Costa Rica protects personal data under Law 8968, from 2011, enforced by PRODHAB. That is thirteen years of distance from the average business today, which runs on WhatsApp, web forms and cloud systems that did not exist in 2011.
That distance makes many people assume the law is a dead letter. It is not.
What it requires today
- Informed, express consent before collecting or processing personal data. Informed means the person knows what for; express means they said so, not that they failed to object.
- Rights of access, rectification and deletion for the data subject.
- Fines of up to 30 base salaries per violation.
PRODHAB also holds precautionary powers and has used them, ordering processing to stop before ruling on the merits. That precedent is worth noting: a final resolution is not required for an operation to have to halt.
Where the gap is
Technical analysis acknowledges that Law 8968 urgently needs modernization. The clearest signal is that Costa Rica holds no EU adequacy recognition, which in practice complicates data transfers with European companies.
The reform under discussion focuses mainly on giving the supervisory authority genuine independence and funding. The direction is the same one Chile took with Law 21.719: more obligations, not fewer.
What to do now
There is no need to wait for reform. Four things that hold under the current law and leave you ready for the next one.
Write down what you use each piece of data for
Informed consent starts with knowing yourself why you are collecting. If your contact form asks for a phone number, it has to be clear what you will use it for. If you later use it for something else, there is no consent.
Make your form ask for the minimum
Every extra field is data you have to safeguard, justify and be able to delete. The safest field is the one you never asked for.
Give data an expiration date
Almost nobody deletes anything. Keeping résumés, form submissions and old databases indefinitely accumulates risk with no benefit. Define how long each thing is kept and make the system enforce it on its own.
Ask where it is hosted
If you use cloud services, your customers' data sits in some specific country under some specific jurisdiction. Worth knowing which one before somebody else asks you.
Where this meets AI
This is becoming the central point. Costa Rica adopted its National Artificial Intelligence Strategy 2024-2027, and much of the country's legislative discussion on AI revolves precisely around data protection rather than the technology itself.
That makes sense: almost everything that goes wrong with AI in a company goes wrong because of the data it was given, not the model. If you are considering a chatbot or an AI agent, the question that matters is not which model to use, but what data it will see and who can query it.
Closing
Law 8968 is old and it shows. But it is in force, it is enforced, and the reform ahead will ask for more. Getting today what you should already be doing in order is considerably cheaper than doing it once it is mandatory and on a deadline.
At egobytes we build custom software for companies in Costa Rica and Chile, with the data where it belongs. Let's talk.
Sources: PRODHAB — Costa Rica Data Protection Agency · Law 8968 — Costa Rican Legal Information System · MICITT — National AI Strategy