Costa Rica

The Act itself, at its scope article, simply covers personal data held in automated or manual databases of public or private bodies and all later use of that data. The effects test comes from the implementing regulation, whose scope article extends the regime to such data 'insofar as they produce effects within the national territory, or Costa Rican law applies to them by virtue of a contract or under international law'. Databases kept purely for internal, personal or household purposes fall outside, but only for as long as they are not sold, distributed or otherwise commercialised. A 2016 amendment also carved out data about individuals in their professional capacity where the processing serves the profession or complies with a legal duty. Registration, where required, asks for a named 'responsable' before the Agency and before third parties, with a contact address, plus the physical location of each database; the regulation does not say that person must live in Costa Rica.

Rated conditional, not open, because the general rule is a consent gate rather than a free flow. The Act's transfer chapter has a single article: controllers of public or private databases 'may only transfer data contained in them where the holder of the right has expressly and validly authorised that transfer'. The implementing regulation then defines the word narrowly. A 'transfer' is a handover from one controller to a receiving controller. It expressly does not cover moving data from a controller to a processor, a service provider, a technology intermediary, or to companies in the same economic-interest group. The definitions article reinforces this: a database shared inside one economic-interest group, 'local or with an international presence', stays an 'internal database' as long as nothing is disseminated, distributed or sold to third parties. In practice that means hosting Costa Rican customer data in a foreign cloud region, or replicating it to a parent company overseas, sits outside the consent gate; selling a marketing list to an unrelated company, even one down the street in San Jose, sits inside it. SECTOR OVERRIDES, all of which add duties rather than walls. Banking and finance: no residency rule, but under the technology governance regulation supervised entities must file an annual technology profile that reports, for each cloud service, the country code, cloud region and zone, the service and deployment model, and the location of cloud and offline backups. Telecoms: no residency rule, but traffic and location data must be deleted or made anonymous once they are no longer needed to carry the communication or provide the service, and identified network security risks must be reported to the telecoms regulator. Government: no residency rule found; a cybersecurity governance decree for government institutions exists but we could not open its text. Health, insurance, securities, education, gambling, mapping and defence: no residency or transfer-specific rule found, checked 19 August 2026, medium confidence. Costa Rica notably does not license online gambling at all, so there is no gambling data regulator to impose one.

The model is case-by-case, but the case is decided by the data subject rather than by an official. There is no adequacy list, no blocklist, no allowlist and no government-published standard contractual clauses. Because there are no lists, the question of whether a list is populated does not arise, and there is no dormant list power in the Act that could be switched on by notification. The regulation adds three operational requirements around the consent. Its article 43 requires the exporting controller to conclude a contract with the receiving controller providing for at least the same obligations the exporter is subject to. Its article 41 makes transfers conditional on faithful compliance with the minimum handling protocols registered with the Agency. Its article 42 places the burden of proof squarely on the controller to show the transfer complied with the Act and the regulation. Under the Act, a registered handling protocol creates a rebuttable presumption of compliance, which is the closest thing Costa Rica has to a safe harbour. Remember the carve-out in question two: none of this bites where the recipient is your processor, service provider, technology intermediary or a company in your own economic-interest group.

PRODHAB was created by the Act as a body with maximum administrative autonomy attached to the Ministry of Justice and Peace, with its own legal personality for managing its budget and contracts, and independence of judgement. Its powers include keeping the register of databases, demanding information and protocols, accessing regulated databases, deciding complaints, ordering deletion, correction or restriction of data, imposing the Act's fines, and referring anything that might be a crime to the public prosecutor. Evidence it is operational: a named director signing 2026 planning documents; 2026 operating and financial plans filed with the budget authority; a strategic plan running 2025 to 2030; site last modified 14 August 2026. Evidence it is not yet aggressive: the published 'depersonalised resolutions' tabs on its own transparency page run 2018, 2019, 2020, 2021, 2022 and 2023 and stop there, so no decision from 2024, 2025 or 2026 is publicly available from the Agency itself; and the fine ceiling is roughly 27,000 US dollars. The one visible 2025 action, a precautionary measure restraining the Banco Central de Costa Rica from requiring non-anonymised data, is reported by professional and press sources rather than published by the Agency. Sector regulators are separately and clearly active: the banking supervisor collects annual technology profiles, and the telecoms regulator issues binding consumer-protection measures. Rated waking rather than active because the Agency's own public record of decisions has not moved for over two years.

The ceiling sits in the data-quality article of the Act, under the heading of keeping data current. Two duties run in parallel: a general one to erase data that has stopped being relevant or necessary for the purpose it was collected for, and the absolute ten-year cut-off for data capable of affecting the person, counted from the date the recorded events occurred. The conflict rule is written into the same sentence: the ceiling applies 'unless a special legal provision provides otherwise'. So a tax, accounting, anti-money-laundering or health record-keeping duty with its own period displaces the ten-year rule for the records it covers, and the safe reading is to keep only what the specific duty requires and dissociate or delete the rest. In telecoms the direction is the opposite of a floor: the sector rules require operators to erase or anonymise traffic and location data once they are no longer needed to carry the communication or to provide and bill the service. We did not verify Costa Rica's general tax and commercial record-keeping floors against a government source in this pass; see the unconfirmed list.

Clock one, everyone: the regulation's article 38 gives five working days from the moment the breach occurred to inform the data subject about any irregularity in the handling or storage of their data, such as loss, destruction or misplacement, resulting from a security failure, so that affected people can protect themselves. The same five-day window triggers a duty to begin an exhaustive review of the scale of the damage and the corrective and preventive measures needed. Article 39 sets the minimum content and, importantly, requires that content to go to the data subject AND to the Agency. Note the clock starts when the breach happened, not when you found out, which is stricter than the discovery-based clocks used in Europe and much of Asia. Clock two, telecoms: operators of public networks and publicly available services must inform the telecoms regulator and users where the operator becomes aware of an identifiable risk to network security. No fixed hour count is given in the statute. Clock three, government: MICITT runs a 24/7 national security operations centre and a national computer security incident response team for central government institutions, with a dedicated incident reporting mailbox, and a cybersecurity governance decree for government institutions. We could not open that decree's text, so any deadline in it is unverified. Clock four, banks: supervised financial entities report operational and technology incidents to the banking supervisor under the technology governance regulation; we could not open that text either and have not verified a deadline. The overlap that hurts is clock one against clock four: a payments outage at a bank is simultaneously a supervisory incident and, if customer data moved, a five-working-day notification to customers and to PRODHAB.

1. THE TRANSFER CARVE-OUT CUTS BOTH WAYS. Because processors, service providers, technology intermediaries and same-group companies are excluded from the definition of transfer, international cloud hosting is easy. But the Act does not distinguish domestic from cross-border in its general rule, so a purely domestic handover to an unrelated controller needs the same express consent as an export. Teams that build their consent flow around 'international transfer' language miss the domestic half. 2. TEN YEARS IS A HARD STOP. Data capable of affecting the person must be gone, or dissociated from the person, ten years after the recorded events, unless a specific legal rule says keep it. Retention schedules imported from Europe or the United States will breach this. 3. EXPORT WITHOUT CONSENT IS A 'FALTA GRAVISIMA'. Article 31 lists, as the most serious class of offence, transferring to third-country databases the personal data of Costa Ricans or of foreigners resident in the country without their holders' consent. The sanction for that class is 15 to 30 base salaries plus suspension of the file's operation for one to six months. The suspension, not the fine, is the commercial threat. 4. REGISTRATION, THE FEE AND THE LOCATION DISCLOSURE. Any database, public or private, run for the purposes of distribution, dissemination or commercialisation must be entered on PRODHAB's register, and the registration form asks for the names of the databases and their physical location, the categories of data, the collection procedures and a technical description of the security measures. There is a flat annual fee of 200 US dollars, plus a per-query fee of between 25 US cents and 1 US dollar on commercial sales of individualised records, capped at ten per cent of the contract price. Processing without being registered when you should be is itself a most serious offence. Financial entities supervised by the banking supervisor are exempt from registering, but PRODHAB keeps full competence over them, which is a distinction people routinely get backwards. 5. SMALL FINES, REAL CRIMINAL TAIL. The maximum administrative fine is 30 base salaries. The base salary for 2026 was fixed at 462,200 colones, so the ceiling is about 13.9 million colones, roughly 27,000 US dollars. But the sanctions article opens with the words 'without prejudice to the corresponding criminal sanctions', and PRODHAB is required to refer anything that might be a crime to the public prosecutor. 6. BONUS TRAP: the breach clock runs from when the breach happened, not from when you discovered it.

PENDING LEGISLATION. Legislative file 23.097, 'Ley de Proteccion de Datos Personales', would replace the 2011 Act with a European-style regime: lawful bases beyond consent, data protection officers, formal international transfer mechanisms, and a stronger regulator. The telecoms regulator filed a formal technical opinion on it, which is our government evidence that the file exists and was consulted on. As of today PRODHAB's own website still states that the Act has never been reformed, so the bill has not become law. We could not read the parliament's own case-tracking system, which blocks automated access, so the bill's current committee stage is unverified. Do not plan around it. DORMANT SWITCHES, which matter more. First and most important: almost everything that makes Costa Rica permissive lives in the implementing decree, not the Act. The exclusion of processors, service providers, technology intermediaries and same-group companies from the definition of 'transfer', the treatment of internationally shared group databases as merely 'internal', and the exemption of bank databases from registration were all inserted by executive decree in 2016. A president and a minister can narrow any of them by signing another decree, with no parliamentary vote and no consultation requirement. If that carve-out were removed, every foreign cloud deployment in the country would suddenly need per-person consent. Second: the Act empowers PRODHAB to issue binding directives, published in the official gazette, telling public institutions how to handle personal data. Third: a cybersecurity governance decree for government institutions was consulted on in April 2025 and MICITT now refers to it as decree 45061; its obligations on public bodies and their suppliers are in force but we have not read them. Fourth: a 2023 decree already imposes cybersecurity measures on 5G and higher telecommunications networks.