--- title: "KM-M Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/km-m-data-protection-privacy-regulation/ source_html: /jurisdictions/comoros-moheli-mwali/index.html description: "KM-M data protection and privacy regulation: 10 categories, 14 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: b9ab203eed944c7ebd7fff830ecd3de0626fb46b042e1d73af0bfee6f7e71b37 generator: "fe-fleet/md-twin@1.0" --- # KM-M Data Protection & Privacy Regulation | Data Protection Monitor Based mainly on secondary sources. Only 1 of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved. # KM-M Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap Last updated 2026-11-04 · 10 categories · 14 claims · 14 sources in the cumulative register Download report (PDF) Expand all The clearest development on the data-protection file for Mohéli, administered within the Union of the Comoros' national legal framework, concerns funding rather than law. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=COMOROS-MOHELI-MWALI)[Build Report](/reports/?j=COMOROS-MOHELI-MWALI)[Compare](/compare/?j=COMOROS-MOHELI-MWALI) Framework posture Unregulated gap 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority IAPP Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 8 Probable · 2 Uncertain 10 Categories 10 Red categories 58 Sub-modules 14 Claims 1 Tier-1 sources Traffic-light mix 10 red (sums to 10 rendered categories; click to filter) 10 categories flagged red ## Jurisdiction lead brief Standing brief, as of 4 November 2026. #### Lead Signal The clearest development on the data-protection file for Mohéli, administered within the Union of the Comoros' national legal framework, concerns funding rather than law. The African Development Bank has approved EUR 9.51 million for a project to support digitisation of the Comorian economy, and that project is understood to include the establishment and operationalisation of a National Authority for the Protection of Personal Data and Access to Information. No general supervisory authority for personal data has existed in an operational form to date, and this funding commitment is the most concrete signal available that this may change. #### Other Developments Consistent with the absence of a constituted authority, no data-protection enforcement decisions have been recorded for the Union of the Comoros as of the most recent verification point in late September 2026. #### Cross-Monitor Connections The AfDB-funded digitisation programme touches institutional capacity-building that may be of interest to those tracking financial-integrity developments in the region, given the programme's broader digital-economy scope, though the detail of that financing sits outside this review. #### Outlook Whether the AfDB-funded project translates into an operational National Authority for the Protection of Personal Data and Access to Information remains to be seen; its current implementation status has not been independently confirmed. Until such an authority is constituted, enforcement capacity in the Comorian data-protection space is expected to remain effectively dormant regardless of what the underlying statute says on paper. Read full brief · 240 words Key regulatory facts for KM-M Regulatory Dimension KM-M Standing Position Jurisdiction KM-M (KM-M) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 14 sourced findings) Regulator & Framework No supervisory authority, no enabling statute, no registration/filing regime identified after targeted research; confirmed gap rather than a sourcing failure. Lawful Processing & Special Data No instrument exists to extract rule-level findings from. Data Subject Rights Confirmed absence of any DSR statute. Controller/Processor Duties Confirmed absence; no instrument found despite targeted search for Comorian cyber/data instruments. Primary Instruments Cited IAPP, EUR-Lex / Official Journal, LawLab Africa - Data Protection in Comoros, e-Governance Academy NCSI - Comoros Last Confirmed / Updated 2026-11-04 (14 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### KM-M: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No supervisory authority, no enabling statute, no registration/filing regime identified after targeted research; confirmed gap rather than a sourcing failure. Traffic-light rationale — Red No supervisory authority, no enabling statute, no registration/filing regime identified after targeted research; confirmed gap rather than a sourcing failure. #### Sub-modules (5) #### Regulator And AuthorityRed No DPA has been established in Comoros/Mohéli. Claims (2): - No data protection authority has been established in the Union of the Comoros (which includes Mohéli/Mwali as a constituent island) as of the research date; the IAPP directory records no DPA or comprehensive data protection legislation for Comoros. - No general personal-data protection authority is operational in the Union of the Comoros. #### Act And InstrumentsRed No national data-protection act exists; the only identified instrument touching personal data is the treaty-level Samoa Agreement commitment. Claims (2): - The Union of the Comoros is a named signatory party to the OACPS-EU Samoa Partnership Agreement, Article 15 of which commits parties to maintain data-protection regimes and establish independent supervisory authorities, but no domestic implementing statute has been identified giving this commitment direct effect. - Comorian sources materially conflict on whether a comprehensive personal-data protection statute is in force. #### Material ScopeRed No statutory material scope exists to research; absent_field_provenance recorded on the governing claim. #### Territorial ScopeRed No territorial-scope provision (no Art 3(2)-style targeting/monitoring limb) exists in Comorian law. #### Regulator Registration And FilingRed No registration, notification, or fee regime exists absent a DPA or statute. No data protection authority and no comprehensive data-protection statute exist for the Union of the Comoros, of which Mohéli (Mwali) is one of three constituent islands under a unitary national legal order; Mohéli has no separate island-level DP regime. The IAPP's Global Privacy Law and DPA Directory expressly states it is unaware of either a DPA or comprehensive DP legislation for Comoros. The country is a signatory to the OACPS-EU Samoa Partnership Agreement, whose Article 15 commits parties to maintain data-protection regimes and establish independent supervisory authorities, but this is a forward-looking treaty commitment, not a self-executing domestic instrument conferring rights on data subjects or obligations on controllers. Sources and claims (4) - [IAPP](https://westin.iapp.org/resources/global-privacy-directory/) — No data protection authority has been established in the Union of the Comoros (which includes Mohéli/Mwali as a constituent island) as of the research date; the IAPP directory records no DPA or comprehensive data protection legislation for Comoros. - [EUR-Lex / Official Journal](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ%3AL_202302862) — The Union of the Comoros is a named signatory party to the OACPS-EU Samoa Partnership Agreement, Article 15 of which commits parties to maintain data-protection regimes and establish independent supervisory authorities, but no domestic implementing statute has been identified giving this commitment direct effect. - [LawLab Africa - Data Protection in Comoros](https://research.lawlab.africa/comoros/) — Comorian sources materially conflict on whether a comprehensive personal-data protection statute is in force. - [e-Governance Academy NCSI - Comoros](https://ncsi.ega.ee/country/km/?allData=1) — No general personal-data protection authority is operational in the Union of the Comoros. ### KM-M: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No instrument exists to extract rule-level findings from. Traffic-light rationale — Red No instrument exists to extract rule-level findings from. D2 · Lawful Processing — Full Module Record 4 sub-modules · 32 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-M: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ Confirmed absence of any DSR statute. Traffic-light rationale — Red Confirmed absence of any DSR statute. #### Sub-modules (5) #### Access RightRed No statutory access right exists. Claims (1): - No codified data-subject-rights regime (access, rectification, erasure, restriction, objection, portability, or statutory response deadlines) exists in Comorian law as of the research date. #### Rectification And ErasureRed No statutory erasure/rectification right exists. #### Restriction And ObjectionRed No statutory restriction/objection right exists. #### Data PortabilityRed No statutory portability right exists. #### Deadlines And Response WindowsRed No statutory response-deadline regime exists. No statutory subject-access, rectification/erasure, restriction/objection, portability, or response-deadline framework exists for Comoros/Mohéli. Sources and claims (1) - [IAPP](https://westin.iapp.org/resources/global-privacy-directory/) — No codified data-subject-rights regime (access, rectification, erasure, restriction, objection, portability, or statutory response deadlines) exists in Comorian law as of the research date. ### KM-M: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Confirmed absence; no instrument found despite targeted search for Comorian cyber/data instruments. Traffic-light rationale — Red Confirmed absence; no instrument found despite targeted search for Comorian cyber/data instruments. D4 · Controller & Processor — Full Module Record 7 sub-modules · 21 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-M: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No adequacy decision received or granted; no SCC/BCR uptake; treaty commitment only. Traffic-light rationale — Red No adequacy decision received or granted; no SCC/BCR uptake; treaty commitment only. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 57 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-M: D6 Sectoral Watch8 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sectoral DP overlay identified; telecom-regulator existence unconfirmed (gap, not negative finding). Traffic-light rationale — Red No sectoral DP overlay identified; telecom-regulator existence unconfirmed (gap, not negative finding). D6 · Sectoral Watch — Full Module Record 8 sub-modules · 50 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-M: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Confirmed absence; no ePrivacy-equivalent or consumer-protection adtech provision identified. Traffic-light rationale — Red Confirmed absence; no ePrivacy-equivalent or consumer-protection adtech provision identified. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 18 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-M: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Confirmed absence of any algorithmic/biometric/AI governance statute. Traffic-light rationale — Red Confirmed absence of any algorithmic/biometric/AI governance statute. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 19 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-M: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Confirmed absence of any children/vulnerable-groups DP provision. Traffic-light rationale — Red Confirmed absence of any children/vulnerable-groups DP provision. D9 · Children's Privacy — Full Module Record 5 sub-modules · 17 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM-M: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No DPA, no DP-specific penalty regime, no enforcement record — confirmed gap. Traffic-light rationale — Red No DPA, no DP-specific penalty regime, no enforcement record — confirmed gap. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 53 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties