🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi
KM-M v13-gdpri-1.0.0
content: ai_generated legal review: never_reviewed (informational) publication gate: 2 failing5 sources retrieved model claude-sonnet-5 · 2026-10-03

Based mainly on secondary sources. Only 1 of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.

KM-M

KM-M schema gdpri-v2 trajectory: not yet assessedunregulated gap

Summary answer not yet published for this jurisdiction

Data collected Data published

AI-assembled from cited sources

Coverage record not yet available for this jurisdiction

10 categories · 11 claims · 5 sources in the cumulative register

10Categoriesbaseline.[]
58Sub-modulesbaseline..sub_modules{}
11Claimsbaseline..claims[]
0Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix (sums to 10 rendered categories; click to filter)

Jurisdiction brief

No content recorded at this JID path.

10 of 10 categories
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

No supervisory authority, no enabling statute, no registration/filing regime identified after targeted research; confirmed gap rather than a sourcing failure.

Traffic-light rationale — RedNo supervisory authority, no enabling statute, no registration/filing regime identified after targeted research; confirmed gap rather than a sourcing failure.

Sub-modules (5)

Regulator And AuthorityRed

No DPA has been established in Comoros/Mohéli.

Claims (1):

  • No data protection authority has been established in the Union of the Comoros (which includes Mohéli/Mwali as a constituent island) as of the research date; the IAPP directory records no DPA or comprehensive data protection legislation for Comoros.

Act And InstrumentsRed

No national data-protection act exists; the only identified instrument touching personal data is the treaty-level Samoa Agreement commitment.

Claims (1):

  • The Union of the Comoros is a named signatory party to the OACPS-EU Samoa Partnership Agreement, Article 15 of which commits parties to maintain data-protection regimes and establish independent supervisory authorities, but no domestic implementing statute has been identified giving this commitment direct effect.

Material ScopeRed

No statutory material scope exists to research; absent_field_provenance recorded on the governing claim.

Territorial ScopeRed

No territorial-scope provision (no Art 3(2)-style targeting/monitoring limb) exists in Comorian law.

Regulator Registration And FilingRed

No registration, notification, or fee regime exists absent a DPA or statute.

Category narrative108 words

No data protection authority and no comprehensive data-protection statute exist for the Union of the Comoros, of which Mohéli (Mwali) is one of three constituent islands under a unitary national legal order; Mohéli has no separate island-level DP regime. The IAPP's Global Privacy Law and DPA Directory expressly states it is unaware of either a DPA or comprehensive DP legislation for Comoros. The country is a signatory to the OACPS-EU Samoa Partnership Agreement, whose Article 15 commits parties to maintain data-protection regimes and establish independent supervisory authorities, but this is a forward-looking treaty commitment, not a self-executing domestic instrument conferring rights on data subjects or obligations on controllers.

Sources and claims (2)
  1. UncertainIAPP — No data protection authority has been established in the Union of the Comoros (which includes Mohéli/Mwali as a constituent island) as of the research date; the IAPP directory records no DPA or comprehensive data protection legislation for Comoros.observed
  2. UncertainEUR-Lex / Official Journal — The Union of the Comoros is a named signatory party to the OACPS-EU Samoa Partnership Agreement, Article 15 of which commits parties to maintain data-protection regimes and establish independent supervisory authorities, but no domestic implementing statute has been identified giving this commitment direct effect.observed

#

No instrument exists to extract rule-level findings from.

Traffic-light rationale — RedNo instrument exists to extract rule-level findings from.

Sub-modules (4)

Lawful BasesRed

No enumerated lawful bases exist in domestic law.

Claims (1):

  • Comoros has no enacted lawful-basis, consent, special-category, or pseudonymisation framework analogous to GDPR Arts 6, 7, 9; this is a confirmed regulatory gap rather than an unresearched area.

Special CategoriesRed

No special/sensitive category regime exists.

Pseudonymisation And AnonymisationRed

No statutory identifiability test exists.

Category narrative32 words

No statutory lawful-basis framework, consent standard, special-category regime, or pseudonymisation/anonymisation safe-harbour exists in Comorian law; this module is entirely a confirmed gap, consistent with the absence of any comprehensive DP statute (regulator_and_framework.regulator_and_authority).

Sources and claims (1)
  1. UncertainIAPP — Comoros has no enacted lawful-basis, consent, special-category, or pseudonymisation framework analogous to GDPR Arts 6, 7, 9; this is a confirmed regulatory gap rather than an unresearched area.observed

#

Confirmed absence of any DSR statute.

Traffic-light rationale — RedConfirmed absence of any DSR statute.

Sub-modules (5)

Access RightRed

No statutory access right exists.

Claims (1):

  • No codified data-subject-rights regime (access, rectification, erasure, restriction, objection, portability, or statutory response deadlines) exists in Comorian law as of the research date.

Rectification And ErasureRed

No statutory erasure/rectification right exists.

Restriction And ObjectionRed

No statutory restriction/objection right exists.

Data PortabilityRed

No statutory portability right exists.

Deadlines And Response WindowsRed

No statutory response-deadline regime exists.

Category narrative12 words

No statutory subject-access, rectification/erasure, restriction/objection, portability, or response-deadline framework exists for Comoros/Mohéli.

Sources and claims (1)
  1. UncertainIAPP — No codified data-subject-rights regime (access, rectification, erasure, restriction, objection, portability, or statutory response deadlines) exists in Comorian law as of the research date.observed

#

Confirmed absence; no instrument found despite targeted search for Comorian cyber/data instruments.

Traffic-light rationale — RedConfirmed absence; no instrument found despite targeted search for Comorian cyber/data instruments.

Sub-modules (7)

Accountability And DpiaRed

No DPIA trigger list exists.

Claims (1):

  • No accountability, DPIA, DPO, ROPA, security-of-processing, DP-specific breach-notification, or retention/disposal duties are codified in Comorian law.

Dpo RequirementsRed

No DPO appointment threshold exists.

Ropa RequirementsRed

No ROPA duty exists.

Joint Controller ArrangementsRed

No processor-contract mandatory-terms rule exists.

Security MeasuresRed

No security-of-processing standard is codified.

Breach NotificationRed

No breach-notification threshold, deadline, or content requirement is codified (DP-specific; ICT-incident regimes are out of scope here).

Retention And DisposalRed

No statutory retention-limit or disposal duty exists.

Category narrative21 words

No accountability/DPIA, DPO, ROPA, joint-controller, security, breach-notification, or retention/disposal regime is codified for controllers or processors operating in or from Comoros/Mohéli.

Sources and claims (1)
  1. UncertainIAPP — No accountability, DPIA, DPO, ROPA, security-of-processing, DP-specific breach-notification, or retention/disposal duties are codified in Comorian law.observed

#

No adequacy decision received or granted; no SCC/BCR uptake; treaty commitment only.

Traffic-light rationale — RedNo adequacy decision received or granted; no SCC/BCR uptake; treaty commitment only.

Sub-modules (6)

Transfer MechanismsRed

No domestic transfer-mechanism statute exists.

Claims (1):

  • The Union of the Comoros, as a signatory party to the OACPS-EU Samoa Partnership Agreement, is committed under Article 15 to cooperate on data-protection policy and facilitate data flows, but no domestic statute establishes a transfer mechanism, adequacy process, SCC/BCR regime, TIA requirement, or localisation rule.

Adequacy ReceivedRed

No adequacy decision has been received by Comoros from the EU or any other regime.

Adequacy GrantedRed

Comoros has not granted any adequacy determination (it has no DP statute under which to do so).

Sccs And BcrsRed

No SCC or BCR framework exists domestically.

Transfer Impact AssessmentRed

No TIA requirement exists.

Data LocalisationRed

No data-localisation mandate identified.

Category narrative57 words

No domestic transfer-mechanism regime (adequacy, SCCs, BCRs, TIA, or localisation mandate) exists in Comorian law. The only cross-border data commitment identified is the treaty-level Article 15 of the OACPS-EU Samoa Partnership Agreement, to which Comoros is a signatory party, committing parties generally to 'maintaining strong data protection regimes' without creating a domestic transfer mechanism or adequacy decision.

Sources and claims (1)
  1. UncertainEUR-Lex / Official Journal — The Union of the Comoros, as a signatory party to the OACPS-EU Samoa Partnership Agreement, is committed under Article 15 to cooperate on data-protection policy and facilitate data flows, but no domestic statute establishes a transfer mechanism, adequacy process, SCC/BCR regime, TIA requirement, or localisation rule.observed

#

No sectoral DP overlay identified; telecom-regulator existence unconfirmed (gap, not negative finding).

Traffic-light rationale — RedNo sectoral DP overlay identified; telecom-regulator existence unconfirmed (gap, not negative finding).

Sub-modules (8)

Financial Sector OverlayRed

No banking-secrecy or open-banking data-access overlay identified.

Health Sector OverlayRed

No health-sector DP overlay identified.

Telecoms And EprivacyRed

No ePrivacy transposition or communications-data retention/access statute identified; existence/identity of a Comorian telecoms regulator could not be confirmed on allowlisted sources.

Claims (1):

  • No sectoral data-protection overlay (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance, or data-access/sharing) was located for Comoros; the identity and statutory basis of any national telecommunications regulator could not be confirmed on allowlisted sources.

Employment DataRed

No employee-data-specific provision identified.

Credit And ScoringRed

No credit-scoring data rule identified.

EducationRed

No education-sector DP rule identified.

InsuranceRed

No insurance-sector DP rule identified.

Data Access SharingRed

No local data-access/smart-data/portability scheme identified; EU Data Act (Reg (EU) 2023/2854) does not apply extraterritorially to Comoros absent EU-market-facing activity, and no equivalent domestic scheme exists.

Category narrative50 words

No sector-specific data-protection overlays (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance, or horizontal data-access/sharing schemes) were identified for Comoros on allowlisted sources. A national telecommunications regulator could not be confirmed via the available retrieval allowlist; this is recorded as a sourcing gap rather than an affirmative finding of no regulator.

Sources and claims (1)
  1. UncertainIAPP — No sectoral data-protection overlay (financial, health, telecoms/ePrivacy, employment, credit-scoring, education, insurance, or data-access/sharing) was located for Comoros; the identity and statutory basis of any national telecommunications regulator could not be confirmed on allowlisted sources.observed

#

Confirmed absence; no ePrivacy-equivalent or consumer-protection adtech provision identified.

Traffic-light rationale — RedConfirmed absence; no ePrivacy-equivalent or consumer-protection adtech provision identified.

Sub-modules (6)

Cookies And TrackersRed

No cookie-consent provision exists.

Claims (1):

  • No cookie/tracker consent provision, dark-pattern prohibition, opt-out-signal rule, clean-room regime, or direct-marketing consent/suppression rule is codified in Comorian law.

Dark PatternsRed

No dark-pattern prohibition identified.

Opt Out SignalsRed

No opt-out-signal recognition rule identified.

Clean Rooms And DcrRed

No clean-room/DCR rule identified.

Cross Context AdvertisingRed

No cross-context-advertising rule identified.

Direct MarketingRed

No direct-marketing consent or suppression rule identified.

Category narrative18 words

No cookie/tracker consent statute, dark-pattern prohibition, opt-out-signal recognition, clean-room rule, or direct-marketing consent regime exists in Comorian law.

Sources and claims (1)
  1. UncertainIAPP — No cookie/tracker consent provision, dark-pattern prohibition, opt-out-signal rule, clean-room regime, or direct-marketing consent/suppression rule is codified in Comorian law.observed

#

Confirmed absence of any algorithmic/biometric/AI governance statute.

Traffic-light rationale — RedConfirmed absence of any algorithmic/biometric/AI governance statute.

Sub-modules (6)

Profiling RestrictionsRed

No profiling-restriction rule exists.

Claims (1):

  • No profiling restriction, ADM transparency right, AI-specific risk-assessment duty, biometric-processing condition, or genetic-data regime is codified in Comorian law; no national AI authority has been designated.

Automated Decision Making TransparencyRed

No ADM transparency/explanation right exists.

Ai Risk AssessmentsRed

No AI-specific risk-assessment duty exists; EU AI Act has no territorial application to Comoros.

Biometric RegimeRed

No biometric-processing condition exists.

Genetic DataRed

No genetic-data regime exists.

State Surveillance CarveoutsRed

No codified national-security carve-out or its limits could be identified.

Category narrative19 words

No automated-decision-making transparency rule, AI-specific risk-assessment regime, biometric-processing condition, genetic-data regime, or state-surveillance carve-out is codified in Comorian law.

Sources and claims (1)
  1. UncertainIAPP — No profiling restriction, ADM transparency right, AI-specific risk-assessment duty, biometric-processing condition, or genetic-data regime is codified in Comorian law; no national AI authority has been designated.observed

#

Confirmed absence of any children/vulnerable-groups DP provision.

Traffic-light rationale — RedConfirmed absence of any children/vulnerable-groups DP provision.

Sub-modules (5)

Age VerificationRed

No age-verification or age-of-consent provision exists.

Claims (1):

  • No age-of-digital-consent rule, parental-consent mechanism, minor-profiling-for-advertising prohibition, education-setting DP rule, or dependent-adults protection is codified in Comorian law.

Minor Profiling BansRed

No minor-profiling prohibition exists.

Education SettingsRed

No education-setting-specific DP rule exists.

Dependent AdultsRed

No dependent-adults DP protection identified.

Category narrative17 words

No statutory age-of-digital-consent, parental-consent mechanism, minor-profiling ban, education-setting DP rule, or dependent-adults protection exists in Comorian law.

Sources and claims (1)
  1. UncertainIAPP — No age-of-digital-consent rule, parental-consent mechanism, minor-profiling-for-advertising prohibition, education-setting DP rule, or dependent-adults protection is codified in Comorian law.observed

#

No DPA, no DP-specific penalty regime, no enforcement record — confirmed gap.

Traffic-light rationale — RedNo DPA, no DP-specific penalty regime, no enforcement record — confirmed gap.

Sub-modules (6)

Regulator Powers And PenaltiesRed

No DPA powers or DP-specific fine tiers exist.

Claims (1):

  • No DP-specific regulator powers, penalty tiers, procedural deadlines, appeal routes, collective-redress mechanism, private right of action, or enforcement record exist for Comoros, consistent with the absence of a DPA or DP statute.

Enforcement Activity IndexRed

No enforcement activity possible absent a regulator.

Regulator Funding And CapacityRed

Not applicable — no regulator exists.

Collective Redress And Class ActionsRed

No DP-specific collective-redress mechanism identified.

Private Right Of ActionRed

No DP-specific private right of action identified; general tort/constitutional remedies unconfirmed on allowlisted sources.

Recent Developments 180DRed

No legislative, judicial, or guidance developments in the last 180 days were identified for Comoros DP.

Category narrative53 words

No data-protection regulator exists in Comoros, so no DP-specific investigative powers, maximum fines, enforcement record, collective-redress mechanism, or private right of action could be identified. General civil/constitutional redress routes (ordinary courts) may theoretically be available for privacy torts but no DP-specific statutory basis, penalty schedule, or enforcement activity was found on allowlisted sources.

Sources and claims (1)
  1. UncertainIAPP — No DP-specific regulator powers, penalty tiers, procedural deadlines, appeal routes, collective-redress mechanism, private right of action, or enforcement record exist for Comoros, consistent with the absence of a DPA or DP statute.observed
No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

Blocking. 2 failing check(s).

schema_validpass
min_quoted_text_presentwaived — floor 0%
translation_provenance_recordedn/a — no subject in this jurisdiction
egress_verifiedpass
min_t1_per_instrument_metn/a — no subject in this jurisdiction
jurisdiction_source_floor_metFAIL
source_tier_integrity_okpass
manual_overrideFAIL
tier_a_b_national_primary_pct20.0
aggregator_only_jurisdiction_count0

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for KM-M
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewerno reviewer on record
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 11 claim(s) (11 category placement(s)), 5 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 6 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer mechanisms
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redressprivate right of action
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties

Self-audit

All 10 modules researched to T3/T4 commentary depth (IAPP Global Privacy Directory; OneTrust DataGuidance African Bodies and Malabo Convention jurisdictional list) plus one T1 primary-instrument anchor (OJ L 202302862, the OACPS-EU Samoa Partnership Agreement, Article 15). No T1 domestic Comorian statute, regulation, or regulator URL was located for any module because none appears to exist; this was independently corroborated across five distinct searches (national DP law, Malabo Convention ratification status, telecoms regulator, cybercrime/constitutional privacy provisions, and the EU treaty-partner list naming the Union of the Comoros as a Samoa Agreement signatory). No JID-specific (Mohéli/Mwali-level) legal distinction from the national Comorian position was found or expected, as Comoros is a unitary state for data-protection purposes.

Unresolved questions (4):

  • Has the Union of the Comoros signed or ratified the AU Malabo Convention on Cyber Security and Personal Data Protection? No ratification/signature record was found in the reviewed ratification lists (which include many other African states but not Comoros).
  • Has Comoros ratified or provisionally applied the OACPS-EU Samoa Partnership Agreement, and if so what is Comoros's specific entry-into-force date for Article 15 purposes?
  • Does a Comorian telecommunications/ICT regulator (e.g., an ANRTIC-equivalent) exist with a statutory basis reachable on the retrieval allowlist? Not confirmed.
  • Does Comorian constitutional or civil law recognise a general tort-based or constitutional privacy right enforceable in ordinary courts absent a DP statute? Not confirmed on allowlisted sources.

Escalate to primary-source review: yes