Cuba

Ley 149/2022 is Cuba's first comprehensive personal-data statute, binding natural persons with respect to their own data and any natural or legal person that processes personal data.

Article 15 lists sex, gender identity, sexual orientation, ethnic origin and skin color, health status, disability, genetic information, diagnostic test results, religious belief, political affiliation, and criminal record as sensitive data requiring the data subject's express consent to process, absent a statutory exception. Data subjects hold rights to access, rectify, and cancel their personal data, including data held in public as well as private registries.

They may also object to processing, automated or not, that evaluates their professional performance, economic situation, health, reliability, or behavior, or that risks harming them. A person or entity responsible for a registry, file, archive, or database must notify the competent authority of cybersecurity incidents affecting the personal data in its custody. National and international transfer of personal data is permitted only on an enumerated list of grounds rather than as a general rule.

Violations draw administrative sanctions from a warning up to a fine of up to 20,000 pesos, suspension of the database for up to five days, or closure of the registry, file, archive, or database, imposed by officials the responsible state body or entity has expressly authorized, without prejudice to any civil or criminal liability that may separately arise.

Resolución 58/2022 of the Ministry of Communications implements Ley 149/2022's security duties for personal data processed in electronic form and binds public telecommunications and ICT operators and service providers, hosting providers, application providers, and private-network holders.

Article 7 requires that any registry, file, archive, or database containing personal data in electronic form be hosted or replicated only on servers located within the national territory, absent a case the law provides for. Controllers must guarantee the security of electronic personal data, adopt the necessary technical and administrative measures, and notify the competent authorities of cybersecurity incidents affecting personal data under their custody.

Controllers must also let data subjects who are users of public telecommunications, applications, and internet services access, update, and cancel their data on request, and disclose, in plain terms, the purpose of collection, privacy configuration options, and use of tracking elements such as cookies.

Article 289 punishes violating legally established computer-security measures to use information technology media and affect the confidentiality, integrity, or availability of digital assets, with imprisonment of six months to two years or a fine of 200 to 500 cuotas, or both.

Article 290 punishes accessing or using, or letting another access or use, an information system, storage device, software, or database without due authorization, with the purpose of appropriating, using, knowing, disclosing, or disseminating the information it stores, transmits, or captures, with imprisonment of one to three years or a fine of 300 to 1,000 cuotas, or both; because the offense turns on lacking due authorization for a specific purpose rather than on defeating a technical access control, a scraper reading a public, unauthenticated page falls outside a plain reading of the provision unless it is shown to lack authorization for one of the stated purposes.

Article 291 punishes using equipment or procedures to obstruct lawful access to information systems, or scanning telecommunications and ICT services to detect security vulnerabilities, interrupt services, or obtain information about their operation or users, without authorization. Article 292 punishes any act intended to compromise the security of ICT-using systems and knowingly providing a service toward that end.

Article 293 punishes intercepting, manipulating, or interfering with an information or telematic system without authorization and with intent to cause damage, with an aggravated bracket where illegally obtained passwords or similar means are used. Article 294 punishes producing, trafficking, or introducing computer viruses or malicious code intended to disable ICT infrastructure.

Article 296 allows the sanction to be doubled where a grave harm results, an international or foreign system is affected, or a vital or strategic system is put at risk, and increased by half where the offender is an official or employee with custody of the affected system, and allows the accessory sanction of confiscation of property.

Each cuota's monetary value is fixed by the sentencing court between 10 and 200 pesos according to the convicted person's income, so the fine bracket named in each article above is not itself a single peso amount.

Cuba's separate telecommunications framework, Decreto-Ley 35/2021, and its implementing Resolución 105/2021 on cybersecurity-incident response (issued under the earlier Decreto 360/2019) impose incident-notification duties on network operators but create no distinct authorization or access regime for a third party reading data from a system.

Decreto No. 360/2019 sets Cuba's legal framework for the secure use of information and communication technologies (TIC) and binds bodies and organs of the Central State Administration, the Central Bank of Cuba, national entities, People's Power bodies, the state business system and budgeted units, cooperatives, mixed enterprises, nonprofit associative forms, political, social and mass organizations, and natural persons.

Its implementing Reglamento, approved the same day by Resolución 128/2019 of the Ministry of Communications, extends that list by name to non-state forms of ownership and management. Non-state forms of ownership and management and natural persons must comply with the Reglamento to the extent it applies to them even where they have no specialized security personnel.

Every entity that uses TIC must design, implement, manage and keep updated a TIC Security System proportionate to the importance of the assets it protects and the risks it faces, and must adopt a written TIC Security Plan setting out the policies, measures and procedures that follow from it.

An Internet access service provider must additionally draft internal security-operation procedures, name the person responsible for the security of its network, and adopt technical and organizational measures to prevent malware contamination and network attacks and intrusions. The Ministry of Communications licenses any entity that wishes to provide TIC security services to third parties. Only a state entity whose personnel reside permanently in the country may hold that license.

Producers of equipment and providers of network, program, application and IT services, whether domestic or foreign, are responsible for implementing the requirements that guarantee the secure operation of the equipment and services they supply.

Neither Decreto 360/2019 nor its Reglamento sets a specific technical security standard, a pre-market certification gate, a mandatory support period, or a dedicated vulnerability-disclosure channel that a manufacturer must meet, so this regime does not reach the product-security dimension this topic tracks.

A violation draws administrative sanctions, a preventive notice, temporary or partial invalidation or outright cancellation of an administrative authorization the Ministry of Communications granted, temporary or partial suspension or cancellation of computing and communications services contracted with an authorized enterprise, and confiscation of the means used to commit the infraction, rather than a monetary fine.

Neither Decreto 360/2019 nor its Reglamento states an entry-into-force date distinct from their shared Gaceta Oficial publication date of 4 July 2019.

Resolución 105/2021 of the Ministry of Communications approves a Reglamento establishing the National Action Model for responding to cybersecurity incidents within the National Cyberspace, to guarantee an effective response for its protection.

The Reglamento applies to natural and legal persons, naming government bodies, diplomatic missions and Cuba's own commercial and cooperation representations abroad, the state business system, cooperatives, mixed enterprises and other foreign-investment forms, nonprofit associative forms, and the holders of data networks in the National Cyberspace.

A person directly responsible for the computing infrastructure where a cybersecurity incident occurs must report it to their immediate superior and to the Cuban Computer Incident Response Team (CuCERT), housed in the Ministry of Communications' Oficina de Seguridad para las Redes Informáticas (OSRI).

The holder of a private data network is separately responsible for ensuring that a cybersecurity event or incident affecting that network is recorded and classified, and for delivering the information that reporting to CuCERT requires. The holder of a private network belonging to a natural person, and a natural person individually, must also report a cybersecurity incident through the channel the Ministry of Communications publishes on its own website.

CuCERT receives and forwards incident information until a dedicated Cybersecurity entity, to be staffed jointly by the Ministries of Communications, of the Revolutionary Armed Forces and of the Interior, is created to take over that function.

Article 38 permits, without the author's consent and without remuneration but with mandatory credit to the author's name and the source, and provided the work is already known to the public: reproducing citations or fragments in written, sound, or visual form for teaching, informational, critical, illustrative, or explanatory purposes, to the extent the purpose pursued justifies; using a work, even in full where its brief length and nature justify it, as teaching illustration in publications or broadcasts; and reproducing, broadcasting, or otherwise communicating to the public any political speech, report, conference, or judicial debate, or other work of the same character, that has already been communicated or made known to the public, though including such a speech in a compiled collection of one author's works or in a collective work still requires the author's consent and remuneration.

The stored text of this 1977 law is a scanned, optical-character-recognized copy whose transcription is degraded throughout; the provisions above are read from that scan.