Ley 8968, Proteccion de la Persona frente al tratamiento de sus datos personales — transfer of personal data

Art. 14 sets a single gate: those responsible for public or private databases may transfer personal data only where the data subject has expressly and validly authorised the transfer, and only where doing so does not violate the Law's principles and rights. Costa Rica does not operate an adequacy list, and consent is doing all the work — which makes this a consent-based regime like Mexico's rather than an adequacy-based one like most of Latin America's. The teeth are in Art. 31, which classifies transferring data to third countries without consent as a GRAVE violation. Marked 'check': the operative texts are Spanish-language and were triangulated across independent legal-reference sources rather than read in the original; confirm with PRODHAB whether any additional conditions apply to international as distinct from domestic transfers.