Cuba

Art. 10 gives data subjects the right to know the purpose of processing, to access, update and cancel their data, and to be informed of privacy options. Art. 8 requires terms of use to state the purpose, place of storage and retention period, with at least three months' notice of changes. Art. 6 requires controllers to provide ways to access, modify and cancel data.

Art. 43 requires users to give immediate information on any security incident, weakness or threat to the responsible unit of their entity, and art. 97 requires incident-management procedures to set who receives the report, how and when. The decree sets no hour- or day-based deadline.

Art. 9.1 requires obliged entities to identify all their customers, whether regular or occasional. Art. 7.2 includes identifying and verifying customer and beneficial-owner information and monitoring accounts in proportion to the risks identified, and art. 9.2 says verification of the beneficial owner follows Banco Central rules.

Art. 10.1 requires suspicious operations to be reported promptly ("con prontitud") to the Dirección General de Investigación de Operaciones Financieras, and art. 10.2 extends this to attempted transactions whatever the amount. Art. 11.1 allows reports to be sent directly or through the supervisor in the form the Banco Central sets. Failure to report is an administrative infraction under art. 10 of Decreto-Ley 363.