Law: Law on the Protection of Persons Regarding the Processing of their Personal Data No. 8968 of 2011 (only available in Spanish here) ('the Law'), and Executive Decree No. 37554-JP of 30 October 2012 Regulating Law No. 8968 (only available in Spanish here)

Regulator: Costa Rican data protection authority ('PRODHAB')

Summary: The right to privacy has been recognised and protected since the mid-1990s in Costa Rica through the Constitution. The Law then introduced additional data subject rights, including the right to access, rectify, or delete personal data, and established express consent of the data subject as a central principal. The Law further requires that databases must be registered with PRODHAB and that data controllers and processors ensure that adequate security safeguards are in place to protect data. Please note that Bill No. 22.388 (only available in Spanish here), aiming to reform the Law, was published on 12 February 2021 in the Official Gazette.