redress Prodhab opened an ex officio administrative investigation, expediente No. 425-09-2026, on 16 September 2026, following a dark-web claim describing a database containing more than 400 million lines of Costa Rican residents' personal data. Prodhab subsequently confirmed that it holds three related open expedientes connected to this matter. As of the most recent reporting, spanning 7 to 18 October 2026, the investigation remained active and unresolved, and is reportedly being pursued on parallel administrative and criminal tracks, indicating that the exposure is being treated as a matter potentially involving criminal as well as regulatory liability. This is the most significant enforcement-and-redress development for Costa Rica this cycle, both for its scale, over 400 million lines of data claimed exposed, and for its apparent connection to the credit and financial data sector, since commentary following the leak specifically addressed credit bureaus' registration and breach-notification obligations under Ley 8968. The investigation's eventual outcome, whether it results in sanctions, a public resolution, or a finding of no violation, has not yet been reported and remains open. As standing context, Ley 8968 tiers infractions into three severity levels, with the most serious, classified as gravisimas, carrying fines of up to 30 base salaries alongside the possible suspension of the offending database's Prodhab registration. This penalty structure predates the current cycle and is unchanged, but it is the framework against which any eventual sanction arising from expediente 425-09-2026 would be assessed, should Prodhab conclude the investigation with a finding of infraction. #### Outlook The outcome of expediente 425-09-2026, and the three related open expedientes Prodhab has confirmed, is the central enforcement item to watch. Given the scale of the alleged exposure and the parallel administrative and criminal tracks reportedly being pursued, any resolution, sanction, or further procedural development would be a significant data-protection enforcement event for Costa Rica. No resolution had been reported as of the most recent information available this cycle, and the matter remains open. Periodic update · new data 2026-10-11 #### Enforcement & Redress Prodhab's Resolution N.° 029-2026-RF is the most significant enforcement action identified in Costa Rica this cycle, and arguably one of the more significant in the authority's history given its target. The resolution found the Tribunal Supremo de Elecciones' VID biometric-identification practice unlawful absent express consent, classified fingerprint and photograph data as sensitive personal data, and ordered cancellation of the Civil Registry database's registration with Prodhab. The TSE has announced it will file a recurso de revocatoria against the resolution and has warned of possible effects on public services, meaning the practical enforceability of the sanction, including whether the registration cancellation takes effect, remains unresolved pending that appeal. This action should be read against the backdrop of Costa Rica's existing redress architecture under Ley 8968. Data subjects exercise rights first against the responsible party directly; only where that party fails to respond, or the data subject remains dissatisfied, does escalation to Prodhab become available as a secondary route. Separately, article 28 of the law vests Prodhab with supervisory, registration, inspection, complaint-resolution, corrective-order and sanctioning powers, the same powers invoked in the TSE resolution. Civil-society commentary, albeit resting on a single, lower-tier source, suggests that Prodhab's broader caseload management is strained: the authority reportedly receives a high volume of complaints and lacks clear control over case-resolution time, with some cases taking over a year to resolve. The TSE matter is therefore both an enforcement escalation, cancellation of a registration being among Prodhab's more severe available sanctions, and a test of Prodhab's institutional capacity to enforce findings against another constitutionally significant public body that disputes both the factual premise and the legal basis of the finding. #### Outlook The outcome of the TSE's recurso de revocatoria will determine whether Resolution 029-2026-RF stands, is modified, or is overturned, and will be the clearest available indicator of how enforceable Prodhab's sanctioning powers are against a major public-sector counterpart. No confirmed timeline for resolution of the appeal was identified this cycle. Separately, concerns about Prodhab's general case-resolution capacity, while resting on thinner sourcing, suggest that even a favourable outcome for Prodhab in this matter may not translate into swift broader enforcement capacity across its full complaint caseload. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 123 words · 14 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action