{
  "node_id": "cr-pdp-law-2011",
  "title": "Costa Rica Personal Data Protection Law No. 8968 2011 - PRODHAB",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-04-27",
  "bluf": "Costa Rica's Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (Personal Data Protection Law) - Law No. 8968 of 5 July 2011, published in La Gaceta (official gazette) No. 170 on 5 September 2011 and entered into force on 5 March 2012 - is Costa Rica's primary personal data protection legislation. The implementing regulation, Executive Decree No. 37554-JP of 30 October 2012, provides detailed rules for compliance. Law No. 9736 of 14 July 2020 amended Law No. 8968 to introduce mandatory breach notification obligations. The supervisory authority is the Agencia de Protección de Datos de los Habitantes (PRODHAB - Agency for the Protection of Residents' Data), an independent public body operating under the Ministry of Justice and Peace of Costa Rica. PRODHAB registers personal data databases, investigates complaints, and enforces Law No. 8968. Key features of Costa Rica's Law No. 8968: (1) Scope - applies to any individual or legal entity that collects, stores, transfers, or uses personal data of natural persons (habitantes) in Costa Rica; (2) Data processing principles - the law requires compliance with: purpose limitation; proportionality; informed consent; quality (accuracy); security; confidentiality; and transparency; (3) Sensitive personal data - the law establishes heightened protection for data revealing: racial or ethnic origin; political opinions; religious convictions; trade union membership; health status; sex life; (4) ARCO rights - data subjects (habitantes) have the rights of Acceso (access), Rectificación (rectification), Cancelación (cancellation/deletion), and Oposición (opposition); (5) Consent - processing personal data generally requires the data subject's free, informed, specific, and express consent; specific exceptions apply (legal obligation, contract necessity, vital interests, public interest); (6) Database registration - any individual or legal entity maintaining a personal data database must register it with PRODHAB through the Registro Nacional de Bases de Datos (National Database Registry) before processing commences; (7) Breach notification - Law No. 9736 of 2020 introduced mandatory notification to PRODHAB when a security breach occurs that may harm the fundamental rights of data subjects; notification must be made within five business days of discovering the breach; data subjects must also be notified; (8) Cross-border transfers - personal data may only be transferred to countries or organisations providing equivalent or superior protection; transfers to non-adequate countries require PRODHAB authorisation; (9) Administrative sanctions - PRODHAB may impose fines ranging from one to seventy-five base wages (salarios base, the Costa Rican judicial base salary unit) for violations of Law No. 8968; (10) Criminal penalties - violations of data protection rights may give rise to criminal liability under applicable criminal law provisions. Costa Rica occupies a significant position in Central American data governance as the most advanced economy in the region, with a growing technology sector, significant medical devices and pharmaceutical manufacturing, and an established free trade zone economy that processes large volumes of personal data of regional and international data subjects.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "ai_overlay_2026"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "iso-27001-2022",
    "iso-27701-privacy-information-management"
  ],
  "primary_citations_count": 7
}