Legal Update on Privacy and Artificial Intelligence: Costa Rica
Costa Rica’s immediate priorities are clear and were widely debated in the months leading up to the elections. They include:
- Rising crime and urban violence;
- Hospital overcrowding and long waiting lists in the public health system;
- Deficiencies in road infrastructure and public transportation;
- Lagging quality and coverage in public education;
- Unemployment; and,
- Economic pressures tied to the U.S. dollar exchange rate, with implications for monetary stability, inflation, domestic prices, export competitiveness, and the Central Bank’s policy framework.
Within this context, privacy and artificial intelligence may not appear to be top priorities. Yet, given their growing relevance in industries such as banking and financial services, healthcare and biotechnology, telecommunications and technology, and e commerce and retail, it is timely to examine what initiatives the outgoing government has left in the legislative pipeline, what frameworks currently exist, and what gaps remain.
Data Protection and Privacy
Current Framework. Costa Rica has had a dedicated privacy law since 2011: the Law on the Protection of Individuals Against the Processing of Their Personal Data (Law No. 8968), regulated since 2013 by Executive Decree 37554‑JP. Privacy is also safeguarded under the Constitution and through sector‑specific laws in criminal, civil, consumer protection, telecommunications, and financial domains. Local courts have issued robust jurisprudence on the matter.
As of April 2026, three active legislative proposals address privacy:
- Bill No. 24063: Focused on protecting minors from online sexual predators, introducing new criminal offenses such as electronic sexual harassment of minors, sexual disturbance, and sexual extortion.
- Bill No. 23667: Seeks to amend Law No. 8968 by defining “biometric data” and regulating consent requirements for biometric technologies. It also proposes updates to the Biomedical Research Law (Law No. 9234) and the Civil Code.
- Bill No. 23097: Proposes a complete repeal of Law 8968 and the enactment of a new Personal Data Protection Law, more closely aligned with the EU’s GDPR. It introduces a new supervisory authority, a revised sanctions regime, and a 12‑month compliance period for controllers and processors.
What Is Needed. Law 8968 requires urgent modernization. Drafted before 2011, it now shows clear gaps. The absence of EU adequacy recognition underscores its insufficiency. Key reforms include granting independence and adequate funding to the supervisory authority (PRODHAB) to ensure effectiveness and credibility.
Artificial Intelligence
Current Framework. Costa Rica adopted a National Artificial Intelligence Strategy 2024-2027, developed with EU support and aligned with OECD principles and the Hiroshima AI Process. Its five pillars are: (i) ethical and responsible AI, (ii) capacity and talent development, (iii) innovation and competitiveness, (iv) governance and regulation, and (v) inclusion and sustainability. The strategy’s Action Plan, issued in August 2025, sets concrete objectives, indicators, and institutional responsibilities.
Additionally, Costa Rica formalized the technical standard INTE/ISO/IEC 42001:2026 in March 2026, adapted from the international ISO/IEC 42001 standard. It provides guidance for responsible, ethical, and trustworthy AI management across public and private sectors.
No specific AI legislation exists yet, but four bills are under discussion:
- Bill 24875: Regulates AI use in electoral processes;
- Bill 24484: Establishes frameworks for AI system implementation;
- Bill 23919: Promotes responsible AI adoption in Costa Rica; and,
- Bill 23771: Provides general regulation of AI in the country.
It remains uncertain whether any of these initiatives will advance.
What Is Needed. Costa Rica must invest in talent development at multiple levels. This includes preparing young professionals sought by multinational companies already operating in the country, as well as those planning to establish new operations. It also requires strengthening the skills of policymakers responsible for shaping public policy and legislation. The incoming legislative majority has the opportunity to advance ordinary laws and budgets, but must balance urgent national priorities with the need to keep pace in privacy and artificial intelligence. The progress achieved so far deserves sustained attention and continuous improvement.
Article provided by INPLP member: Fabián Solís (Aguilar Castillo Love, Costa Rica)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)l