Law: Law 149/2022 on Personal Data Protection (only available in Spanish here) ('the Law')
Regulator: Ministry of Justice ('MINJUS')
Summary: In Cuba, the Law regulates the protection of personal data, consolidating the right to privacy provided under Article 97 of the Constitution of the Republic of Cuba. The Law applies to public and private bodies, introduces the concepts of data owners, with specific rights, as well as responsible persons, and designated persons. Processing of personal data in Cuba is underpinned by 12 personal data protection principles which must be complied with in any such activities. Interestingly, the Law details an extensive definition for personal data and requires the establishment of a data retention regime and even specifies a statutory retention period of five years, if it is not otherwise stated by law for a category of record.
Although the Law does not establish a new data protection authority, the MINJUS is tasked with ensuring compliance and various public bodies are permitted to authorise cross-border transfers of personal data. To support the Law, the Regulation for Safety and Protection of Personal Data in an Electronic Format governs the processing of personal data by public telecommunications and ICT services providers. Having been published on 25 August 2022 in the Official Gazette, both the Law and the Regulation will enter into force 180 days from this date i.e. 21 February 2023.