Law on the Protection of Persons Regarding the Processing of Their Personal Data

Applies to personal data contained in automated or manual databases held by public or private entities in Costa Rica, with an emphasis on informed consent, data-subject rights, and a mandatory registration of databases that distribute or trade personal data with the Agencia de Proteccion de Datos de los Habitantes (PRODHAB). It is a pre-GDPR-generation law without an explicit targeting clause reaching foreign controllers, so the trigger below is modeled on established presence only. Reform proposals to align it with GDPR concepts have circulated without enactment; a business with any Costa Rican entity or infrastructure should treat PRODHAB registration and the consent-first posture as the operative baseline.