Countries › Costa Rica › Guide › 13. Regulation › Personal data protection in Costa Rica: Ley 8968, PRODHAB, consent and breach notice

Personal data protection in Costa Rica: Ley 8968, PRODHAB, consent and breach notice

Last verified: 2026-10-30 · Status: Stable

Ley 8968 protects anyone's personal data, whatever their nationality, in automated or manual databases. Collection needs prior notice and written, express consent (paper or electronic), data subjects must get answers within five business days, and transfers to third parties need consent. Databases run to distribute, disseminate or sell data must register with PRODHAB and pay US$200 a year. Breaches must be reported within five business days, and fines reach 30 base salaries plus a suspension of up to six months.

USD figures use the Banco Central de Costa Rica reference selling rate of ₡454.82 per US dollar published for 29 October 2026 (indicator 318 on bccr.fi.cr), rounded to the cent. Salario base figures use ₡462,200 for 2026 (Poder Judicial Circular 246-2025 under Ley 7337 art. 2).

Key facts

Breach notice to data subjects	5 business daysDE 37554 art. 38, as of 2026-10-30 · in force
Response to access, rectification or deletion requests	5 business daysLey 8968 art. 7, as of 2026-10-30 · in force
Annual canon for registrable databases	200 USDLey 8968 art. 33, as of 2026-10-30 · in force
Maximum fine for very serious infringements	30 base salaries (judicial assistant I)Ley 8968 art. 28(c), as of 2026-10-30 · in force

The rule

1. The law protects the informational self determination of any person, regardless of nationality, residence or domicile, in automated or manual databases, public or private; databases kept for purely internal, personal or domestic purposes are excluded if not sold or otherwise commercialised.Ley 8968, Protección de la Persona frente al Tratamiento de sus Datos Personales, art. 1 and 2, 2011-07-07 official text · verified 2026-10-30

2. Before collecting data the controller must tell the data subject, expressly and precisely, about the database, purposes, recipients, whether answers are mandatory, the processing, consequences of refusal, their rights and the controller's identity and address.Ley 8968, art. 5(1), 2011-07-07 official text · verified 2026-10-30

3. Express consent in writing, on paper or electronically, is required and can be revoked; it is not needed for court orders, unrestricted public source data or data delivered by legal mandate.Ley 8968, art. 5(2), 2011-07-07 official text · verified 2026-10-30

4. Data subjects may access, rectify and delete their data free of charge, and the controller must respond within five business days.Ley 8968, art. 7, 2011-07-07 official text · verified 2026-10-30

5. Controllers must adopt technical and organisational security measures; staff are bound by confidentiality even after the relationship ends.Ley 8968, art. 10 and 11, 2011-07-07 official text · verified 2026-10-30

6. Personal data may be transferred only with the data subject's express and valid authorisation; transfer to a processor, service provider or companies in the same economic group is not a transfer, but a transferor must sign a contract imposing at least its own obligations on the recipient.Ley 8968 art. 14; DE 37554-JP (art. 40 as amended by DE 40008), Ley 8968 art. 14; DE 37554 art. 40 and 43, 2016-07-19 official text · verified 2026-10-30

7. Databases run for distribution, dissemination or commercialisation must be registered with PRODHAB, together with any action protocols; protocols registered with PRODHAB create a rebuttable presumption of compliance for data transfers.Ley 8968, art. 12 and 21, 2011-07-07 official text · verified 2026-10-30

8. Registrable databases pay an annual canon of US$200, payable from 1 to 31 January (pro rata within one month when processing starts later), and US$1 per data subject record sold, payable within the first ten business days of the next month.
Cost to do it: US$200 a year per registered database, plus US$1 per record sold.
Example: About ₡90,964 a year at the 29 October 2026 rate. / US$200 a year.Ley 8968 art. 33 and 34; DE 37554-JP, DE 37554 art. 78 to 81, 2012-10-30 official text · verified 2026-10-30

9. After a security breach the controller must inform affected data subjects within five business days of the breach and start a full review; the notice to them and to PRODHAB must state the nature of the incident, data affected, corrective actions and where to get more information.DE 37554-JP, Reglamento a la Ley 8968, art. 38 and 39, 2012-10-30 official text · verified 2026-10-30

10. Minor infringements (insufficient notice, insecure collection or transmission) carry fines of up to 5 base salaries of a judicial assistant I; serious ones (processing without consent, unlawful transfers, using data for another purpose, refusing access or deletion) 5 to 20; very serious ones (private processing of sensitive data, deceit, revealing secret data, unregistered registrable databases, transfers abroad without consent) 15 to 30 plus suspension of the database for one to six months.
Cost to do it: Up to 30 base salaries of a judicial assistant I plus up to six months' suspension.Ley 8968, art. 28 to 31, 2011-07-07 official text · verified 2026-10-30

Worked example

A marketing data broker registers its database in March. It pays the US$200 canon pro rata within one month (the full year is about ₡90,964 at ₡454.82), then US$200 every January, plus US$1 per record it sells, paid within ten business days of the next month.
An online shop suffers a breach on a Monday. It must notify affected customers by the following Monday (five business days), explaining what happened, which data were exposed, what it did and where to ask.

Step by step

Inventory databases and decide whether any is run to distribute or sell data (registration with PRODHAB).
Update collection forms with the art. 5 notice and capture express written or electronic consent.
Set a five business day workflow for access, rectification and deletion requests.
Sign contracts with processors and any transferee; get consent before any transfer, including abroad.
Prepare a breach response plan that meets the five business day notice.

Common traps

Sending customer data to a non group company abroad without consent is a very serious infringement.
Private sector processing of sensitive data counts as very serious unless an exception applies.
Consent must be documented in writing or electronically; the controller bears the burden of proof.
Fines are set in base salaries of the judicial assistant I post, not the Ley 7337 salario base.

Sources

← Consumer protection in Costa Rica: information duties, warranties, online sales and finesAnti corruption and corporate criminal liability in Costa Rica: Ley 9699 and compliance programmes →

Get rule changes weekly

Free. One email a week from The LatAm Thread.

One more step after you press the button: we take you to Substack, where your email is already filled in. Confirm there to start. No spam, unsubscribe anytime, we never share your address. By subscribing you agree to the privacy policy.