Costa RicaProtección de la Persona frente al Tratamiento de sus Datos Personales
Ley No. 8968, Proteccion de la Persona frente al Tratamiento de sus Datos Personales
In force since .
A comprehensive regime rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Enforcement body
- Agencia de Proteccion de Datos de los Habitantes (Prodhab)
- Obligation class
- Consent, Data subject rights, Transfer, Security, Licensing
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Before collecting a person's personal data, inform them of the purpose of collection and obtain their express, written consent, unless the data are publicly accessible or a law or judicial order compels disclosure.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
- Do not process data revealing racial or ethnic origin, political opinions, religious convictions, health, or sexual orientation without the data subject's consent or another narrow statutory ground.NIST Privacy FrameworkCT.PO-P1
- Adopt technical and organizational security measures to prevent the alteration, loss, or unauthorized access of personal data.NIST Privacy FrameworkPR.DS-P5
- Do not transfer personal data to a third party or abroad without the data subject's express, valid authorization.NIST Privacy FrameworkCT.PO-P2
- Do not use collected data for a purpose incompatible with the one disclosed at collection.NIST Privacy FrameworkGV.PO-P1
- Register any database administered for distribution, dissemination, or commercialization purposes with the Prodhab.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 5(2) requires the person who collects personal data to obtain the data subject's express consent and requires that consent to be recorded in writing, in a physical or electronic document, and revocable in the same way. A controller must hold that document to show the consent, but the article names no log. Article 16(c) and (d) let the Prodhab require information from the people who run databases and access the databases to enforce the Law, and Article 26 adds inspections in their files, which is the regulator's own power. The register of databases of Articles 16(b) and 21 is the Prodhab's, and no period for keeping the consent record is stated. Article 2 limits the Law by the kind of database and names no territorial hook, so the hook is empty.
- Kind
- Implicit
- As of
- Provision
- Article 5(2)
- Trigger
- consent_or_optout
What this law does
Article 1 makes the law's object guaranteeing any person, regardless of nationality, residence or domicile, their right to informational self-determination over their private life; article 2 applies it to personal data in any automated or manual database of a public or private body, excluding a database kept for exclusively internal, personal or domestic purposes that is never sold or commercialized.
Article 5 requires a data controller to inform a person before collecting their data and to obtain their express, written consent, revocable without retroactive effect, unless the data are publicly accessible or the disclosure is compelled by judicial order or law.
Article 9 prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical convictions, health, life, or sexual orientation, subject to narrow exceptions such as the data subject's own public disclosure or vital-interest necessity. Article 10 requires the controller to adopt technical and organizational security measures. Article 14 conditions any transfer of the data on the data subject's express, valid authorization.
The Prodhab, created by article 15 as an agency attached to the Ministry of Justice and Peace, enforces the law through a complaint procedure (arts. 24-27) and a tiered sanction scale of administrative fines set in multiples of the base salary of a first-level judicial aide, running from up to five base salaries for a minor infraction to fifteen to thirty base salaries plus a suspension of the database's operation of one to six months for the most serious infraction.
A public-sector controller instead receives a corrective resolution rather than a fine. The law itself imposes no criminal penalty and refers conduct that may constitute a crime to the Public Prosecutor's Office. A separate Codigo Penal provision, article 196 bis, carries the criminal exposure for the same underlying conduct. The law is dated at the Presidency of the Republic, and it came into force on its publication.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .