Costa Rica data protection law: Law 8968 rules for licensing records

What does Costa Rica's data protection law cover?#

Costa Rica's data protection law is Law 8968, the Law for the Protection of the Person against the Processing of their Personal Data, and enforced by the Agency for the Protection of Inhabitants' Data (PRODHAB). It applies to personal data held in automated or manual databases of public or private organizations, and to every later use of that data.

Personal data means any data about an identified or identifiable natural person. Companies are not data subjects under the law, but the employees, contractors, customers and vendor contacts who appear in company records are.

The detail that matters most for licensing is the internal-use exemption. The law does not apply to databases kept by individuals or companies for exclusively internal, personal or domestic purposes, but only as long as they are not sold or otherwise commercialized. A support-ticket archive used only to run the business can sit inside that exemption; the same archive licensed to an AI developer is no longer purely internal.

This page covers the questions a U.S., Canadian or EU company faces when records it wants to license include people in Costa Rica. For the wider country-by-country picture, see the SourceX laws library.

When do a U.S. company's records include people in Costa Rica?#

They usually do when the company runs a nearshore team in Costa Rica, contracts with Costa Rican engineers or agents, or sells to customers there. The people most often overlooked are the company's own Costa Rica staff, whose names, IDs, voices and performance notes run through every ticket, call and commit they touched.

Whether Law 8968 governs a particular database depends on facts counsel has to weigh: which entity decides what the database is for, where it is held, and whose data it contains. The table below sorts the common situations and the first question to settle for each.

Does licensing data about people in Costa Rica count as a transfer that needs consent?#

Generally yes. Article 14 of Law 8968 allows a database controller to transfer personal data only when the data subject has expressly and validly authorized that transfer, and the implementing regulation again requires the data subject's consent for transfers.

Not every movement of data is a transfer. Under a later amendment to the regulation, passing data from the controller to a processor, a service provider or technology intermediary, or a company in the same economic group is not treated as a transfer, unless the recipient uses the data for distribution, dissemination or commercialization. The contracting controller stays responsible for how its providers treat the data.

An AI developer that receives a licensed dataset to train its own models is not acting as your processor; it is a third party using the data for its own purposes. Plan on treating that delivery as a transfer. The law also lists transferring personal data of Costa Ricans or foreigners resident in Costa Rica to databases in third countries without the data subjects' consent among sanctionable conduct, which matters because most AI buyers sit outside Costa Rica.

What does valid consent look like under Law 8968?#

Consent under Article 5 must be informed, express and in writing, on paper or electronically, and it can be revoked the same way without retroactive effect. Before collecting data, the controller must tell the person, expressly, precisely and unequivocally, about the existence of the database, its purposes, the recipients of the data and how it will be used.

A later amendment to the regulation describes consent as an express, free, unequivocal, informed and specific statement of will, given in writing or digitally, for a defined purpose. A consent signed at hiring for payroll and HR administration, or a customer notice about service delivery, will rarely name licensing to an AI developer as a purpose or AI developers as recipients.

Article 5 lists narrow exceptions to express consent: a reasoned court order or a resolution of a special legislative investigating commission, data that is of unrestricted public access, and data that must be delivered by constitutional or legal mandate. None of these fits a commercial data license, so the practical choices are fresh consent, or removing the people from the data.

• 1Check whether the original notice named the database, its purposes and its recipients.
• 2Check whether consent was express and recorded in writing or electronically, and whether anyone revoked it.
• 3Check whether the stated purpose reaches disclosure to a third party for AI development.
• 4If not, decide between collecting new, specific consent and de-identifying the records before release.

Does de-identifying the records take them outside the law?#

It can, if the result no longer relates to an identifiable person. The regulation defines a dissociation procedure as dissociating personal data so that the resulting information cannot be linked to a determined or determinable person, and it says a person is not identifiable if identification would require disproportionate time or activities.

Law 8968 also says later processing for historical, statistical or scientific purposes is not incompatible with the original purpose, provided appropriate safeguards protect the rights in the law. Do not assume a commercial AI license fits that wording; counsel should decide it on the facts.

Two limits apply even when de-identification works. First, free text in tickets, chats and transcripts often carries names, phone numbers and identity numbers that field-level redaction misses, and agents' writing styles and shift patterns can point back to a small team. Second, de-identification addresses privacy only. It does not create a contractual right to license data that a customer agreement, an EOR contract or a vendor's terms restrict.

Sensitive data needs its own screen. Article 9 prohibits processing data revealing racial or ethnic origin, political opinions, religious, spiritual or philosophical convictions, and data about health, sex life and sexual orientation, subject to narrow exceptions. Health notes in HR systems, leave records and union information should be excluded from any release scope.

When must a database be registered with PRODHAB?#

PRODHAB says every database, public or private, with a purpose of commercialization, distribution or commercial dissemination must be registered with the agency. Databases of financial entities supervised by SUGEF are exempt from registration, and a database that does not have to be registered is still subject to the law.

The regulation sets the registration requirements in its Article 44, and PRODHAB publishes the application form; get the current list of requirements from the agency or counsel before filing.

PRODHAB's FAQ classifies failing to register a personal database as a very serious fault with a fine of up to 30 base salaries. Its procedures page says database registration applications are filed in person with printed documents, so build lead time into the release plan.

Consent and registration checklist for a dataset release#

Use this checklist before any dataset containing records about people in Costa Rica leaves the company. Each step should leave a dated record in the release file, signed by the accountable owner. Counsel confirms which steps apply to your entity structure.

What rights and penalties should the release plan account for?#

The law gives each person rights to access their personal data, have it rectified or deleted, and consent to its transfer. The release plan should say how a request reaching a dataset already delivered to a buyer will be handled; counsel should confirm the response deadlines and any fees.

PRODHAB handles sanctions under the law after due process. Beyond the registration fine above, the practical risks for a licensing project are an order to stop processing and a buyer who can no longer use data it paid for, so contracts should cover deletion and replacement if consent is revoked or a complaint succeeds.

The regulation has been amended by later decrees. Check the consolidated text on Costa Rica's official legal information system before relying on any article number in this guide.

How this applies when licensing through SourceX#

SourceX works with U.S., Canadian and EU companies that had 50 or more full-time employees at their peak. If such a company's records include people in Costa Rica, the questions above become part of the rights review before any release.

The first step is a short company assessment that needs no data uploads. The company approves exactly what is released, once per deal, and de-identification is performed by SourceX directly or through its processing partner. Consent and registration questions under Law 8968 stay with the company and its counsel; de-identification reduces privacy risk but does not by itself create a right to license.

SourceX can consider companies in Costa Rica when the data they offer is at least 90% English, confirmed on the actual dataset; every dataset still goes through rights, privacy, quality and buyer-fit review.