Data protection law in Costa Rica

Good to know

• A law on paper is not always a law in practice. Some countries have passed a law but have not yet set up the authority that enforces it, or are still bringing it into force in stages. We say so where we know.
• The GDPR can reach you outside the EU. The GDPR applies to organisations anywhere in the world that offer goods or services to people in the EU, or monitor their behaviour, even without a presence there.
• Moving data across borders. Many laws limit sending personal data abroad. Typical safeguards are an adequacy decision, standard contractual clauses, binding corporate rules, or the person's explicit consent.
• Your rights. Most general laws let you ask what data an organisation holds about you, ask for corrections and, in many places, deletion. Find the country's authority below to file a complaint.
• Laws are being updated. Many countries have passed or reformed a law in the last five years, and more are in the pipeline. Check the authority's website for the current text.

More about Costa Rica

• The Costa Rica legal-system profile (Civil law) in the Legal Families Atlas →

Sources

• UNCTAD: data protection and privacy legislation worldwide (the global tracker)
• European Commission: adequacy decisions (the list of countries)
• European Data Protection Board: the national data protection authorities of the EU and EEA
• Global Privacy Assembly: the world's data protection and privacy authorities

For the exact text and the current position, use Costa Rica’s own legislation and its data protection authority.