It is reported that access to web access points such as Wi‑Fi hotspots, cybercafés and public access centres requires users to register with their personal identification information.

Art. 60 of Decree-Law No. 360/2019 establishes that computer systems in which access is possible by multiple users should implement a personal and unique user identifier. The article adds that the people to whom user identifiers are assigned are responsible for the actions realised with their user identifier. In the event of termination of the employment relationship or other causes determined by the entity managing the computer system, the user identifier should be eliminated. In all cases, the the traces of use of the access credentials should be preserved for a period of no less than one year.

It is reported that Cuba’s approach to SIM registration obliges mobile network operators to collect and store users’ personal information, including proof of identity; however, the relevant legislation could not be located.

According to Art. 51 of Decree-Law No. 360/2019, providers and operators must:
- block the sending, receiving or transmission of harmful mass messages that are sent through their networks and use their services;
- Temporarily suspend for up to a month communications between their networks and those established with the networks of foreign operators or providers that do not adopt the necessary measures to prevent the traffic of harmful mass messages, which is notified within 72 hours after to its suspension and, in the same term, report to the Ministry of Communications;
- Temporarily suspend for up to one month the service provided to users responsible for sending harmful mass messages, which is notified within 72 hours after its suspension and, in the same period, informs the Ministry of Communications, the agencies of the Ministry of the Interior or the Office of the Attorney General of the Republic.
In Art. 53, the Decree establishes that any natural or legal person who transports them or mediates in their dissemination or transmission or has influenced their content is responsible for sending harmful mass messages if, through their technical means, they had known it and did not avoid its transportation, dissemination, transmission, sending and forwarding.

According to Art. 69 of Decree-Law No. 35, telecom operators and providers, in coordination with authorities, must implement technical measures to minimise risks associated with their networks and services. They must also interrupt services if used to harm other operators or countries, transmit false, offensive, or harmful information, or content that is sexual, discriminatory, harassing, invades privacy, or affects personal dignity, identity, integrity, public morality, public order, or is used for illegal acts, irrespective of any resulting criminal, civil, or administrative liability.

Art. 25 of Decree-Law No. 35 establishes that "public telecommunications services have priority over private telecommunications services" explicitly imposing, within a legal framework, discrimination against foreign companies in favour of the state ones. The Cuban telecommunications framework is defined by the prohibition of private provision of internet and mobile services and by the concentration of control in the state-owned operator Empresa de Telecomunicaciones de Cuba S.A. (ETECSA), through which all internet access is channelled and whose subsidiary Cubacel serves as the sole mobile provider. This structure is legally reinforced by Art. 1 of Decree No. 124/2025, which grants ETECSA an administrative concession to provide public telecommunications services nationwide, while Art. 3 defines the scope of those services to include basic telephony, signal-carrying services, data transmission, and terrestrial mobile cellular telecommunications, and Art. 4.1 establishes an exclusivity period extending until 2036. In parallel, the Annex of Decree No. 107, specifically activities 65 and 66, prohibits private micro, small, and medium-sized enterprises, non-agricultural cooperatives, and self-employed workers from providing public internet access or related services.

Cuba is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA), nor does it have observer status.

Cuba has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

The Cuban telecommunications framework is defined by the prohibition of private provision of internet and mobile services and by the concentration of control in the state-owned operator Empresa de Telecomunicaciones de Cuba S.A. (ETECSA), through which all internet access is channelled and whose subsidiary Cubacel serves as the sole mobile provider. This structure is legally reinforced by Art. 1 of Decree No. 124/2025, which grants ETECSA an administrative concession to provide public telecommunications services nationwide, while Art. 3 defines the scope of those services to include basic telephony, signal-carrying services, data transmission, and terrestrial mobile cellular telecommunications, and Art. 4.1 establishes an exclusivity period extending until 2036. In parallel, the Annex of Decree No. 107, specifically activities 65 and 66, prohibits private micro, small, and medium-sized enterprises, non-agricultural cooperatives, and self-employed workers from providing public internet access or related services.

Cuba does not have a telecommunications authority whose decision‑making processes are fully independent from the government. In fact, no separate telecommunications regulator exists. Art. 2 of Decree‑Law No. 308 of 2013 states that the Ministry of Communications is the body responsible for proposing, and once approved, directing and supervising State and governmental policy for the country’s unified communications system. This system includes telecommunications, information technology, radiocommunications, postal services, communications‑related automation, radio‑spectrum management, and the corresponding technical and support functions.

Although Law 118 on foreign investment does not restrict investments in the online commerce sector, the state company CIMEX, with its company Tuenvio.cu, is the only platform that offers online purchases in Cuba.

Art. 68.f of Decree‑Law No. 370/2018 stipulates that hosting a website on servers located in a foreign country, except where such hosting functions solely as a mirror or replica of the primary website situated on servers within national territory, constitutes a violation related to ICT. Similarly, Art. 82 of Decree No. 360/2019 provides that when, due to connectivity requirements or other considerations, an entity must host a website on servers outside the country, this may only be undertaken as a mirror or replica of the principal website hosted on servers in Cuba. It further requires the adoption of all necessary measures to guarantee the security of the website, particularly during the process of updating information. In addition, Art. 83 establishes that an entity’s network servers intended to facilitate external access and those intended for internal use must be installed in distinct areas of the network in order to prevent any connection between them.

Art. 19 of the Foreign Investment Law stipulates that, for the establishment of an international economic association, the national investor must negotiate with the foreign investor every aspect of the investment, including its economic feasibility, the respective contributions of the parties, the proposed governance and administrative structure, and the legal instruments required for its formalisation.
In the case of a wholly foreign‑owned enterprise, the Ministry of Foreign Trade and Foreign Investment designates the Cuban entity responsible for the relevant sector, subsector, or economic activity with which the investor must examine the proposal and from which written approval must be obtained.
Art. 20 provides that the Cuban State authorises only those foreign investments that do not compromise national defence and security, the nation’s patrimony, or the environment. Art. 21 further establishes that approval to undertake foreign investments within national territory is granted, depending on the sector, modality, and characteristics of the proposed investment, by one of the following organs of the State: the Council of State, the Council of Ministers, or the head of the competent body of the Central State Administration authorised for this purpose.
The internal evaluation and follow-up process for foreign investment projects is further regulated by Resolution No. 21/2020 of the Ministry of Foreign Trade and Foreign Investment, which approves the Regulation of the Commission for the Evaluation of Foreign Investment Businesses.

Law 149/2022 includes provisions for cross-border data transfer and outlines that there are only five specific exceptions for data transfers outside the country. The cross-border data transfer is therefore only allowed in the case of international judicial cooperation, exchange of medical data when necessary for the treatment of the data subject, bank or stock exchange transfers about the relevant transactions, under applicable international treaties, and if the transfer of data is for the purpose of international cooperation in the fight against crime (Art. 65.1). In addition, Art. 66 grants to certain authorities the competencies to authorise the international transfer of personal data in other circumstances.

According to Art. 4 of Resolution No. 659/2002, foreign individuals and legal entities that lack a domicile or a real and effective commercial establishment in Cuba must be represented by an Official Agent for any legal act carried out before the Cuban Industrial Property Office. In addition, Art. 15.4 of Decree-Law No. 290/2012 provides that, where a patent applicant lacks a domicile or a real and effective industrial or commercial establishment in Cuba, an agent residing in Cuba must act as intermediary.