Costa Rica Law No. 8968 on Personal Data

National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.


Short name	CR L8968
Region	Americas
Country or scope	Costa Rica
Sector	Privacy
In your workspace	Off until you switch it on in Compliance › Manage.

How Safeguard covers CR L8968

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CR-8968-10` Security of Data	The party responsible for a database must adopt technical and organizational measures appropriate to the processing risk to guarantee the security of personal data and prevent its alteration, loss or unauthorized access, presuming integrity controls over the processing software (Law No. 8968, Art. 10)	Scan
`CR-8968-11` Duty of Confidentiality Across Parties	Everyone who intervenes in the processing of personal data is bound by professional or functional secrecy, requiring the third parties and suppliers involved in processing systems to be identified (Law No. 8968, Art. 11)	Scan
`CR-8968-6` Quality of Information	Personal data must be current, truthful, exact and complete; applied to the processing stack this requires every component to carry both a name and a version (Law No. 8968, Art. 6)	Scan
`CR-8968-PROT` Documented Action Protocols	Database managers must follow documented action protocols governing how data is handled, which requires dated, identifiable documentation of the processing systems, such as an SBOM with document ID and timestamp (Law No. 8968, Art. 12 action-protocol obligation)	Scan
`CR-8968-REG` Database Registration with PRODHAB	Databases must be registered with PRODHAB, including a description of the processing, its security measures and recipients, which presupposes an enumerated inventory of the systems and components involved (Law No. 8968, registration regime)	Scan

All 22 from the standard set, adapted to CR L8968.