Pursuant to Art. 72 of SUTEL’s End-User Protection Scheme Regulations (RPUF), SUTEL must make available to end-users and operators/providers a platform for the registration and updating of information concerning prepaid end-users, known as the Prepaid Register. This platform enables the verification of the identity of prepaid service users before they are allowed to make calls other than those required to complete the registration process.
Before making calls outside the registration platform, prepaid end-users must register, at a minimum, their assigned telephone number and the following information:
- full name;
- valid identity card, equivalent identification document or, in the case of foreign nationals, passport;
- place of residence; and
- email address.
For legal entities, registration must include the legal registration number and the full name or business name, together with the details of the legal representative or authorised agent. In addition, Art. 11.27 of the Act requires telecommunications operators and service providers to verify the authenticity of customers’ identification details and supporting documents, and to duly record this information at the time of subscription or service provision.
This regime is further complemented by the General Regulations for Data Update of Prepayment Mobile Users, which remain in force as the implementing rules for the prepaid-user registration and data-update mechanism originally established under the 2010 Regulation on the Regime for the Protection of the End User of Telecommunications Services, now repealed and replaced by the RPUF. Under these implementing regulations, users of prepaid mobile subscriptions must validate their identity, while mobile network operators must collect and record users’ personal information and proof-of-identity documentation. It has also been reported that operators may be required to share, upon request, full or partial prepaid-user registration profiles with the government.

Under recital XVI and point 1 of Resolution DGA-368-2009, imports of used or inoperative electronic equipment covered by the specified tariff lines require prior authorisation under Technical Note No. 269. The measure applies to ICT products including printers and multifunction machines, laptops and other data-processing equipment, mobile phones, data transmission equipment, digital cameras, monitors, personal digital assistants, and projectors.

Under recital XVI and point 1 of Resolution DGA-368-2009, exports of used or inoperative electronic equipment covered by the specified tariff lines require prior authorisation under Technical Note No. 269. The measure applies to ICT products including printers and multifunction machines, laptops and other data-processing equipment, mobile phones, data transmission equipment, digital cameras, monitors, personal digital assistants, and projectors.

Under the "Procedure for the Approval of Mobile Telecommunications Devices", companies seeking to have their mobile phones certified must submit the devices for testing to experts accredited by the Telecommunications Superintendence (SUTEL)

According to Art. 111 bis of Law No. 7.557 on General Customs, introduced in June 2022 by Art. 1.8 of Law No. 10271, the importation of goods whose total value does not exceed the threshold of 100 Central American pesos (equivalent to USD 100) are exempt from import duties. This threshold is lower than the USD 200 threshold recommended by the International Chamber of Commerce (ICC).

Law No. 7472 and its accompanying Regulations establish a comprehensive framework for consumer protection that extends to transactions conducted online.

Costa Rica has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Costa Rica has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Costa Rica has enacted national legislation based on the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures, namely Law No. 8454 on Certificates, Digital Signatures and Electronic Documents.

Under Art. 15 of Law No. 7.789, foreign participation in public or private telecommunications companies entering into joint ventures with the state-owned Heredia Public Services Company (ESPH) is limited to 49% of the capital stock. In addition, Art. 5 of Law No. 8.660 on the Strengthening and Modernization of Public Entities in the Telecommunications Sector requires the Costa Rican Electricity Institute (ICE), which operates in the telecommunications sector, to retain at least 51% of the share capital of any company it constitutes or acquires. The same provision further establishes that the sale of shares in any ICE company must be authorised by a special law.

Costa Rica has joined trade agreements covering cooperation commitments on open transfers of cross-border data flows. However, none of these commitments includes binding rules on cross-border data transfers. These include:
- Art. 15.5.d of the Tratado de Libre Comercio entre los Estados Unidos Mexicanos y las Repúblicas de Costa Rica, El Salvador, Guatemala, Honduras y Nicaragua;
- Art. 16.7.c of the Tratado de Libre Comercio entre la República de Colombia y la República de Costa Rica.

In general, there are no restrictions based on nationality for directors and managers of telecommunications companies. However, in the case of the Costa Rican Institute for Electricity (ICE), a major public company providing electricity and telecommunications services, all directors must be Costa Rican nationals. This requirement is in Art. 10 of the Law of Creation of the Costa Rican Electricity Institute, which states that the superior administration of the ICE shall correspond to a Board of Directors and that all of them must be Costa Ricans characterised by their honorability.

Law No. 8968 and Executive Decree No. 37554-JP establish a comprehensive framework for data protection in Costa Rica. The Costa Rican Data Protection Authority (PRODHAB) is the body charged with overseeing and enforcing compliance with the Law.

According to Art. 34 of Law No. 6.867 on Patents, Industrial Designs and Utility Models, it is mandatory to appoint a local representative to file a patent application if the applicant has a domicile or headquarters outside of Costa Rica.

Costa Rica has a safe harbour regime in place for intermediaries for copyright infringements. Executive Decree No. 36.880 implements Art. 15.11.27 of the Central America-Dominican Republic Free Trade Agreement (CAFTA-DR), establishing limitations on liability for service providers for copyright only. Pursuant to the Decree, users who believe their rights have been violated should communicate with the service provider, who has 15 days to take down the content. Takedowns can also occur through a judicial order. The system has been criticised for ambiguity, as the limited intermediary liability applies to service providers who voluntarily abide by the rule.