#CostaRica 🇨🇷 #BDS_LaborAlert: Ruling from the Constitutional Chamber Affects Provisions of the Law on Strengthening Public Finances
Recently, judgment 2025-008201 was announced by the Constitutional Chamber of the Supreme Court of...
Recently, the Legislative Assembly approved several amendments to the Personal Data Protection Law (LPDP), aimed to streamline the exercise of data subjects’ rights and offer organizations greater flexibility to process requests in accordance with their internal structure.
Key Changes for Companies
- Elimination of the Personal Data Protection Officer requirement: The obligation to appoint a Personal Data Protection Officer has been removed. Companies, as regulated entities, will now be directly responsible for receiving, processing, and resolving requests related to ARCO-POL rights. Each organization may establish its own official channels for receiving requests, which must be clearly specified in its Privacy Notice.
- Statutory Deadlines & Review Status: The five-business-day timeframe remains in effect for processing consent revocations and notifying third parties of any corrections or deletions of previously shared data. Additionally, companies must flag data “under review” whenever a rectification request is pending.
- Enforcement Powers: The State Cybersecurity Agency will retain its inspection and oversight powers.
- Administrative Enforcement: The Personal Data Protection Director — appointed by the President of the Republic for a three-year term— will oversee administrative enforcement proceedings.
What Should Companies Do Now?
While the requirement to appoint a Personal Data Protection Officer has been eliminated, all other obligations established under the LPDP remain fully in force. We therefore recommend that organizations:
- Designate the specific department or individual responsible for managing data subject requests.
- Review and update their Privacy Notices to reflect the official channels for submitting requests.
- Align internal procedures to ensure compliance with statutory deadlines.
- Implement recordkeeping mechanisms to document the receipt, processing, and resolution of all requests.
- Train personnel involved in processing personal data.
The amending decree will enter into force eight days after its publication in the Official Gazette.
Should you have any questions or require assistance adapting your procedures to these regulatory changes, please feel free to reach out to us.
