Data protection & privacy law in Cuba (2026)

Legal framework

Ley No. 149/2022 'De Protección de Datos Personales' (Law on the Protection of Personal Data), supervised by the Ministry of Communications

Key points: data & privacy in Cuba

1. 01Primary legislation

   Ley No. 149/2022 'De Protección de Datos Personales' was adopted by the Cuban National Assembly and published in the Gaceta Oficial (edition O-90) on 25 August 2022, entering into force 180 days later on 21 February 2023.

   wipo.int gacetaoficial.gob.cu

2. 02Constitutional basis

   The law gives legal effect to the right to protection of personal data enshrined in the 2019 Cuban Constitution, particularly Article 40 (human dignity), Article 48 (personal and family privacy, image, voice, honour and identity), and Article 97.

   parlamentocubano.gob.cu dataguidance.com

3. 03Supervisory authority

   The Ministry of Communications (Ministerio de Comunicaciones) is the primary competent authority for enforcement, acting in coordination with the Ministry of the Interior, the Cuban Central Bank, and the Ministry of Justice for sanctioning purposes.

   dlapiperdataprotection.com dataguidance.com

4. 04Individual rights

   Data subjects are granted rights of access, rectification, erasure (once the original processing purpose is fulfilled), objection to processing that causes personal harm, and objection to automated decision-making, closely mirroring GDPR-style subject rights.

   caseguard.com globalcompliancenews.com

5. 05Scope and obligations

   The law applies to any natural or legal person (public or private) that processes personal data in Cuba. Data controllers and processors must register databases, observe purpose-limitation and data-minimisation principles, and obtain valid consent where required.

   digitalpolicyalert.org dlapiperdataprotection.com

6. 06Sanctions

   Penalties for non-compliance include administrative fines of up to CUP 20,000, temporary suspension of the offending database (five days), and permanent closure of the database for serious or repeated violations.

   caseguard.com globalcompliancenews.com

Timeline of decisions

1. 21 Feb 2023Law · official
   Law 149/2022 Enters into Force — Cuba's First Data Protection Law Becomes Binding

   Cuba's Personal Data Protection Law (Ley 149/2022) became legally enforceable 180 days after its August 2022 publication, making it the country's first comprehensive data-protection statute. It grants data subjects rights to access, rectify, and request non-disclosure of their personal data, and assigns primary enforcement to the Ministry of Communications (MINCOM) with fines up to CUP 20,000.

   WIPO Lex

2. 25 Aug 2022Law · official
   Law 149/2022 on Personal Data Protection Published in Official Gazette

   Cuba's Official Gazette published Ley 149/2022, establishing 12 data-processing principles, a legal basis requirement for processing, mandatory breach notification, and specific protections for sensitive categories such as health, ethnicity, and political opinion. Notably, the law explicitly exempts state security, national defense, and criminal-investigation activities from its protections.

   Gaceta Oficial de la República de Cuba

3. 14 May 2022Law · official
   Cuban National Assembly Adopts Ley 149/2022 on Personal Data Protection

   The National Assembly of People's Power approved Cuba's first standalone personal data protection law, applicable to all public and private entities processing personal data of individuals on Cuban territory. The law fills a decades-long gap and was initiated by the Council of State in January 2022 in direct response to the constitutional mandate of 2019.

   Cuba Si (Cuban Government News Service)

4. 24 Jul 2019Law · official
   Decree-Law 370/2019 on Computerization of Society Published

   Cuba enacted Decree-Law 370/2019 regulating the computerization of society, governing how state bodies, enterprises, and citizens use ICTs. The law complemented the 2019 Constitution's privacy provisions and established MINCOM's authority to oversee digital-society norms, setting the institutional groundwork that would evolve into the 2021 cybersecurity package and the 2022 data protection law.

   Granma (Official organ of the Communist Party of Cuba)

5. 24 Feb 2019Law · official
   New Cuban Constitution Adopted — Articles 48 and 97 Enshrine Privacy and Data Rights

   Cuba adopted a new Constitution via national referendum, replacing the 1976 charter. Article 48 guarantees the right to personal and family privacy, image, voice, honor, and personal identity; Article 97 explicitly recognises each person's right to access their personal data held by the state and to request its correction or non-disclosure — providing the direct constitutional mandate for Ley 149/2022.

   Constitute Project (official constitutional text reproduced)

6. 24 Feb 2019Law · official
   New Cuban Constitution Ratified: First Constitutional Personal Data Protection Guarantee

   Cuba's 2019 Constitution, approved by referendum, codified personal data protection as a constitutional guarantee (Article 97) and included an international relations chapter explicitly rejecting cyberwarfare and calling for democratization of cyberspace. It created the constitutional foundation for the subsequent wave of cybersecurity legislation.

   WIPO Lex

Sources

1. 1.wipo.int/wipolex/en/legislation/details/21647
2. 2.gacetaoficial.gob.cu/sites/default/files/goc-2022-o90_0.pdf
3. 3.parlamentocubano.gob.cu/index.php/ley-de-proteccion-de-datos-personales
4. 4.dlapiperdataprotection.com/?t=law&c=CU
5. 5.dlapiperdataprotection.com/index.html?t=authority&c=CU
6. 6.digitalpolicyalert.org/event/6549-implemented-personal-data-protection-law-including-data-pr
7. 7.dataguidance.com/opinion/cuba-new-data-protection-law-what-you-need-know
8. 8.caseguard.com/articles/cuba-passes-new-comprehensive-data-privacy-law/
9. 9.globalcompliancenews.com/2022/09/15/cuba-new-personal-data-protection-law-1509/