Cuba Law 149/2022 on Personal Data Protection
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | CU Law 149 |
| Region | Americas |
| Country or scope | Cuba |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers CU Law 149
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
CU-L149-SEC Security of Personal Data Processing | Those responsible for processing must apply technical and organizational measures that guarantee the security, confidentiality, and integrity of personal data and its processing systems (Law 149/2022, security-of-processing obligation) | Scan |
CU-L149-INV Accountability for Processing Systems | Responsibility for lawful processing presupposes knowing which software systems and components process personal data (Law 149/2022, controller-responsibility principle) | Scan |
CU-L149-QUAL Data Quality and Updating | Personal data must be exact and kept up to date so subjects can exercise rectification rights, requiring version tracking of the maintaining software (Law 149/2022, data-quality principle and rectification right) | Scan |
CU-L149-TP Third-Party Processing Safeguards | Communication of data to, or processing by, third parties requires legal grounds and equivalent safeguards, so component suppliers must be identified (Law 149/2022, third-party processing/communication provisions) | Scan |
CU-L149-DOC Documented Processing Environment | The duties of information and lawful processing imply an identifiable, timestamped record of the processing environment (Law 149/2022, duty of information) | Scan |
Policy templates
All 22 from the standard set, adapted to CU Law 149.
Costa Rica Law No. 8968 on Personal Data
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Curacao Personal Data Protection Ordinance
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.