Cybersecurity law & regulation in Costa Rica (2026)

Legal framework

Ley sobre Delitos Informáticos (Law 9048, 2012) + MICITT National Cybersecurity Strategy 2023-2027 + proposed Ley de Ciberseguridad (Expediente 23292, pending)

Key points: cybersecurity in Costa Rica

1. 01Cybercrime law (2012)

   Law 9048 (Ley de Delitos Informáticos e Conexos, 2012) is the foundational instrument, criminalising unauthorised access, data interference, system interference, and fraud. It aligns broadly with Council of Europe Budapest Convention principles but does not establish proactive security obligations or a regulatory authority.

   coe.int cyberlaw.ccdcoe.org

2. 02National Cybersecurity Strategy 2023-2027

   Issued by MICITT in 2023, the strategy sets five pillars, governance, legal framework, risk management, cybersecurity culture, and international cooperation, and created the National Cybersecurity Directorate with CSIRT-CR and SOC-CR. It is a policy document, not a binding legislative instrument, and explicitly acknowledges that a legal framework upgrade is still needed.

   micitt.go.cr dig.watch

3. 03Proposed comprehensive cybersecurity law (Exp. 23292)

   A standalone Ley de Ciberseguridad (Legislative File 23292) was introduced in 2022 and was advancing through the Legislative Assembly in 2024-2025, including first plenary debate. It would create a National Cybersecurity Agency within MICITT, mandate incident reporting for operators of critical information infrastructure, and establish administrative sanctions. Critics noted it was limited in scope regarding the judiciary's independence.

   cicr.com delfino.cr semanariouniversidad.com

4. 04Breach notification obligation

   Under the data protection framework, data controllers must notify affected individuals within five business days of any irregularity in the processing or storage of personal data (loss, destruction, or theft). Controllers must also notify PRODHAB (the data protection authority), though no explicit deadline applies to that notification.

   hunton.com dlapiperdataprotection.com

5. 05CSIRT-CR and incident response

   CSIRT-CR, operating under MICITT's National Cybersecurity Directorate, is the national computer security incident response team. Its RFC 2350 document (updated July 2024) defines its constituency as all Costa Rican internet users, with a focus on government and critical infrastructure. Operators of critical information infrastructure are directed under the 2023-2027 strategy to report cyber incidents to CSIRT-CR.

   micitt.go.cr ncsi.ega.ee

6. 062022 emergency declaration and US assistance

   Following the Conti ransomware attack on ~27 government institutions in April-May 2022, President Chaves issued Executive Decree 43542-MP-MICITT declaring a national cyber emergency. The US subsequently committed over $25 million to bolster Costa Rica's cybersecurity capacity, including equipment, training, and support for CSIRT-CR.

   cr.usembassy.gov cyberlaw.ccdcoe.org

Timeline of decisions

1. 15 Apr 2026Law · official
   Costa Rica Ratifies Second Additional Protocol to Budapest Convention

   Costa Rica deposited its instrument of ratification for CETS No. 224 on enhanced co-operation and disclosure of electronic evidence, becoming the fourth country globally to ratify. The protocol expands cross-border access to electronic evidence and direct cooperation with service providers for cybercrime investigations.

   Council of Europe – Cybercrime Division

2. 16 Sept 2025Decision
   Second Court Ruling Upholds 5G Cybersecurity Regulation Against Constitutional Challenge

   A Costa Rican tribunal issued a second ruling affirming the validity of Decree 44196-MSP-MICITT's 5G cybersecurity requirements, rejecting legal challenges mounted by equipment vendors including Huawei. The rulings cement the government's authority to impose supply-chain security conditions on critical telecom infrastructure providers.

   TeleSemana

3. 1 Nov 2023Guidance · official
   National Cybersecurity Strategy 2023-2027 Formally Launched by MICITT

   MICITT published the successor National Cybersecurity Strategy built on five pillars, governance, legal framework, critical infrastructure protection, capacity-building, and international cooperation, directly incorporating lessons from the 2022 ransomware crisis. The strategy mandates creation of a national Security Operations Centre (SOC-CR) and assigns MICITT as the permanent lead-coordinating authority.

   MICITT

4. 1 Aug 2023Law · official
   Decree 44196-MSP-MICITT: 5G Cybersecurity Regulations Enacted

   Executive Decree 44196-MSP-MICITT established mandatory cybersecurity requirements for providers of 5G and next-generation telecommunications services, including supply-chain risk controls and equipment-trustworthiness assessments. This is Costa Rica's first sector-specific cybersecurity regulation and triggered extended litigation by affected vendors.

   MICITT

5. 20 Apr 2023Law
   Comprehensive Cybersecurity Bill (Exp. 23292) Advances to Legislative Plenary

   The Legislative Assembly approved Expediente 23292 for full plenary debate; the bill would create a National Cybersecurity Agency within MICITT, establish a critical information infrastructure (CII) protection regime, and impose mandatory incident-reporting obligations across public and private sectors. As of 2025 the bill had not yet been finally enacted.

   Cámara de Industrias de Costa Rica (Exp. 23292 text)

6. 13 Jun 2022Decision · official
   Costa Rica Signs Second Additional Protocol to Budapest Convention

   In the immediate aftermath of the 2022 ransomware crisis, Costa Rica's representative signed the Second Additional Protocol on enhanced co-operation and disclosure of electronic evidence, signalling commitment to stronger cross-border law enforcement cooperation on cybercrime.

   Council of Europe

7. 31 May 2022Incident
   Hive Ransomware Attack Cripples CCSS National Health System

   The Hive ransomware group attacked the Costa Rican Social Security Fund (CCSS), taking down the national digital health-record system and hospital payroll across the country; more than 800 servers and 9,000 end-user computers were affected. Occurring just weeks after the Conti crisis, the attack demonstrated that the cyber emergency extended far beyond the initial wave.

   TechCrunch

8. 8 May 2022Law
   President Chaves Declares National Cyber Emergency, Decree 43542-MP-MICITT

   Newly inaugurated President Rodrigo Chaves signed Executive Decree 43542-MP-MICITT, declaring a national state of emergency across the entire public sector due to the Conti ransomware attacks, the first cyber-emergency declaration in Costa Rican history and among the first in Latin America. The decree unlocked emergency procurement authority and mandatory inter-agency coordination under MICITT.

   BleepingComputer (reporting on Decree 43542-MP-MICITT)

9. 21 Apr 2022Guidance
   Directive 133-MP-MICITT: First Binding Cyber Incident-Reporting Mandate

   Issued four days after the Conti attack began, Directive 133-MP-MICITT obligated all central public administration entities to report cybersecurity incidents affecting service confidentiality, integrity, availability, or institutional identity to CSIRT-CR, even incidents considered internally under control. It established csirt@micit.go.cr as the mandatory reporting channel and required preservation of incident evidence.

   Lawfare (citing MICITT Directive 133-MP-MICITT)

10. 17 Apr 2022Incident
    Conti Ransomware Campaign Begins Against Costa Rican Government Agencies

    The Conti group launched a sustained ransomware campaign against nearly 30 Costa Rican state institutions, including the Ministry of Finance, MICITT, RACSA, and the Social Security Fund (CCSS), exfiltrating and publicly leaking sensitive personal and financial data. It was the most damaging cyberattack in Latin American government history and directly triggered debate about data protection adequacy.

    CCDCOE Cyber Law Toolkit

11. 17 Apr 2022Incident
    Conti Ransomware Group Attacks ~30 Costa Rican Government Institutions

    The Russia-linked Conti group breached the Ministry of Finance, MICITT, the Tax Administration, Customs, RACSA, and approximately 27 other government entities, encrypting systems and exfiltrating taxpayer data; Conti demanded a $10 million ransom and ultimately published 97% of stolen data after Costa Rica refused to pay. The attack paralysed tax and customs services for weeks and catalysed a complete overhaul of Costa Rica's cybersecurity governance.

    Wikipedia (citing MICITT, official decrees, and press reporting)

12. 3 Oct 2017Law · official
    Costa Rica Ratifies Budapest Convention on Cybercrime

    Costa Rica deposited its instrument of accession to the Council of Europe's Budapest Convention on Cybercrime, becoming one of only three Central American states party to the treaty. Ratification gave law enforcement access to the T-CY network for real-time cross-border cooperation and aligned domestic law with international cybercrime standards.

    Council of Europe – Cybercrime Division

13. 1 Jul 2012Law · official
    Law 9048: Major Expansion of Cybercrime Offences in Penal Code

    President Laura Chinchilla signed Law 9048, overhauling the Penal Code's cybercrime section to criminalise system intrusion, malware deployment, cyber-espionage, disclosure of government secrets via ICT, and social-media impersonation, with sentences of five to ten years. The law raised controversy over potential restrictions on press freedom but was ultimately upheld.

    SCIJ – Procuraduría General de la República

14. 1 Jul 2012Law · official
    Law 9048: Cybercrime Formally Introduced into the Penal Code

    President Laura Chinchilla signed Law 9048, amending the Penal Code to criminalise hacking, unauthorised access to computer systems, data interception, and electronic fraud in alignment with the UN Convention on Cybercrime framework. Law 9135 (2013) followed with additional cybercrime provisions, completing the first generation of substantive cyber-criminal law.

    Council of Europe Octopus Cybercrime Community

15. 9 Mar 2012Decision · official
    CSIRT-CR Established by Executive Decree 37052-MICIT

    Decree 37052-MICIT created the Computer Security Incident Response Team of Costa Rica (CSIRT-CR) within MICITT with authority to coordinate incident response across the three branches of government, autonomous institutions, and state-owned banks. CSIRT-CR became Costa Rica's first dedicated national cyber-defence body and the primary point of contact for international incident coordination.

    MICITT / CSIRT-CR RFC-2350 Document

Sources

1. 1.micitt.go.cr/sites/default/files/2023-06/englishEstrategia-Nacional-de-Ciberseguri
2. 2.micitt.go.cr/sites/default/files/2024-07/CSIRT-CR%20-%20RFC-2350%20ING%20(V1.0)%20
3. 3.cicr.com/wp-content/uploads/2022/10/Exp_23292.pdf
4. 4.dig.watch/resource/costa-ricas-national-cybersecurity-strategy-2023-2027
5. 5.hunton.com/privacy-and-cybersecurity-law-blog/costa-rica-imposes-five-day-breach
6. 6.cr.usembassy.gov/united-states-announces-25-million-to-strengthen-costa-ricas-cybersec
7. 7.cyberlaw.ccdcoe.org/wiki/Costa_Rica_ransomware_attack_(2022)
8. 8.coe.int/en/web/octopus/-/costa-rica
9. 9.ncsi.ega.ee/country/cr/
10. 10.delfino.cr/2024/05/experta-el-proyecto-de-ley-de-ciberseguridad-es-falente-y-se-
11. 11.semanariouniversidad.com/pais/proyecto-de-ley-de-ciberseguridad-mantiene-sanciones-y-mandatos-
12. 12.dlapiperdataprotection.com/index.html?t=law&c=CR