Ley 149/2022, De Protección de Datos Personales, general regime
Ley 149/2022 "De Protección de Datos Personales" (Gaceta Oficial de la República de Cuba, Ordinaria No. 90, GOC-2022-832-O90, 25 de agosto de 2022)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 21 February 2023.
A comprehensive regime rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Obtain the data subject's express, unambiguous, free and informed consent before collecting or processing sensitive data (sex, gender identity, sexual orientation, ethnic origin, health, disability, genetic information, religious belief, political affiliation, or criminal record), absent a statutory exception.
- Let a data subject access, rectify, update, and cancel their personal data, including data held in a public registry, and honor an objection to processing, automated or not, that evaluates their performance, economic situation, health, reliability, or behavior, or risks harming them.
- Notify the competent authority of cybersecurity incidents affecting personal data held in a registry, file, archive, or database under your custody.
- Transfer personal data nationally or internationally only on one of the law's enumerated grounds; a general business justification is not enough.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
The statute also authorizes non-monetary measures: a warning, suspension of the database for up to five days, or closure of the registry, file, archive, or database, graduated by the social impact, gravity, and repetition of the violation (art. 56.1-56.2).
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- CUP
- Fixed cap
- 20,000
Who enforces it
Enforcement body
Officials expressly authorized by each central-state body, organism, or national entity, within the scope of its own competence (Ley 149/2022, art. 56.4)
What it reaches
Obligation class
Consent, Data subject rights, Transfer, Breach notice, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Ley 149/2022 is Cuba's first comprehensive personal-data statute, binding natural persons with respect to their own data and any natural or legal person that processes personal data.
Article 15 lists sex, gender identity, sexual orientation, ethnic origin and skin color, health status, disability, genetic information, diagnostic test results, religious belief, political affiliation, and criminal record as sensitive data requiring the data subject's express consent to process, absent a statutory exception. Data subjects hold rights to access, rectify, and cancel their personal data, including data held in public as well as private registries.
They may also object to processing, automated or not, that evaluates their professional performance, economic situation, health, reliability, or behavior, or that risks harming them. A person or entity responsible for a registry, file, archive, or database must notify the competent authority of cybersecurity incidents affecting the personal data in its custody. National and international transfer of personal data is permitted only on an enumerated list of grounds rather than as a general rule.
Violations draw administrative sanctions from a warning up to a fine of up to 20,000 pesos, suspension of the database for up to five days, or closure of the registry, file, archive, or database, imposed by officials the responsible state body or entity has expressly authorized, without prejudice to any civil or criminal liability that may separately arise.
When LexLint raises it
automated_outreachhigh_risk_decisions
Read the law
Official text of Ley 149/2022 as published in Gaceta Oficial de la República de Cuba
Ordinaria No. 90 (25 August 2022), in an Internet Archive capture