What Is Ley N.° 8968, Protección de la Persona frente al Tratamiento de sus Datos Personales?
Costa Rica’s principal general personal-data statute is Ley N.° 8968, Protección de la Persona frente al Tratamiento de sus Datos Personales. PRODHAB’s official legislation page identifies its approval in 2011, publication in La Gaceta on 5 September 2011, and implementing regulation by Executive Decree N.° 37554-JP. The same page says the statute itself has not undergone reforms, while the regulation was modified in 2016 and 2019. The statute creates PRODHAB and gives it supervisory, complaint-resolution, database-registration, corrective, and sanctioning functions. The reviewed statutory and regulator materials are primarily in Spanish; this explainer records only provisions that were confirmed from those official materials and does not treat an English secondary summary as a substitute for the Spanish text. For data-broker research, the clearest verified feature is the registration requirement for public or private databases intended for commercialization, distribution, or commercial dissemination. No official source reviewed in this pass identified a separate people-search registry, broker-specific deletion portal, or broker-specific enforcement history.
At a glance
- Full name
- Ley N.° 8968, Protección de la Persona frente al Tratamiento de sus Datos Personales
- Short code
- Ley 8968
- Jurisdiction
- Costa Rica
- Enacted
- 2011
- Last major update
- PRODHAB states that Ley N.° 8968 itself has not undergone reforms; its regulation was modified by Executive Decrees N.° 40008-JP (2016) and N.° 41582 (2019). No later amending statute was located in the reviewed official sources
- Regulator
- Agencia de Protección de Datos de los Habitantes (PRODHAB)
- Private right of action
- Limited
Scope, who Ley 8968 covers
Protected data
Data subject rights
Right to know whether personal data are held and to obtain access to the data and relevant processing information
Right to rectification or updating of inaccurate, incomplete, or outdated personal data
Right to request suppression, deletion, or blocking where data are unlawfully processed, inaccurate, no longer necessary, or retained without a valid basis
Right to control disclosure or transfer through informed consent, subject to statutory exceptions
Right to object to or restrict processing through the procedures described in the statute, regulation, and PRODHAB guidance
Requests for access, rectification, and deletion are described by PRODHAB as free; the statute provides a five-business-day response period for the relevant request procedure
Notable features
PRODHAB’s official FAQ says public and private databases intended for commercialization, distribution, or commercial dissemination must be registered, while certain financial databases supervised by SUGEF are exempt from registration but remain subject to data-subject rights jurisdiction. The official materials also require informed consent for transfers to third countries unless a legal exception applies. The regulatory framework includes a retention or deletion rule for data older than ten years unless a special rule applies.
Enforcement & penalties
Regulator: Agencia de Protección de Datos de los Habitantes (PRODHAB)
Penalties: Article 28 provides administrative fines measured by the base salary of a Judicial Branch Auxiliary Court Officer I: up to 5 base salaries for a light infraction, 5–20 for a serious infraction, and 15–30 for a very serious infraction. Very serious conduct includes specified unlawful processing, disclosure, transfer, and failure to register where registration is required. The amount and classification depend on the facts and applicable procedure.
Private right of action: The reviewed statute clearly provides an administrative complaint route before PRODHAB and preserves applicable jurisdictional and penal remedies. It does not, in the reviewed provisions, state a general standalone private damages action for every data incident; any judicial claim depends on the applicable Costa Rican procedure and facts.
Relevance to data brokers
Costa Rica has verified broker-relevant regulation because commercial-distribution databases generally fall within PRODHAB’s registration framework and non-registration can be a very serious infraction. No official people-search-specific guidance, public-record suppression process, broker opt-out registry, or named enforcement history was located in the reviewed sources.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does Costa Rica have a comprehensive personal-data law?+
Yes. Ley N.° 8968, Protección de la Persona frente al Tratamiento de sus Datos Personales, was published on 5 September 2011. PRODHAB’s current legislation page says the statute itself has not undergone reforms, while its implementing regulation has been modified.
What rights can a person exercise under Costa Rica’s framework?+
The reviewed statute and PRODHAB materials support access, rectification or updating, suppression or deletion, and control of disclosure or transfer. PRODHAB describes these request routes as free and gives a five-business-day response period for the relevant procedure.
Can I ask a Costa Rican data broker to remove my information?+
A commercial database is subject to the general PRODHAB framework and, in many cases, registration requirements. No separate people-search-specific removal portal was located, so the practical route depends on the database operator and the facts of the request.
Official sources & citations
Other international privacy regimes
Ley 8968 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: