Costa Rica's comprehensive personal-data regime is Ley No. 8968, Proteccion de la Persona frente al Tratamiento de sus Datos Personales, which binds any public or private entity that holds personal data in an automated or manual database and is enforced by the Agencia de Proteccion de Datos de los Habitantes (Prodhab) through an administrative complaint procedure and a tiered fine schedule.
A separate Codigo Penal provision, article 196 bis as reformed by Ley No. 9048, criminalizes unauthorized appropriation, copying, transmission, or other unauthorized treatment of a person's data or images, with an aggravated penalty when the data are public, belong to a minor, or reveal ideology, religion, health, racial origin, or sexual orientation.
A bill to replace Law 8968 with a General Data Protection Regulation (GDPR)-aligned regime, Expediente 23097, cleared first debate in October 2024 but was returned for reconsideration days later and has seen no further floor action since.
Article 1 makes the law's object guaranteeing any person, regardless of nationality, residence or domicile, their right to informational self-determination over their private life; article 2 applies it to personal data in any automated or manual database of a public or private body, excluding a database kept for exclusively internal, personal or domestic purposes that is never sold or commercialized.
Article 5 requires a data controller to inform a person before collecting their data and to obtain their express, written consent, revocable without retroactive effect, unless the data are publicly accessible or the disclosure is compelled by judicial order or law.
Article 9 prohibits processing data revealing racial or ethnic origin, political opinions, religious or philosophical convictions, health, life, or sexual orientation, subject to narrow exceptions such as the data subject's own public disclosure or vital-interest necessity. Article 10 requires the controller to adopt technical and organizational security measures. Article 14 conditions any transfer of the data on the data subject's express, valid authorization.
The Prodhab, created by article 15 as an agency attached to the Ministry of Justice and Peace, enforces the law through a complaint procedure (arts. 24-27) and a tiered sanction scale of administrative fines set in multiples of the base salary of a first-level judicial aide, running from up to five base salaries for a minor infraction to fifteen to thirty base salaries plus a suspension of the database's operation of one to six months for the most serious infraction.
A public-sector controller instead receives a corrective resolution rather than a fine. The law itself imposes no criminal penalty and refers conduct that may constitute a crime to the Public Prosecutor's Office. A separate Codigo Penal provision, article 196 bis, carries the criminal exposure for the same underlying conduct. The law is dated at the Presidency of the Republic, and it came into force on its publication.
Article 196 bis of the Codigo Penal, as reformed by Ley No. 9048, punishes with three to six years of imprisonment a person who, for their own benefit or a third party's, and to the danger or harm of another's privacy, without the data subject's authorization, appropriates, modifies, interferes with, accesses, copies, transmits, publishes, disseminates, compiles, disables, intercepts, retains, sells, buys, diverts to a different purpose than the one for which the data were collected, or otherwise gives unauthorized treatment to the images or data of a natural or legal person stored in a computer or telematic system or in an electronic, optical or magnetic container.
The penalty rises to four to eight years when the conduct is committed by a person who administers or supports the system or has access to it by reason of their duties, when the data are public or held in a public database, when the victim is a minor or an incapacitated person, or when the conduct affects data revealing ideology, religion, beliefs, health, racial origin, sexual preference, or sex life.
The Legislative Assembly approved Ley No. 9048 on and the President signed it on ; the pgrweb consolidated text states it takes effect on publication.
Costa Rica has no scraping-specific statute, so general law governs each dimension separately.
The Codigo Penal's computer-crimes title, added by Ley No. 9048, has no provision that squarely tracks a Computer Fraud and Abuse Act (CFAA)-style unauthorized-access offense triggered by circumventing a technical measure; the closest fit, article 231 (espionaje informatico), reaches unauthorized computerized appropriation or copying of information of value to industry or commerce, and no reported Costa Rican decision has tested whether reading a public, unauthenticated page falls within it.
No Costa Rican court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper. Ley No. 6683 protects databases as compilations rather than granting a sui generis database right, and it carries no text-and-data-mining exception; its narrow author's-quotation exception (arts. 67-70) is recorded under the aggregation topic rather than repeated here.
Personal data scraped from a public Costa Rican source remains subject to Ley No. 8968's consent and purpose-limitation duties, recorded under the privacy topic, and Costa Rica's publicly-accessible-data category is a defined subset of covered personal data rather than an exemption from the Act.
No Costa Rican statute or reported case establishes a scraping-specific unfair-competition, misappropriation or trespass doctrine distinct from article 231, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.
Article 231, added by Ley No. 9048, punishes with three to six years of imprisonment a person who, without the authorization of the owner or the party responsible, and by means of any computerized or technological manipulation, appropriates, transmits, copies, modifies, destroys, uses, blocks, or recycles information of value to the economic traffic of industry and commerce.
The offense's trigger is the absence of authorization from the system's owner or responsible party rather than the circumvention of a specific technical access control, so a plain reading leaves open whether reading a page an operator has made publicly and unauthenticated available is conduct the owner has thereby authorized.
The Legislative Assembly approved Ley No. 9048 on and the President signed it on ; the pgrweb consolidated text states it takes effect on publication.
Article 8, as amended by Ley No. 7397 of , states that databases are protected as compilations. Article 1, as reformed by Ley No. 8686 of , protects a compilation of data or other materials only where, by reason of the selection or arrangement of its contents, it is an intellectual creation. That protection does not cover the data or materials themselves.
Costa Rican law therefore gives a database no sui generis right of the kind the EU Database Directive creates for the producer's investment; protection instead follows the ordinary compilation-copyright standard, so only a database whose selection or arrangement is itself an intellectual creation is protected, and only against reproduction of that selection or arrangement, not against extraction of the underlying data as such. No text-and-data-mining exception exists in Costa Rican copyright law.
Costa Rica has no standalone statute or regulation requiring a manufacturer to build security into a product with digital elements or a connected device before placing it on the market, and no analogue to the EU's Cyber Resilience Act, the UK's PSTI regime or Australia's Cyber Security Act Part 2 was located.
There is likewise no general "reasonable security" or information-security-programme statute reaching a business simply because it holds covered information: the closest instrument, Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales (Ley N.º 8968), Artículo 10 (Sección III, Seguridad y Confidencialidad del Tratamiento de los Datos), requires the person responsible for a database to adopt technical and organizational measures to guarantee the security of personal data and to prevent its unauthorized alteration, destruction, loss or access, but this is a security-of-processing clause inside a comprehensive, consent-based data-protection regime, the same architecture as General Data Protection Regulation (GDPR) Article 32, so it is researched under this jurisdiction's privacy row and not repeated here.
The Código Penal's computer-crime section, as reformed by Ley N.º 9048 (Título VII, Sección VIII, Delitos Informáticos y Conexos), Artículos 196 bis (Violación de datos personales) and 231 (Espionaje informático), criminalizes unauthorized access to, interception of, or interference with a system or data by an intruder; it creates no duty on an operator or a manufacturer and belongs to this corpus's scraping topic rather than this one.
Costa Rica's only cybersecurity-governance instrument carrying a coordinated-incident-response duty, Decreto Ejecutivo N.° 45061-MICITT (Reglamento para la Gobernanza en Ciberseguridad y la Resiliencia Cibernética de las Instituciones Gubernamentales, which replaced Decreto Ejecutivo N.° 37052-MICIT), binds only the Administración Central by its own Artículo 1 (Objeto): Artículo 14 instructs the hierarchs of the Administración Central to report any cybersecurity incident to computer security incident response team (CSIRT)-CR (the Centro de Respuesta de Incidentes de Seguridad Informática de Costa Rica, housed in MICITT's Dirección de Ciberseguridad) within 24 hours, and Artículo 13 only authorizes, without obligating, the other Powers of State, the decentralized administration, and public and private entities to support MICITT's cybersecurity work on a voluntary basis.
This is a government information-security programme, the same class as Spain's Esquema Nacional de Seguridad or the United States' FISMA, and is a Government Accountability matter rather than a finding for this topic.
The one regime located that does bind a private-sector class is CONASSIF's Acuerdo 5-24 (Reglamento General de Gobierno y Gestión de la Tecnología de Información), approved , published in the Alcance 130 to La Gaceta 134 of and in force from that publication (the version read here, version 3, is dated ).
Its Artículo 2 (Alcance) binds every entity and company supervised by SUGEF (state and special-law commercial banks, private banks, non-bank finance companies, savings and credit cooperatives, mutual savings-and-loan associations, the Caja de Ahorro y Préstamos de la ANDE), SUGEVAL (brokerage houses and investment-fund managers, stock exchanges, clearing and settlement companies, price providers, custodians, central securities depositories, securitization and trust companies, electronic bill-of-exchange registries), SUGESE (insurers, reinsurers, foreign insurers' branches, insurance brokerage companies) and SUPEN (complementary pension operators and most substitute and complementary pension funds), together with the holding companies and member entities of a supervised financial group or conglomerate.
Its Capítulo IV (Artículos 31 to 41) requires an information-security management system, a cybersecurity programme and a vulnerability-testing programme (Artículos 31 to 33); requires classifying and logging a security incident (Artículo 38); requires an initial notification to the entity's own Superintendencia, on the clock the regulation's own Lineamientos (Sección XI) set, within eight calendar hours of identifying an incident whose impact is classified "moderado" or "alto" (Artículo 39), followed by further reports on a schedule the Superintendencia sets; requires notifying affected clients of a breach of the confidentiality or integrity of their information and of the remediation measures taken, the latter within five business days of the incident's closure (Artículo 40); and requires retaining historical incident records for supervisory inspection (Artículo 41).
No penalty schedule is stated in the regulation itself; enforcement runs through each Superintendencia's own general sanctioning powers under its organic law, and no provision creates a private right of action. Its information security management and incident-reporting duties on supervised financial entities are filed as rows of their own.
No telecommunications-sector cybersecurity circular from SUTEL binding a telecommunications operator was located in the sources examined; SUTEL's own site served only a JavaScript navigation shell to direct navigation on both its home page and a guessed regulations path, so that absence rests on inconclusive navigation rather than a confirmed finding about the law.
Acuerdo CONASSIF 5-24 requires every entity supervised by SUGEF, SUGEVAL, SUGESE or SUPEN to run an information security management system, manage cybersecurity and run annual vulnerability testing programmes under Articles 31 to 33. Acuerdo CONASSIF 5-24 requires a supervised entity to report an incident classified as moderate or high to its Superintendencia, with an initial communication within eight natural hours, under Article 39 and Section XI of the general guidelines.
Article 2 applies the Regulation to entities supervised by SUGEF, SUGEVAL, SUGESE and SUPEN. Article 31 requires supervised entities and companies to design, implement, maintain and monitor an information security management system. Article 32 requires supervised entities and companies to manage cybersecurity to meet business requirements and to ensure digital operational resilience.
Article 33 requires supervised entities and companies to establish, every year, programmes of vulnerability analysis and testing that cover the information security and cybersecurity controls. For savings and credit cooperatives under the SUGEF proportional regulation and for insurance brokerage companies, Articles 33, 34 and 35 are good-practice references they may adopt at their discretion.
The Regulation was approved on and applies from its publication in Alcance 130 to La Gaceta 134 of .
Article 2 applies the Regulation to entities supervised by SUGEF, SUGEVAL, SUGESE and SUPEN. Article 39 requires supervised entities and companies to report to their Superintendencia each incident classified as moderate or high. Section XI of the general guidelines sets the initial communication at no later than eight natural hours after the incident is identified and its impact established.
Article 40 requires supervised entities and companies to tell affected customers when an information security incident affects the confidentiality or integrity of their information. Article 40 also requires the measures taken to remediate the incident to be communicated to customers within five business days after the incident is closed.
Article 41 requires supervised entities and companies to keep historical information on incidents available to the Superintendencias when they require it for supervision. The Regulation was approved on and applies from its publication in Alcance 130 to La Gaceta 134 of .
Costa Rica has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability specifically; each of those dimensions is a sourced absence rather than an unresolved question.
The relevant instrument is Ley No. 6683 sobre Derechos de Autor y Derechos Conexos, which excludes news of a strictly informational press character from copyright protection outright (art. 67) and separately lets any medium reproduce a current-events article from a magazine or newspaper unless expressly prohibited, citing the source (art. 68), and lets a person quote an author's relevant passages so long as the quotation is not so extensive and continuous as to amount to a simulated, substantial reproduction to the original author's detriment (art. 70).
The law predates the concept of a machine-readable text-and-data-mining reservation entirely, so no opt-out mechanism of that kind exists either.
Ley No. 6683 arts. 67-70 (art. 67 según reforma por Ley No. 7979 de 6 de enero de 2000; arts. 68 y 70 según reforma por Ley No. 8686 de 21 de noviembre de 2008)Consolidated text of Ley No. 6683 sobre Derechos de Autor y Derechos Conexos
In force.Binds public and private bodies.
What this law does
Article 67, in its text as reformed by Ley No. 7979 of , excludes news of a strictly informational press character from copyright protection outright, though the outlet that reproduces or retransmits it must state the original source.
Article 68, in its text as reformed by Ley No. 8686 of , makes it lawful for the press, broadcasting or wire transmission to the public to reproduce current-affairs articles on economic, political or religious topics published in newspapers or periodicals, or broadcast works of the same character, unless that reproduction has been expressly reserved, and the source must always be clearly indicated.
Article 69 lets speeches given at public assemblies or meetings, and court pleadings, be published in the press, radio, or periodic television without authorization, though not in a separate printed work or a collection without the author's permission.
Article 70, in its text as reformed by Ley No. 8686 of , permits quoting an author by transcribing the pertinent passages of a work lawfully made available to the public, provided they are not so numerous and continuous that they could be considered a simulated and substantial reproduction to the detriment of the original work's author, and their extent does not exceed what the purpose justifies. None of the four provisions sets a headline-length or short-extract threshold.
Article 68 reaches only reproduction by the press, broadcasting or wire transmission, and article 70 limits a quotation to the extent its purpose justifies; whether either reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a single reproduction or a traditional press review, has not been tested in a reported Costa Rican decision.
Costa Rica has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright law, and no located case law on hyperlinking or framed display. The sections this entry groups came into force on different days.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Costa Rica has no enacted artificial-intelligence statute as of the review date; the Sistema Costarricense de Informacion Juridica carries no AI-specific transparency, risk-obligation, training-data, prohibited-practice, governance, or sector rule. Several AI-regulation bills remain pending before the Legislative Assembly, including Expediente 23.771, a general AI-governance bill first introduced in May 2023, but none has passed a chamber or reached a plenary vote.
The executive's National Artificial Intelligence Strategy, launched by the Ministry of Science, Innovation, Technology and Telecommunications in October 2024, is a non-binding policy framework rather than a legal instrument.
As of .
Age gating law
Costa Rica has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code. The Codigo de la Ninez y la Adolescencia (Ley No. 7739 de 1998), Costa Rica's general framework statute for the rights of minors, contains no internet, online-service, digital-verification, social-media, or pornography-specific provision.
The Codigo Penal's computer-crimes provisions, added by Ley No. 9048, aggravate the penalty for corruption of a minor when the offender uses social networks or another computerized or telematic medium to seek a sexual encounter with them (art. 167), and aggravate the penalty for violating a minor's personal data (art. 196 bis(c)); both are prohibitions running against an offender rather than an age-verification or age-gating duty imposed on a service provider.
As of .
Case law
No current case law for Costa Rica AI law
No current case law for Costa Rica privacy law
No current case law for Costa Rica scraping law
No current case law for Costa Rica cybersecurity law
No current case law for Costa Rica communications law
No current case law for Costa Rica content moderation law
No current case law for Costa Rica product and AI liability law
No current case law for Costa Rica digital accessibility law
No current case law for Costa Rica age gating law
No current case law for Costa Rica reuse law
Reporting clocks that run here1 instrument
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Costa Rica comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Report to your Superintendencia each incident whose impact is classified as moderate or high (Article 39), sending the initial communication without delay and no later than eight natural hours after the incident is identified and its impact is established as moderate or high (general guidelines, Section XI).
Tell the affected customers when an information security or cybersecurity incident affects the confidentiality or integrity of their information, in a timely and clear way, and tell them the measures taken to remediate it within five business days after the incident is closed (Article 40).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
