--- title: "KM-A Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/km-a-data-protection-privacy-regulation/ source_html: /jurisdictions/comoros-anjouan/index.html description: "KM-A data protection and privacy regulation: 10 categories, 20 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: c814dbad8163aadce809db9727657b6da2416ee60d0225dd14b4f8d183392527 generator: "fe-fleet/md-twin@1.0" --- # KM-A Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap Last updated 2026-11-04 · 10 categories · 20 claims · 8 sources in the cumulative register Download report (PDF) Expand all Sources materially disagree on whether Comoros-Anjouan has ever had a comprehensive data-protection law in force. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=COMOROS-ANJOUAN)[Build Report](/reports/?j=COMOROS-ANJOUAN)[Compare](/compare/?j=COMOROS-ANJOUAN) Framework posture Unregulated gap 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority OneTrust DataGuidance Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 10 Red categories 58 Sub-modules 20 Claims 1 Tier-1 sources Traffic-light mix 10 red (sums to 10 rendered categories; click to filter) 10 categories flagged red ## Jurisdiction lead brief Standing brief, as of 25 October 2026. #### Lead Signal Sources materially disagree on whether Comoros-Anjouan has ever had a comprehensive data-protection law in force. A 2023 civil-society legal review states that Comoros does not have a dedicated data protection law, and that a 2014 draft bill does not appear to have been enacted. A compliance-vendor summary, by contrast, describes a Law on the Protection of Personal Data as enacted on 29 June 2021, with GDPR-aligned obligations including a seventy-two-hour breach-notification duty, though it describes that law as unenforced for want of an operational supervisory authority. No primary gazette text has been located to resolve this disagreement either way. #### Other Developments No operational supervisory authority exists under either account. Whether or not a comprehensive law was enacted in 2021, the vendor source describing that law also states that the designated authority is not operational. This fact holds regardless of which account of the statute is correct, and it is the single most consequential finding in the record: a law without an enforcing body, if it exists, and the absence of any law at all, if the civil-society account is correct, converge on the same practical outcome for anyone assessing regulatory exposure in this jurisdiction. A distinct cybercrime and ICT provision does impose a data-retention duty. The Comoros Information and Communications Code, cited as Loi n degrees 21-011/AU, requires service providers to retain data capable of identifying persons who use their networks, and allows a judicial authority to compel supply of identification data. This is a cybercrime and ICT code provision, not a transposition of any ePrivacy-style instrument, and it sits outside the disputed comprehensive data-protection law entirely; it is in force on the evidence available, independent of how the 2021 law dispute is ultimately resolved. #### Cross-Monitor Connections The gambling-licensing and enabler-jurisdiction dimensions of Comoros-Anjouan's broader regulatory record, including the Anjouan-branded licensing network's disputed legal status and a related cross-border cooperation request, are tracked on the gambling-regulatory and financial-integrity monitors respectively and are not analysed here. #### Outlook The open question is whether either Loi n degrees 14-029/AU, the 2014 draft bill, or the law the vendor source dates to 29 June 2021, was ever adopted via a verifiable gazette publication, and whether any Comorian authority, whether or not currently operational, has been formally constituted to supervise data protection. Until a primary government or gazette text is located, this finding stands as disputed rather than resolved, and the practical assessment, that no operational enforcement mechanism exists under any account of the law, is unlikely to change even if the enactment question itself is eventually settled. Read full brief · 432 words Key regulatory facts for KM-A Regulatory Dimension KM-A Standing Position Jurisdiction KM-A (KM-A) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 20 sourced findings) Regulator & Framework Absence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan. Lawful Processing & Special Data No lawful-basis or consent framework exists absent an enacted DP statute. Data Subject Rights No data-subject-rights framework exists absent an enacted DP statute. Controller/Processor Duties No controller/processor accountability regime exists absent an enacted DP statute. Primary Instruments Cited OneTrust DataGuidance, International Association of Privacy Professionals (IAPP), International Association of Privacy Professionals (IAPP), Internews ARISA Internet Environment Assessment -- Comoros chapter, Digital Watch Observatory Last Confirmed / Updated 2026-11-04 (8 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### KM-A: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Absence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan. Traffic-light rationale — Red Absence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan. #### Sub-modules (5) #### Regulator And AuthorityRed No national or island-level (Anjouan) data-protection regulator identified. Claims (3): - No independent or sectoral data-protection supervisory authority for the Union of the Comoros (including the autonomous island of Anjouan) is listed in current regional data-protection regulator trackers. - Union of the Comoros — No operational data-protection supervisory authority exists; a designated authority is described as 'not operational'. - Comoros data-protection supervisory authority — No dedicated KM-A (or KM-national) data protection authority has been confirmed operational as of this cycle. #### Act And InstrumentsRed No comprehensive omnibus statute identified; Comoros not listed among Malabo Convention ratifiers. Claims (5): - The Union of the Comoros does not appear in the current global inventory of countries with comprehensive data-protection and privacy laws in effect. - The Union of the Comoros is not identified among the African Union member states reported to have ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection), so that regional instrument does not currently bind Comoros domestically. - Comoros (national-level, Loi n°14-029/AU) — A 2023 civil-society legal mapping and a 2025-dated Africa DP factsheet state Comoros has no dedicated data-protection law and that the 2014 draft (Loi n°14-029/AU) does not appear enacted; a 2026 country-profile source states Comoros 'has a personal data protection law'. - Union of the Comoros — A 2023 civil-society legal review states Comoros does not have a dedicated data protection law, and a 2014 draft bill does not appear to have been enacted. - Comoros Law on the Protection of Personal Data — A compliance-vendor summary describes a 'Law on the Protection of Personal Data' as enacted 29 June 2021, with GDPR-aligned obligations including 72-hour breach notification, though unenforced for lack of an operational authority. #### Material ScopeRed No statutory material-scope test (personal data definition, processing scope) exists absent an enacted law. #### Territorial ScopeRed No extraterritorial/targeting test, household exemption, or representative-appointment duty exists absent an enacted law. #### Regulator Registration And FilingRed No registration, notification, or fee regime exists absent a designated regulator. No dedicated data-protection supervisory authority or comprehensive data-protection statute could be located for the Union of the Comoros, of which Anjouan (Nzwani) is an autonomous island. Global and regional trackers of data-protection law (IAPP's 144-country directory, OneTrust DataGuidance's African Bodies tracker) do not list Comoros as having an operative DPA or omnibus statute, and Comoros does not appear among the African Union member states reported to have ratified the Malabo Convention. Anjouan's well-known autonomous-island offshore-finance and company-registration functions did not surface any dedicated data-protection instrument in this research pass. This is recorded as a gap finding rather than an invented obligation. Periodic update · new data 2026-11-04 #### Regulator & Framework The underlying state of Comoros data-protection law, which bears directly on Anjouan as an island within the Union, is unsettled in a way that is itself the finding rather than a gap to be filled later. A 2023 civil-society legal mapping states plainly that Comoros does not have a dedicated data protection law, and identifies a 2014 draft, Loi n 14-029/AU, that does not appear to have been enacted. A separate, more general country-level source likewise states that Comoros currently has no comprehensive data protection legislation. Against this, a 2026-dated country-profile source states that Comoros has a personal data protection law providing the basis for regulating personal data processing, while noting that public information on an operational supervisory authority remains limited. These two positions are in direct conflict on the most basic question, whether any data-protection statute has ever been enacted at national level, and the conflict cannot be resolved from the material gathered. What is understood to be consistent across both positions is that no dedicated data-protection supervisory authority has been confirmed operational for Comoros, or for Anjouan specifically. Even the source asserting that a law exists stops short of identifying a functioning regulator exercising powers under it. For Anjouan, this means that whatever the resolution of the statutory question turns out to be, the practical absence of a confirmed operational authority is the more immediately relevant fact: there is, on the evidence gathered, no body known to be receiving complaints, issuing guidance, or exercising enforcement powers over data processing on the island or at the national level that would reach it. The disputed status of Loi n 14-029/AU sits at the centre of the disagreement. If the 2014 draft was never enacted, as the civil-society and general country sources suggest, then any claim of a Comoros personal data protection law resting on that instrument would be describing a draft rather than an enacted statute. No primary text from the Journal Officiel des Comores has been located to settle which account is accurate. This is presented here as a disputed state of the law, to be read by readers as an open legal question rather than as a research shortfall that a future search is expected to close. #### Outlook The path to resolution runs through a primary legislative text. Should the Journal Officiel des Comores record show Loi n 14-029/AU, or a successor instrument, formally enacted, that would settle the statutory question in one direction; continued absence of such a record across further monitoring would reinforce the no-enactment account. Separately, and regardless of how the statutory question resolves, confirmation of any operational supervisory body with actual complaint-handling or enforcement activity would mark a materially different development from anything found, since no such body has been identified under either account of the law. Sources and claims (8) - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/african-bodies) — No independent or sectoral data-protection supervisory authority for the Union of the Comoros (including the autonomous island of Anjouan) is listed in current regional data-protection regulator trackers. - [International Association of Privacy Professionals (IAPP)](https://iapp.org/news/a/data-protection-and-privacy-laws-now-in-effect-in-144-countries) — The Union of the Comoros does not appear in the current global inventory of countries with comprehensive data-protection and privacy laws in effect. - [International Association of Privacy Professionals (IAPP)](https://iapp.org/news/a/evaluating-data-privacy-across-africa-toward-a-unified-gdpr-inspired-framework) — The Union of the Comoros is not identified among the African Union member states reported to have ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection), so that regional instrument does not currently bind Comoros domestically. - [Internews ARISA Internet Environment Assessment -- Comoros chapter](https://internews.org/wp-content/uploads/2023/11/ARISA-IEA-CHAPTER-5-Comoros.pdf) — Comoros (national-level, Loi n°14-029/AU) — A 2023 civil-society legal mapping and a 2025-dated Africa DP factsheet state Comoros has no dedicated data-protection law and that the 2014 draft (Loi n°14-029/AU) does not appear enacted; a 2026 country-profile source states Comoros 'has a personal data protection law'. - [Digital Watch Observatory](https://dig.watch/countries/comoros) — Union of the Comoros — No operational data-protection supervisory authority exists; a designated authority is described as 'not operational'. - [dataprotection.africa](https://dataprotection.africa/comoros/) — Union of the Comoros — A 2023 civil-society legal review states Comoros does not have a dedicated data protection law, and a 2014 draft bill does not appear to have been enacted. - [Digital Watch Observatory](https://dig.watch/countries/comoros) — Comoros Law on the Protection of Personal Data — A compliance-vendor summary describes a 'Law on the Protection of Personal Data' as enacted 29 June 2021, with GDPR-aligned obligations including 72-hour breach notification, though unenforced for lack of an operational authority. - [dataprotection.africa](https://dataprotection.africa/comoros/) — Comoros data-protection supervisory authority — No dedicated KM-A (or KM-national) data protection authority has been confirmed operational as of this cycle. ### KM-A: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No lawful-basis or consent framework exists absent an enacted DP statute. Traffic-light rationale — Red No lawful-basis or consent framework exists absent an enacted DP statute. D2 · Lawful Processing — Full Module Record 4 sub-modules · 26 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-A: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No data-subject-rights framework exists absent an enacted DP statute. Traffic-light rationale — Red No data-subject-rights framework exists absent an enacted DP statute. #### Sub-modules (5) #### Access RightRed No subject-access-request framework identified. Claims (1): - No statutory subject-access, rectification, erasure, restriction, objection, or portability rights regime could be identified for Comoros in the absence of a national data-protection law. #### Rectification And ErasureRed No erasure/rectification right identified. #### Restriction And ObjectionRed No restriction/objection right identified. #### Data PortabilityRed No portability right identified. #### Deadlines And Response WindowsRed No statutory response deadline identified. No statutory subject-access, rectification/erasure, restriction/objection, portability right, or statutory response-deadline framework could be identified for Comoros/Anjouan. Sources and claims (1) - [International Association of Privacy Professionals (IAPP)](https://iapp.org/news/a/data-protection-and-privacy-laws-now-in-effect-in-144-countries) — No statutory subject-access, rectification, erasure, restriction, objection, or portability rights regime could be identified for Comoros in the absence of a national data-protection law. ### KM-A: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No controller/processor accountability regime exists absent an enacted DP statute. Traffic-light rationale — Red No controller/processor accountability regime exists absent an enacted DP statute. D4 · Controller & Processor — Full Module Record 7 sub-modules · 26 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-A: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No domestic transfer-mechanism regime exists; adjacent cybercrime-cooperation instrument status is unconfirmed. Traffic-light rationale — Red No domestic transfer-mechanism regime exists; adjacent cybercrime-cooperation instrument status is unconfirmed. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 104 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-A: D6 Sectoral Watch8 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sectoral DP overlays identified for any of the eight declared sub-modules. Traffic-light rationale — Red No sectoral DP overlays identified for any of the eight declared sub-modules. D6 · Sectoral Watch — Full Module Record 8 sub-modules · 42 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-A: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No adtech/commercial-privacy regime exists absent an enacted DP or ePrivacy statute. Traffic-light rationale — Red No adtech/commercial-privacy regime exists absent an enacted DP or ePrivacy statute. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 21 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-A: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No algorithmic/biometric governance regime exists absent an enacted DP statute. Traffic-light rationale — Red No algorithmic/biometric governance regime exists absent an enacted DP statute. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 25 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-A: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No children/vulnerable-groups DP regime exists absent an enacted statute. Traffic-light rationale — Red No children/vulnerable-groups DP regime exists absent an enacted statute. D9 · Children's Privacy — Full Module Record 5 sub-modules · 18 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-A: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No enforcement or redress regime exists absent an enacted DP statute and designated regulator. Traffic-light rationale — Red No enforcement or redress regime exists absent an enacted DP statute and designated regulator. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 38 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties