CubaLey 149/2022, De Protección de Datos Personales, general regime
Ley 149/2022 "De Protección de Datos Personales" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-832-O90, 25 de agosto de 2022)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0_0.pdfIn force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Obtain the data subject's express, unambiguous, free and informed consent before collecting or processing sensitive data (sex, gender identity, sexual orientation, ethnic origin, health, disability, genetic information, religious belief, political affiliation, or criminal record), absent a statutory exception.NIST Privacy FrameworkCT.PO-P1
- Let a data subject access, rectify, update, and cancel their personal data, including data held in a public registry, and honor an objection to processing, automated or not, that evaluates their performance, economic situation, health, reliability, or behavior, or risks harming them.NIST Privacy FrameworkCT.PO-P3
- Notify the competent authority of cybersecurity incidents affecting personal data held in a registry, file, archive, or database under your custody.NIST Privacy FrameworkCM.AW-P7
- Transfer personal data nationally or internationally only on one of the law's enumerated grounds; a general business justification is not enough.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
The statute also authorizes non-monetary measures: a warning, suspension of the database for up to five days, or closure of the registry, file, archive, or database, graduated by the social impact, gravity, and repetition of the violation (art. 56.1-56.2).
- Rule
- Fixed only
- As of
- Currency
- CUP
- Fixed cap
- 20,000
Who enforces it
Enforcement body
Officials expressly authorized by each central-state body, organism, or national entity, within the scope of its own competence (Ley 149/2022, art. 56.4)
Settledness
- As of
- Open questions
- Which central State body's expressly authorized officials are the "autoridad competente" that imposes the fine and the other measures of Article 56 paragraph 4 on a person or entity that falls within no central State body's or national entity's "ámbito de su competencia"?
What it reaches
Obligation class
Consent, Data subject rights, Transfer, Breach notice, Disclosure
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- natural persons, with respect to their own data (las personas naturales respecto a sus datos)
- natural and legal persons, as to the processing of personal data that they carry out (las personas jurídicas y naturales, en cuanto al tratamiento de datos personales que realicen)
What it makes you log
Logging duty
Article 48 requires the person responsible for or in charge of a registry, file, archive or database of personal data to notify the competent authority of cybersecurity incidents. It is a duty to notify and does not say that a record of the incident is kept. The other sections this row cites set consent, rights, sanctions and transfer rules without a record duty. Articles 41 and 42, outside this row's sections, have the controller declare its database to the competent authority, which is a filing and not a record the controller keeps, and the last part of Article 9(g), also outside them, makes the files open to inspection by the competent authority. The sections cited here name no audit, access party or retention period for a record, and Article 2 names who is bound and not a territorial hook, so the hook is empty.
- Kind
- None
- As of
What this law does
Ley 149/2022 is Cuba's first comprehensive personal-data statute, binding natural persons with respect to their own data and any natural or legal person that processes personal data.
Article 15 lists sex, gender identity, sexual orientation, ethnic origin and skin color, health status, disability, genetic information, diagnostic test results, religious belief, political affiliation, and criminal record as sensitive data requiring the data subject's express consent to process, absent a statutory exception. Data subjects hold rights to access, rectify, and cancel their personal data, including data held in public as well as private registries.
They may also object to processing, automated or not, that evaluates their professional performance, economic situation, health, reliability, or behavior, or that risks harming them. A person or entity responsible for a registry, file, archive, or database must notify the competent authority of cybersecurity incidents affecting the personal data in its custody. National and international transfer of personal data is permitted only on an enumerated list of grounds rather than as a general rule.
Violations draw administrative sanctions from a warning up to a fine of up to 20,000 pesos, suspension of the database for up to five days, or closure of the registry, file, archive, or database, imposed by officials the responsible state body or entity has expressly authorized, without prejudice to any civil or criminal liability that may separately arise.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .