🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi
KM-A v13-gdpri-1.0.0
content: ai_generated legal review: never_reviewed (informational) publication gate: 2 failing4 sources retrieved model claude-sonnet-5 · 2026-10-03

Based mainly on secondary sources. Only 1 of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.

KM-A

KM-A schema gdpri-v2 trajectory: not yet assessedunregulated gap

Summary answer not yet published for this jurisdiction

Data collected Data published

AI-assembled from cited sources

Coverage record not yet available for this jurisdiction

10 categories · 13 claims · 4 sources in the cumulative register

10Categoriesbaseline.[]
58Sub-modulesbaseline..sub_modules{}
13Claimsbaseline..claims[]
0Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix (sums to 10 rendered categories; click to filter)

Jurisdiction brief

No content recorded at this JID path.

10 of 10 categories
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

Absence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan.

Traffic-light rationale — RedAbsence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan.

Sub-modules (5)

Regulator And AuthorityRed

No national or island-level (Anjouan) data-protection regulator identified.

Claims (1):

  • No independent or sectoral data-protection supervisory authority for the Union of the Comoros (including the autonomous island of Anjouan) is listed in current regional data-protection regulator trackers.

Act And InstrumentsRed

No comprehensive omnibus statute identified; Comoros not listed among Malabo Convention ratifiers.

Claims (2):

  • The Union of the Comoros does not appear in the current global inventory of countries with comprehensive data-protection and privacy laws in effect.
  • The Union of the Comoros is not identified among the African Union member states reported to have ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection), so that regional instrument does not currently bind Comoros domestically.

Material ScopeRed

No statutory material-scope test (personal data definition, processing scope) exists absent an enacted law.

Territorial ScopeRed

No extraterritorial/targeting test, household exemption, or representative-appointment duty exists absent an enacted law.

Regulator Registration And FilingRed

No registration, notification, or fee regime exists absent a designated regulator.

Category narrative101 words

No dedicated data-protection supervisory authority or comprehensive data-protection statute could be located for the Union of the Comoros, of which Anjouan (Nzwani) is an autonomous island. Global and regional trackers of data-protection law (IAPP's 144-country directory, OneTrust DataGuidance's African Bodies tracker) do not list Comoros as having an operative DPA or omnibus statute, and Comoros does not appear among the African Union member states reported to have ratified the Malabo Convention. Anjouan's well-known autonomous-island offshore-finance and company-registration functions did not surface any dedicated data-protection instrument in this research pass. This is recorded as a gap finding rather than an invented obligation.

Sources and claims (3)
  1. UncertainOneTrust DataGuidance — No independent or sectoral data-protection supervisory authority for the Union of the Comoros (including the autonomous island of Anjouan) is listed in current regional data-protection regulator trackers.observed
  2. UncertainInternational Association of Privacy Professionals (IAPP) — The Union of the Comoros does not appear in the current global inventory of countries with comprehensive data-protection and privacy laws in effect.observed
  3. UncertainInternational Association of Privacy Professionals (IAPP) — The Union of the Comoros is not identified among the African Union member states reported to have ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection), so that regional instrument does not currently bind Comoros domestically.observed

#

No lawful-basis or consent framework exists absent an enacted DP statute.

Traffic-light rationale — RedNo lawful-basis or consent framework exists absent an enacted DP statute.

Sub-modules (4)

Lawful BasesRed

No GDPR Art 6-equivalent lawful-basis enumeration identified.

Claims (1):

  • No enumerated lawful-processing-basis regime, consent-validity standard, or special-category/sensitive-data rules specific to data protection could be identified for Comoros in the absence of an enacted comprehensive statute.

Special CategoriesRed

No sensitive/special-category processing conditions identified.

Pseudonymisation And AnonymisationRed

No statutory identifiability test or anonymisation safe-harbour identified.

Category narrative26 words

No enumerated lawful-basis regime, consent-validity standard, special-category/sensitive-data rules, or pseudonymisation/anonymisation safe-harbour could be identified for Comoros/Anjouan, consistent with the absence of a comprehensive statute (see regulator_and_framework).

Sources and claims (1)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — No enumerated lawful-processing-basis regime, consent-validity standard, or special-category/sensitive-data rules specific to data protection could be identified for Comoros in the absence of an enacted comprehensive statute.observed

#

No data-subject-rights framework exists absent an enacted DP statute.

Traffic-light rationale — RedNo data-subject-rights framework exists absent an enacted DP statute.

Sub-modules (5)

Access RightRed

No subject-access-request framework identified.

Claims (1):

  • No statutory subject-access, rectification, erasure, restriction, objection, or portability rights regime could be identified for Comoros in the absence of a national data-protection law.

Rectification And ErasureRed

No erasure/rectification right identified.

Restriction And ObjectionRed

No restriction/objection right identified.

Data PortabilityRed

No portability right identified.

Deadlines And Response WindowsRed

No statutory response deadline identified.

Category narrative16 words

No statutory subject-access, rectification/erasure, restriction/objection, portability right, or statutory response-deadline framework could be identified for Comoros/Anjouan.

Sources and claims (1)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — No statutory subject-access, rectification, erasure, restriction, objection, or portability rights regime could be identified for Comoros in the absence of a national data-protection law.observed

#

No controller/processor accountability regime exists absent an enacted DP statute.

Traffic-light rationale — RedNo controller/processor accountability regime exists absent an enacted DP statute.

Sub-modules (7)

Accountability And DpiaRed

No DPIA trigger list or accountability principle codified.

Claims (1):

  • No statutory breach-notification duty, DPIA trigger list, DPO threshold, or ROPA obligation specific to data protection could be identified for Comoros.

Dpo RequirementsRed

No DPO appointment threshold identified.

Ropa RequirementsRed

No ROPA obligation or exemption test identified.

Joint Controller ArrangementsRed

No joint-controller or processor-contract mandatory-terms rule identified.

Security MeasuresRed

No security-of-processing standard identified.

Breach NotificationRed

No breach-notification threshold, deadline, or content requirement identified (data-protection breach rule only; ICT-incident regimes are out of scope here).

Retention And DisposalRed

No statutory retention limit or disposal duty identified.

Category narrative26 words

No statutory DPIA trigger list, DPO appointment threshold, ROPA exemption test, processor-contract mandatory-terms rule, security-measures standard, breach-notification duty, or retention/disposal rule could be identified for Comoros/Anjouan.

Sources and claims (1)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — No statutory breach-notification duty, DPIA trigger list, DPO threshold, or ROPA obligation specific to data protection could be identified for Comoros.observed

#

No domestic transfer-mechanism regime exists; adjacent cybercrime-cooperation instrument status is unconfirmed.

Traffic-light rationale — RedNo domestic transfer-mechanism regime exists; adjacent cybercrime-cooperation instrument status is unconfirmed.

Sub-modules (6)

Transfer MechanismsRed

No adequacy, SCC, BCR, or derogation mechanism exists under Comorian law; possible but unconfirmed participation in Budapest Convention Second Additional Protocol noted separately.

Claims (2):

  • No Comorian statutory transfer mechanism equivalent to GDPR Arts 44-49 (adequacy, SCCs, BCRs, derogations) governing outbound personal-data transfers from Comoros/Anjouan could be identified, absent a national data-protection law.
  • The Union of the Comoros appears in a list of Parties/signatories annexed to the Second Additional Protocol to the Council of Europe Convention on Cybercrime (OJ L 2023/2862), which includes data-protection safeguards for cross-border law-enforcement access to electronic evidence; Comoros's exact ratification status could not be independently confirmed in this pass.

Adequacy ReceivedRed

No adequacy decision received from any other regime identified.

Adequacy GrantedRed

No adequacy decision granted by Comoros to any other regime identified (no competent authority exists to issue one).

Sccs And BcrsRed

No national SCC or BCR framework identified.

Transfer Impact AssessmentRed

No statutory TIA requirement identified.

Data LocalisationRed

No data-localisation mandate identified.

Category narrative104 words

No Comorian statutory transfer mechanism (adequacy regime, SCCs, BCRs, localisation rule, or transfer-impact-assessment test) could be identified, consistent with the absence of a national data-protection statute. Separately, search results place the Union of the Comoros within a list of Parties/signatories annexed to the Second Additional Protocol to the Council of Europe Convention on Cybercrime (published at OJ L 2023/2862), an instrument containing safeguards on cross-border law-enforcement access to electronic evidence; Comoros's precise ratification status under that instrument (signatory vs. party in force) could not be independently confirmed from the retrieved material and should be checked against the Council of Europe treaty office status list.

Sources and claims (2)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — No Comorian statutory transfer mechanism equivalent to GDPR Arts 44-49 (adequacy, SCCs, BCRs, derogations) governing outbound personal-data transfers from Comoros/Anjouan could be identified, absent a national data-protection law.observed
  2. SpeculativeEUR-Lex / Publications Office of the European Union — The Union of the Comoros appears in a list of Parties/signatories annexed to the Second Additional Protocol to the Council of Europe Convention on Cybercrime (OJ L 2023/2862), which includes data-protection safeguards for cross-border law-enforcement access to electronic evidence; Comoros's exact ratification status could not be independently confirmed in this pass.observed

#

No sectoral DP overlays identified for any of the eight declared sub-modules.

Traffic-light rationale — RedNo sectoral DP overlays identified for any of the eight declared sub-modules.

Sub-modules (8)

Financial Sector OverlayRed

No banking-secrecy or open-banking data-access rule identified.

Health Sector OverlayRed

No health-sector data rule identified.

Telecoms And EprivacyRed

No national ePrivacy/communications-data retention transposition identified.

Employment DataRed

No employee-data provision identified.

Credit And ScoringRed

No credit-scoring rule identified.

EducationRed

No education-sector data rule identified.

InsuranceRed

No insurance-sector data rule identified.

Data Access SharingRed

No horizontal data-access/smart-data/data-portability scheme, and no Data Act-equivalent regime, identified for Comoros or specifically for Anjouan's offshore-registry functions.

Claims (1):

  • No Comoros-specific data-access-sharing, open-banking, or sector-overlay data regime (financial, health, telecoms, employment) could be identified in this pass; searches on Anjouan's offshore-finance and gaming-registry functions did not return a dedicated data-protection sectoral overlay.
Category narrative42 words

No Comoros-specific financial-sector, health-sector, telecoms/ePrivacy, employment-data, credit-scoring, education, insurance, or data-access-sharing overlay regime could be identified. Anjouan is known internationally chiefly for its autonomous-island offshore company-registration and licensing functions, but no dedicated data-protection sectoral overlay for that activity surfaced in available sources.

Sources and claims (1)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — No Comoros-specific data-access-sharing, open-banking, or sector-overlay data regime (financial, health, telecoms, employment) could be identified in this pass; searches on Anjouan's offshore-finance and gaming-registry functions did not return a dedicated data-protection sectoral overlay.observed

#

No adtech/commercial-privacy regime exists absent an enacted DP or ePrivacy statute.

Traffic-light rationale — RedNo adtech/commercial-privacy regime exists absent an enacted DP or ePrivacy statute.

Sub-modules (6)

Cookies And TrackersRed

No cookie-consent provision identified.

Claims (1):

  • No ePrivacy-style cookie/tracker consent regime or direct-marketing consent statute specific to Comoros could be identified; no sectoral telecoms-privacy regulation surfaced in this pass.

Dark PatternsRed

No dark-pattern prohibition identified.

Opt Out SignalsRed

No opt-out-signal (GPC/DAA-equivalent) framework identified.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room rule identified.

Cross Context AdvertisingRed

No cross-context-advertising rule identified.

Direct MarketingRed

No direct-marketing consent or suppression rule identified.

Category narrative21 words

No ePrivacy-style cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rule, or direct-marketing consent statute specific to Comoros could be identified.

Sources and claims (1)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — No ePrivacy-style cookie/tracker consent regime or direct-marketing consent statute specific to Comoros could be identified; no sectoral telecoms-privacy regulation surfaced in this pass.observed

#

No algorithmic/biometric governance regime exists absent an enacted DP statute.

Traffic-light rationale — RedNo algorithmic/biometric governance regime exists absent an enacted DP statute.

Sub-modules (6)

Profiling RestrictionsRed

No profiling-restriction provision identified.

Claims (1):

  • No Comorian statutory analogue to GDPR Art 22 (automated decision-making/profiling restrictions) or biometric-specific regulation could be identified.

Automated Decision Making TransparencyRed

No ADM transparency/explanation right identified.

Ai Risk AssessmentsRed

No AI-specific risk-assessment regime identified.

Biometric RegimeRed

No biometric-data processing condition identified.

Genetic DataRed

No genetic-data regime identified.

State Surveillance CarveoutsRed

No national-security/surveillance carve-out provision identified.

Category narrative25 words

No statutory analogue to GDPR Art 22 (automated decision-making/profiling restrictions), AI-specific risk-assessment regime, biometric-processing condition, genetic-data rule, or state-surveillance carve-out could be identified for Comoros.

Sources and claims (1)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — No Comorian statutory analogue to GDPR Art 22 (automated decision-making/profiling restrictions) or biometric-specific regulation could be identified.observed

#

No children/vulnerable-groups DP regime exists absent an enacted statute.

Traffic-light rationale — RedNo children/vulnerable-groups DP regime exists absent an enacted statute.

Sub-modules (5)

Age VerificationRed

No age-of-consent threshold identified.

Claims (1):

  • No Comorian age-of-digital-consent threshold or parental-consent mechanism for data processing could be identified in the absence of a national data-protection statute.

Minor Profiling BansRed

No minor-profiling prohibition identified.

Education SettingsRed

No education-settings-specific rule identified.

Dependent AdultsRed

No dependent-adults protection rule identified.

Category narrative18 words

No statutory age-of-digital-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection could be identified for Comoros.

Sources and claims (1)
  1. UncertainInternational Association of Privacy Professionals (IAPP) — No Comorian age-of-digital-consent threshold or parental-consent mechanism for data processing could be identified in the absence of a national data-protection statute.observed

#

No enforcement or redress regime exists absent an enacted DP statute and designated regulator.

Traffic-light rationale — RedNo enforcement or redress regime exists absent an enacted DP statute and designated regulator.

Sub-modules (6)

Regulator Powers And PenaltiesRed

No investigative powers or penalty tiers identified.

Claims (1):

  • No enforcement powers, penalty tiers, or redress mechanisms specific to data protection could be identified for the Union of the Comoros, consistent with the absence of both a national data-protection authority and a comprehensive statute.

Enforcement Activity IndexRed

No enforcement decisions identified (no regulator exists to issue them).

Regulator Funding And CapacityRed

Not applicable; no regulator exists.

Collective Redress And Class ActionsRed

No collective-redress or representative-action mechanism identified.

Private Right Of ActionRed

No private right of action specific to data protection identified.

Recent Developments 180DRed

No legislative, regulatory, or case-law developments in the last 180 days identified for Comoros.

Category narrative38 words

No statutory maximum fines, investigative/decision deadlines, appeal routes, collective-redress mechanism, private right of action, or recent (180-day) enforcement development could be identified for Comoros, consistent with the absence of both a national DPA and a comprehensive data-protection statute.

Sources and claims (1)
  1. UncertainOneTrust DataGuidance — No enforcement powers, penalty tiers, or redress mechanisms specific to data protection could be identified for the Union of the Comoros, consistent with the absence of both a national data-protection authority and a comprehensive statute.observed
No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

Blocking. 2 failing check(s).

schema_validpass
min_quoted_text_presentwaived — floor 0%
translation_provenance_recordedn/a — no subject in this jurisdiction
egress_verifiedpass
min_t1_per_instrument_metn/a — no subject in this jurisdiction
jurisdiction_source_floor_metFAIL
source_tier_integrity_okpass
manual_overrideFAIL
tier_a_b_national_primary_pct25.0
aggregator_only_jurisdiction_count0

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for KM-A
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewerno reviewer on record
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 13 claim(s) (13 category placement(s)), 4 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 6 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsaccess right
Art. 14Data Subject Rightsaccess right
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer impact assessment
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redresscollective redress and class actions
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties

Self-audit

All 10 modules were researched, but none yielded a Comoros/Anjouan-specific Tier-1 data-protection statute or regulator; the single Tier-1 anchor obtained (src-001, EU Official Journal publication of the Second Additional Protocol to the Convention on Cybercrime) is adjacent (cross-border law-enforcement evidence access) rather than a DP-specific instrument, and its application to Comoros is unconfirmed. All substantive findings rest on Tier-3 commentary/tracker sources (IAPP global directory, IAPP Africa analysis, OneTrust DataGuidance African Bodies page) used to support an absence-of-regime finding rather than to state positive obligations. No seed anchors were injected for this JID (all seed fields blank in the dispatch), so sourcing was fully self-directed.

Unresolved questions (4):

  • Has the Union of the Comoros enacted a national data-protection statute or established a DPA since the sources retrieved in this pass were last updated?
  • What is Comoros's confirmed signatory/ratification status under the Second Additional Protocol to the Council of Europe Convention on Cybercrime (OJ L 2023/2862), and does it have any operative data-protection safeguard provisions applicable today?
  • Does Anjouan's autonomous-island offshore-finance and company/gaming registry framework contain any island-level confidentiality or data-handling rules distinct from the Union-level (Moroni) legal order, and are any such instruments published in a reachable gazette?
  • Has Comoros signed or ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection) since the most recent (128-day-old) ratification count cited here?

Escalate to primary-source review: yes