Costa Rica

The Act's scope article covers personal data held in automated or manual databases of public or private bodies. It also covers all later use of that data. The effects test comes from the regulation that implements the Act. Its scope article extends the rules to such data where the data produces effects inside the country. It also applies where Costa Rican law covers the data under a contract or under international law. Databases kept purely for internal, personal or household purposes fall outside. That only lasts while they are not sold, distributed or otherwise sold on. A 2016 amendment also removed data about people in their professional role, where the use serves the profession or meets a legal duty. Where registration applies, you must name a 'responsable', the person answerable to the Agency and to the public. You give a contact address and the physical location of each database. The regulation does not say that person must live in Costa Rica.

We rate this conditional rather than open, because the general rule is a consent gate rather than free movement. The Act's transfer chapter has a single article. Whoever runs a public or private database may only pass on data from it if the person has expressly and validly authorised that. The regulation then defines the word narrowly. A 'transfer' means a handover from one organisation that decides how data is used to another such organisation. It expressly does not cover moving data to a supplier, a service provider, a technology intermediary, or to companies in the same economic-interest group. The definitions article backs this up. A database shared inside one economic-interest group stays an 'internal database', whether the group is local or international. That holds as long as nothing is spread, distributed or sold to outsiders. So hosting Costa Rican customer data in a foreign cloud region sits outside the consent rule. So does copying it to a parent company overseas. Selling a marketing list to an unrelated company sits inside the rule, even if that company is down the street in San Jose. Industry rules add duties rather than walls. Banking and finance: no rule that data must stay in the country. But under the technology governance regulation, supervised firms must file an annual technology profile. For each cloud service it reports the country code and the cloud region and zone. It also reports the service and deployment model, and where cloud and offline backups sit. Telecoms: no rule that data must stay in the country. But traffic and location data must be deleted or made anonymous once no longer needed to carry the communication or provide the service. Identified network security risks must be reported to the telecoms regulator. Government: we found no rule that data must stay in the country. A cybersecurity governance decree for government institutions exists, but we could not read its text. Health, insurance, securities, education, gambling, mapping and defence: we found no rule on storage location or on transfers, checked 19 August 2026, medium confidence. Costa Rica does not license online gambling at all, so there is no gambling data regulator to impose one.

Costa Rica decides case by case, and the person decides, not an official. There is no list of countries judged safe enough. There is no list of banned countries and no list of approved ones. The government publishes no standard contract clauses. Because there are no lists, there is no question of whether a list has been filled in. The Act contains no unused list power that could be switched on by notice. The regulation adds three practical requirements around the consent. Article 43 requires the sending organisation to sign a contract with the receiving organisation. That contract must impose at least the same duties the sender is under. Article 41 makes transfers conditional on faithfully following the minimum handling protocols registered with the Agency. Article 42 puts the burden of proof on the sender to show the transfer met the Act and the regulation. Under the Act, a registered handling protocol creates a presumption that you complied, which can be rebutted. That is the closest thing Costa Rica has to a safe harbour. Remember the exception in question two. None of this applies where the recipient is your supplier, service provider, technology intermediary or a company in your own economic-interest group.

The Act created PRODHAB as a body with maximum administrative autonomy attached to the Ministry of Justice and Peace. It has its own legal personality for managing its budget and contracts. It also has independence of judgement. Its powers cover several things. Keeping the register of databases. Demanding information and protocols. Getting access to regulated databases. Deciding complaints. Ordering data to be deleted, corrected or restricted. Imposing the Act's fines. And referring anything that might be a crime to the public prosecutor. Signs it is working. A named director signed 2026 planning documents. The 2026 operating and financial plans are filed with the budget authority. A strategic plan runs 2025 to 2030. The site was last modified 14 August 2026. Signs it is not yet aggressive: the 'depersonalised resolutions' tabs on its own transparency page cover 2018 to 2023 and stop there. No decision from 2024, 2025 or 2026 is publicly available from the Agency itself. The top fine is roughly 27,000 US dollars. The one visible 2025 action was a precautionary measure stopping the Banco Central de Costa Rica from requiring data that had not been made anonymous. That is reported by professional and press sources, not published by the Agency. Industry regulators are clearly active. The banking supervisor collects annual technology profiles. The telecoms regulator issues binding consumer protection measures. We rate the Agency waking rather than active, because its own public record of decisions has not moved for over two years.

The ten-year limit sits in the Act's data-quality article, under the heading about keeping data current. Two duties run in parallel. One is general: erase data that has stopped being relevant or necessary for the purpose you collected it for. The other is the absolute ten-year cut-off for data that could affect the person. That is counted from the date the recorded events happened. The clash rule sits in the same sentence. The ten-year limit applies unless a special legal rule says otherwise. So a tax, accounting, anti-money-laundering or health record-keeping duty with its own period beats the ten-year rule for the records it covers. The safe approach is to keep only what the specific duty requires. Strip the identifying details from the rest, or delete it. Telecoms goes the other way. The sector rules require operators to erase traffic and location data, or make it anonymous, once it is no longer needed. That means once it is no longer needed to carry the communication or to provide and bill the service. We did not check Costa Rica's general tax and commercial record-keeping minimums against a government source. See the unconfirmed list.

Deadline one, for everyone. Article 38 of the regulation gives five working days from the moment the breach happened. In that time you must tell the person about any problem in the handling or storage of their data. That covers loss, destruction or misplacement caused by a security failure. The point is to let affected people protect themselves. The same five-day window starts a duty to begin a full review of the scale of the damage. You must also work out the corrective and preventive measures needed. Article 39 sets the minimum content of the notice. That content must go to the person and to the Agency. Note that the clock starts when the breach happened, not when you found out. That is stricter than the discovery-based deadlines used in Europe and much of Asia. Deadline two, telecoms. Operators of public networks and publicly available services must tell the telecoms regulator and their users. This applies where the operator learns of an identifiable risk to network security. The statute gives no fixed number of hours. Deadline three, government. MICITT runs a national security operations centre around the clock. It also runs a national computer security incident response team for central government institutions. There is a dedicated incident reporting mailbox and a cybersecurity governance decree for government institutions. We could not read that decree, so any deadline in it is unconfirmed. Deadline four, banks. Supervised financial firms report operational and technology incidents to the banking supervisor under the technology governance regulation. We could not read that text either, so we have not confirmed a deadline. The painful overlap is deadline one against deadline four. A payments outage at a bank is a supervisory incident. If customer data moved, it is also a five-working-day notice to customers and to PRODHAB.

1. THE TRANSFER EXCEPTION CUTS BOTH WAYS. Suppliers, service providers, technology intermediaries and same-group companies are left out of the definition of transfer. So international cloud hosting is easy. But the Act's general rule makes no difference between domestic and cross-border. A purely domestic handover to an unrelated organisation needs the same express consent as an export. Teams that build their consent flow around 'international transfer' wording miss the domestic half. 2. TEN YEARS IS A HARD STOP. Data that could affect the person must be gone ten years after the recorded events. Or it must be stripped of anything linking it to the person. A specific legal rule can say keep it. Keeping schedules copied from Europe or the United States will break this rule. 3. EXPORT WITHOUT CONSENT IS A 'FALTA GRAVISIMA'. Article 31 lists this as the most serious class of offence. It covers sending the personal data of Costa Ricans, or of foreigners living in the country, to databases in another country without the holders' consent. The penalty for that class is 15 to 30 base salaries. It also suspends the file's operation for one to six months. The suspension, not the fine, is the commercial threat. 4. REGISTRATION, THE FEE AND THE LOCATION DISCLOSURE. Any database, public or private, run to distribute, spread or sell data must go on PRODHAB's register. The registration form asks for the names of the databases and their physical location. It also asks for the categories of data, the collection procedures and a technical description of your security measures. There is a flat annual fee of 200 US dollars. There is also a per-query fee of 25 US cents to 1 US dollar on commercial sales of individual records. That fee is capped at ten per cent of the contract price. Running a database unregistered when you should have registered is itself a most serious offence. Financial firms supervised by the banking supervisor do not have to register. PRODHAB still keeps full power over them. People routinely get that pair the wrong way round. 5. SMALL FINES, REAL CRIMINAL TAIL. The top administrative fine is 30 base salaries. The base salary for 2026 was fixed at 462,200 colones. So the top fine is about 13.9 million colones, roughly 27,000 US dollars. But the sanctions article opens by saying it applies without prejudice to the matching criminal penalties. PRODHAB must refer anything that might be a crime to the public prosecutor. 6. ONE MORE TRAP. The breach clock runs from when the breach happened, not from when you discovered it.

PENDING LEGISLATION. Legislative file 23.097, 'Ley de Proteccion de Datos Personales', would replace the 2011 Act with European-style rules. It would allow legal bases other than consent. It would require data protection officers. It would add formal routes for sending data abroad. And it would give the regulator more power. The telecoms regulator filed a formal technical opinion on it. That is our government evidence that the file exists and was consulted on. As of today PRODHAB's own website still says the Act has never been reformed. So the bill has not become law. We could not read parliament's own case-tracking system, which blocks automated access. So we cannot confirm which committee stage the bill is at. Do not plan around it. RULES THAT CAN CHANGE WITHOUT WARNING. These matter more. First, and most important: almost everything that makes Costa Rica permissive sits in the decree that implements the Act, not in the Act itself. Suppliers, service providers, technology intermediaries and same-group companies were left out of the definition of 'transfer' by executive decree in 2016. So was the treatment of internationally shared group databases as merely 'internal'. So was the exemption of bank databases from registration. A president and a minister can narrow any of these by signing another decree. There is no parliamentary vote and no duty to consult. If that exception went, every foreign cloud deployment in the country would suddenly need consent from each person. Second, the Act lets PRODHAB issue binding directives in the official gazette. These tell public institutions how to handle personal data. Third, a cybersecurity governance decree for government institutions was consulted on in April 2025. MICITT now calls it decree 45061. Its duties on public bodies and their suppliers are in force, but we have not read them. Fourth, a 2023 decree already imposes cybersecurity measures on 5G and higher telecommunications networks.