Chapter 5 of Annex II to Resolution No. 175/2022 stipulates that the Cuban Customs Authority authorises the importation of information and communications technology equipment in specific quantities, permitting up to three computing devices of any type, including a complete desktop microcomputer, a laptop, a tablet PC, an e‑reader or any similar item; up to five mobile telephones, whether basic or smart models; and up to three telecommunications‑related items or network devices, including accessories or peripherals for computing equipment such as mice, keyboards or other comparable components.

Chapter 5 of Annex II to Resolution No. 175/2022 and Section 2 of Resolution No. 272/2015 stipulate that, when imported by legal entities, the following categories of communications equipment require prior authorisation from the Cuban Ministry of Communications (MINCOM): wireless fax machines; wireless microphones and their accessories; data‑network devices such as routers, switches, and similar equipment; radio transmitters and transceivers of any type and service, including fixed, mobile, and personal stations (for example, walkie‑talkies and satellite telephones), together with their components and power amplifiers; wireless telephones operating in frequency bands not authorised by MINCOM; telephone switchboards of all types; wireless access points such as RLAN devices and comparable equipment, except for Wi‑Fi equipment, which is governed by its own specific regulatory framework; professional radio receivers distinct from domestic radio and television sets; satellite earth stations and transmitting and receiving satellite‑communications terminals, including satellite‑television receiving stations, parabolic antennas, their accessories, and portable or other satellite telephones; and equipment intended for the mass transmission of data, text, or voice by wireless means.

According to the Ministry of Communications, a process is implemented that requires a homologation certificate issued after control in testing laboratories in Cuba for ICT goods. Although there is no legal framework establishing the procedures for testing, control and certification of these goods, the Ministry requires companies to pass certain tests to obtain a homologation certificate for each product or service of telecommunication and computer equipment. There are two accredited laboratories in Cuba. The first one performs tropicalisation tests. The second one handles the testing of equipment connected to telecommunications networks that use the spectrum. Through this certification process, the Ministry of Communications regulates and controls the technical and operating specifications of the systems, equipment, and devices to be used in telecommunications and computer networks in order to guarantee the interconnection between public networks, as well as the interoperability of services.

Art. 19 (e) of Resolution No. 179/08 requires that Internet access service providers must ensure that software with cryptographic systems or encrypted file transfer is not used.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Cuba's law and jurisprudence.

It is reported that access to web access points such as Wi‑Fi hotspots, cybercafés and public access centres requires users to register with their personal identification information.

Art. 60 of Decree-Law No. 360/2019 establishes that computer systems in which access is possible by multiple users should implement a personal and unique user identifier. The article adds that the people to whom user identifiers are assigned are responsible for the actions realised with their user identifier. In the event of termination of the employment relationship or other causes determined by the entity managing the computer system, the user identifier should be eliminated. In all cases, the the traces of use of the access credentials should be preserved for a period of no less than one year.

It is reported that Cuba’s approach to SIM registration obliges mobile network operators to collect and store users’ personal information, including proof of identity; however, the relevant legislation could not be located.

According to Art. 51 of Decree-Law No. 360/2019, providers and operators must:
- block the sending, receiving or transmission of harmful mass messages that are sent through their networks and use their services;
- Temporarily suspend for up to a month communications between their networks and those established with the networks of foreign operators or providers that do not adopt the necessary measures to prevent the traffic of harmful mass messages, which is notified within 72 hours after to its suspension and, in the same term, report to the Ministry of Communications;
- Temporarily suspend for up to one month the service provided to users responsible for sending harmful mass messages, which is notified within 72 hours after its suspension and, in the same period, informs the Ministry of Communications, the agencies of the Ministry of the Interior or the Office of the Attorney General of the Republic.
In Art. 53, the Decree establishes that any natural or legal person who transports them or mediates in their dissemination or transmission or has influenced their content is responsible for sending harmful mass messages if, through their technical means, they had known it and did not avoid its transportation, dissemination, transmission, sending and forwarding.

According to Art. 69 of Decree-Law No. 35, telecom operators and providers, in coordination with authorities, must implement technical measures to minimise risks associated with their networks and services. They must also interrupt services if used to harm other operators or countries, transmit false, offensive, or harmful information, or content that is sexual, discriminatory, harassing, invades privacy, or affects personal dignity, identity, integrity, public morality, public order, or is used for illegal acts, irrespective of any resulting criminal, civil, or administrative liability.

It is reported that certain messaging applications showed signs of blocking during the period from 1 June 2024 to 31 May 2025.
The blockings are most likely implemented in accordance with Art. 69 of Decree-Law No. 35/2021, which stipulates that public telecommunications and ICT service operators and providers, in coordination with the competent authorities, shall implement technical operational and supervisory measures to minimise the risks associated with the use of their networks and services, or to suspend such services when they are employed in a manner that affects the networks or services of other operators or countries. This includes instances in which such networks or services are used to disseminate false or offensive information, material detrimental to human dignity, sexual or discriminatory content, or content that incites harassment; that infringes personal or family privacy, or compromises an individual’s image, voice, identity, integrity, or honour; that threatens collective security, general welfare, public morality, or respect for public order; or that serves as a means for committing unlawful acts, irrespective of any ensuing criminal, civil, or administrative liability.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 2 in Cuba for the year 2024. This corresponds to "The government shut down domestic access to the Internet several times this year."

Art. 19 of Decree No. 102/2024 stipulates that proprietors of digital mass media must seek authorisation from the president of the Institute of Information and Social Communication to insert and disseminate advertising, and in doing so must specify the distinctive features and intended scope of the proposed advertising activities. In addition, Art. 115.1.i provides that, in relation to advertising in cyberspace, access to content across digital platforms, applications, video games, or any other software may not be conditioned upon the user’s acceptance of advertising messages.

Law 149/2022 includes provisions for cross-border data transfer and outlines that there are only five specific exceptions for data transfers outside the country. The cross-border data transfer is therefore only allowed in the case of international judicial cooperation, exchange of medical data when necessary for the treatment of the data subject, bank or stock exchange transfers about the relevant transactions, under applicable international treaties, and if the transfer of data is for the purpose of international cooperation in the fight against crime (Art. 65.1). In addition, Art. 66 grants to certain authorities the competencies to authorise the international transfer of personal data in other circumstances.

Cuba has not joined any agreement with binding commitments to open transfers of data across borders.