Snap Compliance
Solution Partners Consulting Partners
Contact us

Language

EN ES PT
Start free
Law 8968 · PRODHAB · Costa Rica

Handle your customers' data under Law 8968, and be able to prove it

Due diligence collects data on customers and beneficial owners. Law 8968 and its regulation define how to obtain consent, how quickly each person's rights must be honored and what security the controller must be able to show PRODHAB.

See what it requires Talk to a specialist

At a glance

What it governs

Informational self-determination

The automated or manual processing of personal data in public and private databases, and any later use of that data (arts. 1 and 2). Its regulation is Executive Decree 37554-JP.

Who it binds

Database controllers

Any individual or legal entity, public or private, that decides the purpose and processing of a personal database (art. 3). The law excludes databases kept for exclusively internal, personal or domestic purposes that are not sold or commercialized (art. 2).

Authority

PRODHAB

The Agency for the Protection of Inhabitants' Data, attached to the Ministry of Justice and Peace: it keeps the database registry, rules on complaints and imposes sanctions (arts. 15 and 16).

In force since

September 5, 2011

Published in La Gaceta 170 and unamended since. Its regulation has applied since March 5, 2013, and was amended by Decrees 40008-JP (2016) and 41582 (2019).

Read the official text: Ley 8968

What it requires

What Law 8968 requires of the controller

The law sets the principles, and the regulation turns them into procedures, deadlines and measures that PRODHAB can verify.

Inform before collecting

Give express, precise and unequivocal notice that the database exists, its purposes, its recipients, whether each answer is mandatory, what happens if the person refuses, their rights and who the controller is. On a form, these notices must be clearly legible (art. 5.1).

Express, written consent

On paper or electronically, revocable with no retroactive effect (art. 5.2). If requested inside a contract with other purposes, it needs a specific, separate clause, and the burden of proof lies with the controller (regulation, arts. 2 and 6). A withdrawal is carried out within five business days (regulation, art. 8).

Quality data, not kept forever

Only current, truthful, accurate data fit for the purpose for which it was collected; data no longer needed is deleted. Data that may harm the data subject is not kept beyond ten years, unless a special rule says otherwise (art. 6; regulation, art. 11).

Honor rights within five business days

Access, rectification and erasure, free of charge and within five business days of the request (art. 7). The controller offers simple ways to exercise them, answers even if it holds no data on the person and justifies any refusal in writing (regulation, arts. 16 to 22).

Sensitive and credit data

No one is required to provide sensitive data, and processing it is prohibited except under the exceptions of article 9. Credit-behavior data is governed by the rules of the National Financial System, without exceeding the limits of the law (art. 9.4).

Security, confidentiality and incidents

Technical and organizational measures, and secrecy even after the relationship ends (arts. 10 and 11). The regulation calls for a risk analysis, a residual-risk calculation and a work plan, and after a breach, notice to data subjects within five business days (arts. 36 and 38).

Minimum protocol and providers

A minimum operating protocol with privacy policies, staff training, internal control and a free procedure to serve data subjects. Whoever hires a technology provider remains responsible and must verify its security (regulation, arts. 29 and 32).

Transfers and registration

Transferring data to a third party requires the data subject's express authorization (art. 14). Databases kept for distribution, dissemination or commercialization are registered with PRODHAB (art. 21); the regulation exempts SUGEF-supervised institutions from registering (art. 3).

Consequences

What happens in case of non-compliance

PRODHAB imposes fines measured in base salaries of the Judicial Assistant I position, under the Budget Law: up to five for minor offenses, five to twenty for serious ones and fifteen to thirty for very serious ones, which also suspend the operation of the file for one to six months (art. 28), without prejudice to criminal penalties. It is serious to process data without the data subject's informed, express consent, to use it for a different purpose or to unjustifiably deny access, rectification or deletion (art. 30). It is very serious, among other cases, for a private party to collect or use sensitive data, to disclose information that must be kept secret, to process data without the required registration or to transfer data to databases in other countries without the data subjects' consent (art. 31).

How we help

How Snap Compliance helps

Snap Compliance does not have a dedicated data protection product for Costa Rica. What it does offer: with Compliance Agent, your institution manages Law 8968 and its regulation as part of its compliance model, with the law in its regulatory catalog, linked controls, assessments, tracked action plans, KRIs and evidence organized for audits. And in Due Diligence, the module that holds the customer file, the form field catalog has privacy control per field, with a trail of who reviewed what and when.

Snap Compliance modules

Corporate Governance Management Due Diligence

Other regulations in Costa Rica

Ley 7786 · SUGEF · SUGEVAL · SUPEN · SUGESE

Law 7786: AML compliance in Costa Rica

Ley 10.889 · SUGEF

Law 10.889 and SUGEF 5-26: free assessment and toolkit

Ley 9416 · BCCR · DGT

Law 9416: beneficial ownership and RTBF in Costa Rica

CONASSIF 4-16 · CONASSIF

CONASSIF 4-16: corporate governance in Costa Rica

All regulations in Costa Rica

What we are asked most about Law 8968

Who does Law 8968 apply to in Costa Rica?
It applies to personal data held in automated or manual databases, public or private, and to any later use of that data (art. 2). It binds the controller: the individual or legal entity that decides the database's purpose, what data it records and how it is processed (art. 3). The law excludes databases kept for exclusively internal, personal or domestic purposes that are not sold or commercialized. With Compliance Agent, your institution adds Law 8968 to its regulatory catalog and assigns controls to it.
What does Law 8968 require to obtain consent?
Before collecting, the institution gives express, precise and unequivocal notice of the database's existence, its purposes, its recipients, whether each answer is mandatory, the consequences of refusing, the data subject's rights and who the controller is (art. 5). Consent is express and recorded in writing, on paper or electronically; if requested inside a contract with other purposes, it goes in a specific, separate clause (regulation, art. 2). The burden of proving it lies with the controller (regulation, art. 6).
How long does an institution have to answer an access, rectification or erasure request?
Within five business days of receipt, free of charge (Law 8968, art. 7). The regulation counts the period from the following day, allows additional information to be requested once and requires an answer even if the person is not in the database (arts. 18 to 20). A refusal must be justified in writing (art. 22), and a consent withdrawal is carried out within the same period and passed on to those who received the data (art. 8). With Compliance Agent, that procedure becomes a control your institution assesses.
Can a customer demand that their data be deleted?
They may request full or partial erasure at any time (Law 8968 regulation, art. 25), but it does not apply, among other cases, when the data must be kept under a constitutional, legal or judicial provision, or for the prevention and investigation of criminal offenses (art. 26). That is the typical situation of the records that anti-money laundering rules require institutions to keep. A refusal must be justified in writing (art. 22). In Due Diligence, the file keeps a trail of who reviewed what and when.
What is sensitive data under Law 8968?
Data on a person's private sphere, such as data revealing racial origin, political opinions, religious beliefs, socioeconomic status, biomedical or genetic information, sex life and sexual orientation (art. 3). No one is required to provide it, and processing it is prohibited except in cases such as the data subject's vital interest or the defense of a right in court (art. 9). Its collection or use by a private party is a very serious offense (art. 31). In Due Diligence, each form field carries its own privacy control.
Must a SUGEF-supervised institution register its databases with PRODHAB?
No. Law 8968 requires registration of databases run for distribution, dissemination or commercialization (art. 21), which pay an annual fee of US$200 (art. 33). Its regulation adds that the databases of SUGEF-supervised financial institutions do not need to be registered, although PRODHAB keeps full authority to oversee them, and that internal databases are not registered (arts. 3 and 44). Processing data without the required registration is a very serious offense (art. 31). With Compliance Agent, your institution documents which regime applies to each database.
What security measures does the Law 8968 regulation require?
Administrative, physical and logical measures (art. 34). At a minimum: describe the data processed, inventory the technology infrastructure, analyze risks, calculate residual risk and carry out a work plan for the missing measures (art. 36). If data is lost or improperly accessed, the controller notifies data subjects within five business days and tells them and PRODHAB the nature of the incident and the data compromised (arts. 38 and 39). Compliance Agent handles those assessments and their action plans.
Does hiring a technology provider shift responsibility for the data?
No. Whoever hires a technology intermediary or service provider remains responsible for the processing and must verify that it meets minimum security measures (Law 8968 regulation, art. 29). Handing data to a processor or provider is not a transfer (art. 40), but transferring it to a third party requires the data subject's express authorization (law, art. 14), and sending it to databases in other countries without consent is a very serious offense (art. 31). With Compliance Agent, provider verification becomes an assessed control.
What does PRODHAB say about personal data in debt collection?
In directive PRODHAB-DIR-DN-001-2026, of July 2026, issued under Law 8968, it states that anyone requesting data for financial or collection activities may only ask for the data of the account holder, and that including third parties requires their express informed consent. It prohibits sending collection notices to people unrelated to the debt who did not consent, and using work contact details without a final court order. It applies from its publication in La Gaceta. With Compliance Agent, the directive enters your regulatory catalog.
What fines does PRODHAB impose for breaching Law 8968?
They are set in base salaries of the Judicial Assistant I position, under the Budget Law: up to five for minor offenses, five to twenty for serious ones and fifteen to thirty for very serious ones, which also suspend the operation of the file for one to six months (art. 28). Processing data without consent or unjustifiably denying access is serious (art. 30); disclosing information that must be kept secret is very serious (art. 31). Compliance Agent organizes the controls and evidence your institution uses to show compliance.

Would your program withstand a supervisor's review today?

We review with you where your institution stands against these rules and what it still needs to demonstrate compliance.

Talk to a specialist

Free self-assessment · Chile

How ready is your organization for Chile's Law No. 21.719?

Answer the questions that apply to your organization and see its blocking findings, its gaps by domain and its estimated exposure, with an action plan in Word. Available in Spanish.

16 domains · 45 to 90 minutes · save and resume 46 days until enforcement

Start the self-assessment (in Spanish)