CubaResolución 58/2022 (MINCOM), security and localization rules for personal data in electronic form
Resolución 58/2022 Ministerio de Comunicaciones, "Reglamento para la Seguridad y Protección de los Datos Personales en Soporte Electrónico" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-833-O90, 25 de agosto de 2022)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0_0.pdfIn force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Security, Transfer, Breach notice, Data subject rights, Disclosure
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Host or replicate any registry, file, archive, or database containing personal data in electronic form only on servers located within Cuba's national territory, absent a case the law provides for.NIST Privacy FrameworkID.IM-P7
- Guarantee the security of personal data in electronic form and adopt the necessary technical and administrative measures for its processing.NIST Privacy FrameworkPR.DS-P5
- Notify the competent authorities of cybersecurity incidents affecting personal data in electronic form under your custody.NIST Privacy FrameworkCM.AW-P7
- Let a telecommunications, application, or internet-service user access, update, and cancel their personal data on request, and disclose the purpose of data collection, privacy configuration options, and any tracking elements such as cookies.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
4 more
- AIR-PREV-020MCP Server Security Governance
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Dirección General de Informática, Dirección de Inspección, and the territorial Control offices of the Ministry of Communications
What it makes you log
Logging duty
Article 4(c) requires those responsible for and in charge of personal data registries, files, archives and databases to notify the competent authorities of cybersecurity incidents affecting electronic personal data; it is a duty to notify and names no record. Article 6(e) requires a backup of the data, which is a copy of the data and not a log, and Article 7 requires hosting on servers in the national territory, which is a location rule for the data. The First Final Provision charges the Ministry's Directorate of Inspection and its offices with controlling compliance, which is the regulator's own power and names no report owed by the party inspected. No access party or retention period for a record is named, and Article 2 names who is bound, not a territorial hook, so the hook is empty.
- Kind
- None
- As of
What this law does
Resolución 58/2022 of the Ministry of Communications implements Ley 149/2022's security duties for personal data processed in electronic form and binds public telecommunications and ICT operators and service providers, hosting providers, application providers, and private-network holders.
Article 7 requires that any registry, file, archive, or database containing personal data in electronic form be hosted or replicated only on servers located within the national territory, absent a case the law provides for. Controllers must guarantee the security of electronic personal data, adopt the necessary technical and administrative measures, and notify the competent authorities of cybersecurity incidents affecting personal data under their custody.
Controllers must also let data subjects who are users of public telecommunications, applications, and internet services access, update, and cancel their data on request, and disclose, in plain terms, the purpose of collection, privacy configuration options, and use of tracking elements such as cookies.
When LexLint raises it
When your app profile says your app provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .