Data protection & privacy law in Cuba (2026)

Cuba's Personal Data Protection Law (Ley 149/2022) became legally enforceable 180 days after its August 2022 publication, making it the country's first comprehensive data-protection statute. It grants data subjects rights to access, rectify, and request non-disclosure of their personal data, and assigns primary enforcement to the Ministry of Communications (MINCOM) with fines up to CUP 20,000.

Cuba's Official Gazette published Ley 149/2022, establishing 12 data-processing principles, a legal basis requirement for processing, mandatory breach notification, and specific protections for sensitive categories such as health, ethnicity, and political opinion. Notably, the law explicitly exempts state security, national defense, and criminal-investigation activities from its protections.

The National Assembly of People's Power approved Cuba's first standalone personal data protection law, applicable to all public and private entities processing personal data of individuals on Cuban territory. The law fills a decades-long gap and was initiated by the Council of State in January 2022 in direct response to the constitutional mandate of 2019.

Published in Official Gazette Extraordinary No. 92, Decree-Law 35/2021 on Telecommunications, ICTs, and Radio Spectrum Use — together with companion Decrees 42 and 43 and MINCOM Resolution 105/2021 on Cybersecurity Incident Response — authorized suspension or termination of internet services for content deemed 'false,' threatening 'public order,' or harmful to 'morality,' and legally codified blanket internet shutdowns. Human-rights organizations condemned the package as institutionalising censorship and mass digital surveillance.

Following unprecedented anti-government protests across Cuba, authorities directed ETECSA to cut mobile internet and social media for several days — the first large-scale documented use of a state-directed network shutdown on the island. The incident exposed the lack of any legal constraint on government access to or disruption of citizens' communications data, and directly accelerated enactment of Decree-Law 35/2021.

Cuba enacted Decree-Law 370/2019 regulating the computerization of society, governing how state bodies, enterprises, and citizens use ICTs. The law complemented the 2019 Constitution's privacy provisions and established MINCOM's authority to oversee digital-society norms, setting the institutional groundwork that would evolve into the 2021 cybersecurity package and the 2022 data protection law.

The Council of Ministers enacted Decree 360/2019 on the Security of ICTs and the Defence of National Cyberspace, creating mandatory ICT-security obligations for all state bodies, enterprises, cooperatives, and individuals. It assigned MINCOM supervisory authority over ICT-security compliance across the entire economy, constituting Cuba's first coherent cybersecurity legal instrument and a precursor to data-protection regulation.

Cuba adopted a new Constitution via national referendum, replacing the 1976 charter. Article 48 guarantees the right to personal and family privacy, image, voice, honor, and personal identity; Article 97 explicitly recognises each person's right to access their personal data held by the state and to request its correction or non-disclosure — providing the direct constitutional mandate for Ley 149/2022.

Cuba's Ministry of Communications issued Resolution 57/2003, establishing the first sector-specific norms governing information security and confidentiality for computing systems operated by state entities. It set baseline standards for protecting electronically stored data and assigned MINCOM responsibility for their enforcement, representing the earliest building block of Cuba's eventual data-governance architecture.