Law: Law 149/2022 on Personal Data Protection (only available in Spanish here) (the Law)

Regulator: Ministry of Justice (MINJUS)

Summary: In Cuba, Law 149/2022 on Personal Data Protection (only available in Spanish here) (the Law) regulates the protection of personal data, consolidating the right to privacy provided under Article 97 of the Constitution of the Republic of Cuba. To support the Law, the Regulation for Safety and Protection of Personal Data in an Electronic Format (the Regulation) governs the processing of personal data by public telecommunications and ICT services providers. Having been published on August 25, 2022, in the Official Gazette, both the Law and the Regulation entered into force 180 days from this date, on February 21, 2023.

The Law applies to public and private bodies, introduces the concepts of data owners, with specific rights, as well as responsible persons, and designated persons. Processing of personal data in Cuba is underpinned by 12 personal data protection principles which must be complied with in any such activities. Interestingly, the Law details an extensive definition for personal data and requires the establishment of a data retention regime and even specifies a statutory retention period of five years if it is not otherwise stated by law for a category of record.

Although the Law does not establish a new data protection authority, the Ministry of Justice (MINJUS) is tasked with ensuring compliance and various public bodies are permitted to authorize cross-border transfers of personal data.