🔒 Data Protection Regulatory Intelligence
Data Protection Monitor · dataprotection.gi
KM v13-gdpri-1.0.0
content: ai_generated legal review: never_reviewed (informational) publication gate: 2 failing6 sources retrieved model claude-sonnet-5 · 2026-10-03

Based mainly on secondary sources. Only 1 of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.

KM

KM schema gdpri-v2 trajectory: not yet assessedunregulated gap

Summary answer not yet published for this jurisdiction

Data collected Data published

AI-assembled from cited sources

Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress.

10 categories · 0 claims · 6 sources in the cumulative register

10Categoriesbaseline.[]
58Sub-modulesbaseline..sub_modules{}
0Claimsbaseline..claims[]
0Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix (sums to 10 rendered categories; click to filter)
No red categories; 58 sub-modules are flagged red.

Jurisdiction brief

No content recorded at this JID path.

10 of 10 categories
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID.

Traffic-light rationale — Not assessedNo comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID.

Sub-modules (5)

Regulator And AuthorityRed

No national data protection authority identified for the Union of the Comoros in any surveyed source.

Claims (1):

  • CLM-KM-001 (claim on file)

Act And InstrumentsRed

No comprehensive data protection act or instrument located; absent_field_provenance records the searches run.

Material ScopeRed

Not applicable in the absence of an identified instrument.

Territorial ScopeRed

Territorial/material scope cannot be assessed absent a national instrument; the only regional instrument potentially touching Comoros (Malabo Convention) has unconfirmed ratification status for this JID.

Claims (1):

  • CLM-KM-002 (claim on file)

Regulator Registration And FilingRed

No registration, notification or fee regime identified.

Category narrative101 words

Extensive searching across cross-jurisdictional legal trackers (OneTrust DataGuidance jurisdiction/African Bodies pages, IAPP Global Privacy Law and DPA Directory commentary, UNCTAD-referenced cyberlaw sources), French-language searches for a Comorian 'loi sur la protection des données personnelles' or 'informatique et libertés' instrument, and searches for an ITU/telecoms-sector privacy regulator, returned no comprehensive national data-protection statute and no named Comorian data-protection authority. The Union of the Comoros is an African Union member state and is in the orbit of the AU Malabo Convention on Cyber Security and Personal Data Protection, but no ratification or signature record for Comoros specifically was located in the sources surveyed.

#

No lawful-basis, consent, or special-category regime identified; absence consistent with unregulated_gap status.

Traffic-light rationale — Not assessedNo lawful-basis, consent, or special-category regime identified; absence consistent with unregulated_gap status.

Sub-modules (4)

Lawful BasesRed

No lawful-basis enumeration (consent, contract, legitimate interest, etc.) identified for this JID.

Claims (1):

  • CLM-KM-003 (claim on file)

Special CategoriesRed

No special/sensitive-category data regime identified.

Pseudonymisation And AnonymisationRed

No pseudonymisation/anonymisation safe-harbour or identifiability test identified.

Category narrative36 words

No enumerated lawful-basis framework, consent-validity standard, or special-category/sensitive-data regime was located for the Union of the Comoros. This is the heaviest-weighted gap module and the absence is recorded rather than an obligation being inferred or fabricated.

#

No rights framework identified in the absence of a national data protection statute.

Traffic-light rationale — Not assessedNo rights framework identified in the absence of a national data protection statute.

Sub-modules (5)

Access RightRed

Not identified.

Rectification And ErasureRed

Not identified.

Restriction And ObjectionRed

Not identified.

Data PortabilityRed

Not identified.

Deadlines And Response WindowsRed

Not identified.

Category narrative27 words

No subject-access, rectification, erasure, restriction, objection or portability framework was located for the Union of the Comoros in any searched source; no statutory response-deadline regime was identified.

#

No controller/processor obligations regime identified.

Traffic-light rationale — Not assessedNo controller/processor obligations regime identified.

Sub-modules (7)

Accountability And DpiaRed

Not identified.

Dpo RequirementsRed

Not identified.

Ropa RequirementsRed

Not identified.

Joint Controller ArrangementsRed

Not identified.

Security MeasuresRed

Not identified.

Breach NotificationRed

Not identified. (Note: cyber-incident reporting regimes such as NIS2/DORA analogues are out of scope for this producer in any case.)

Retention And DisposalRed

Not identified.

Category narrative33 words

No DPIA, DPO, ROPA, processor-contract, security-of-processing, breach-notification or retention regime was located for the Union of the Comoros. No evidence of a sector-specific breach-notification duty (e.g., via a telecoms regulator) was found either.

#

No cross-border transfer mechanism or adequacy framework identified for this JID.

Traffic-light rationale — Not assessedNo cross-border transfer mechanism or adequacy framework identified for this JID.

Sub-modules (6)

Transfer MechanismsRed

Not identified.

Adequacy ReceivedRed

No EU/UK adequacy decision for Comoros identified.

Adequacy GrantedRed

Not applicable; no Comorian data protection authority exists to grant adequacy determinations.

Sccs And BcrsRed

Not identified.

Transfer Impact AssessmentRed

Not identified.

Data LocalisationRed

Not identified.

Category narrative57 words

No EU/UK adequacy decision covering the Union of the Comoros, no SCC/BCR uptake data, and no data-localisation mandate were identified for this JID. Comoros participates in an EU trade relationship (Interim Economic Partnership Agreement, Eastern and Southern Africa configuration) but this source does not address personal-data transfer adequacy and was not relied upon for any transfer-mechanism claim.

#

No sectoral data-protection overlay identified for any sub-module.

Traffic-light rationale — Not assessedNo sectoral data-protection overlay identified for any sub-module.

Sub-modules (8)

Financial Sector OverlayRed

Not identified.

Health Sector OverlayRed

Not identified.

Telecoms And EprivacyRed

Not identified.

Employment DataRed

Not identified.

Credit And ScoringRed

Not identified.

EducationRed

Not identified.

InsuranceRed

Not identified.

Data Access SharingRed

No EU Data Act implementing/enforcement law or local smart-data/data-portability scheme identified for this JID (and none would be expected absent EU-market-facing legislative uptake).

Category narrative46 words

No sector-specific data-access/sharing, financial-sector, health-sector, telecoms/ePrivacy, employment, credit-scoring, education or insurance overlay touching personal data was located for the Union of the Comoros in the sources searched, including banking-secrecy rules potentially administered by the Banque Centrale des Comores, for which no DP-specific overlay text was found.

#

No adtech/commercial-privacy regime identified.

Traffic-light rationale — Not assessedNo adtech/commercial-privacy regime identified.

Sub-modules (6)

Cookies And TrackersRed

Not identified.

Dark PatternsRed

Not identified.

Opt Out SignalsRed

Not identified.

Clean Rooms And DcrRed

Not identified.

Cross Context AdvertisingRed

Not identified.

Direct MarketingRed

Not identified.

Category narrative22 words

No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rule, or direct-marketing consent regime was located for the Union of the Comoros.

#

No algorithmic/biometric/surveillance governance regime identified.

Traffic-light rationale — Not assessedNo algorithmic/biometric/surveillance governance regime identified.

Sub-modules (6)

Profiling RestrictionsRed

Not identified.

Automated Decision Making TransparencyRed

Not identified.

Ai Risk AssessmentsRed

Not identified.

Biometric RegimeRed

Not identified.

Genetic DataRed

Not identified.

State Surveillance CarveoutsRed

Not identified.

Category narrative20 words

No profiling restriction, ADM-transparency rule, AI-risk-assessment regime, biometric-data rule, or state-surveillance carve-out was located for the Union of the Comoros.

#

No children/vulnerable-groups data-protection regime identified.

Traffic-light rationale — Not assessedNo children/vulnerable-groups data-protection regime identified.

Sub-modules (5)

Age VerificationRed

Not identified.

Minor Profiling BansRed

Not identified.

Education SettingsRed

Not identified.

Dependent AdultsRed

Not identified.

Category narrative20 words

No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-sector rule, or dependent-adult protection was located for the Union of the Comoros.

#

No enforcement or redress regime identified; no DPA exists to exercise powers or generate an enforcement record.

Traffic-light rationale — Not assessedNo enforcement or redress regime identified; no DPA exists to exercise powers or generate an enforcement record.

Sub-modules (6)

Regulator Powers And PenaltiesRed

No regulator exists to hold powers or impose penalties.

Claims (1):

  • CLM-KM-004 (claim on file)

Enforcement Activity IndexRed

Not applicable; no enforcement record exists.

Regulator Funding And CapacityRed

Not applicable; no regulator exists.

Collective Redress And Class ActionsRed

Not identified.

Private Right Of ActionRed

Not identified.

Recent Developments 180DRed

No legislative, case-law, guidance, or adequacy development in the last 180 days was identified for this JID.

Category narrative30 words

No maximum-fine schedule, investigative-powers regime, enforcement-activity record, collective-redress mechanism, or private-right-of-action was located for the Union of the Comoros, consistent with the absence of any identified data-protection authority or statute.

No categories match.

Filters combine as OR inside a group and AND across groups.

Publication gate

Blocking. 2 failing check(s).

schema_validpass
min_quoted_text_presentwaived — floor 0%
translation_provenance_recordedn/a — no subject in this jurisdiction
egress_verifiedpass
min_t1_per_instrument_metn/a — no subject in this jurisdiction
jurisdiction_source_floor_metFAIL
source_tier_integrity_okpass
manual_overrideFAIL
tier_a_b_national_primary_pct16.67
aggregator_only_jurisdiction_count0

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for KM
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewerno reviewer on record
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 0 claim(s) (0 category placement(s)), 6 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 6 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsdeadlines and response windows
Art. 14Data Subject Rightsdeadlines and response windows
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer impact assessment
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redresscollective redress and class actions
Art. 82Enforcement & Redressprivate right of action
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties

Self-audit

All 10 modules were researched for the Union of the Comoros using cross-jurisdictional legal trackers (OneTrust DataGuidance, IAPP Global Privacy Law and DPA Directory commentary), French- and English-language targeted searches for a national statute, Malabo Convention ratification-status searches, and sectoral (telecoms/ICT regulator, banking) searches. No Tier-1 primary instrument (national gazette, official DPA URL, or ratified regional convention text binding Comoros specifically) was located for any module. Findings rely on Tier-2 (EUR-Lex official EU document, for jurisdictional/trade-relationship context only) and Tier-3 (OneTrust DataGuidance, IAPP commentary) sources to establish the absence of a regime, per GAP DISCIPLINE. Priority modules (regulator_and_framework, lawful_processing_and_special_data, cross_border_and_adequacy, enforcement_and_redress) received the deepest search effort; all returned negative results.

Unresolved questions (4):

  • Has the Union of the Comoros signed or ratified the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention)?
  • Does Comorian telecommunications or cybercrime legislation (e.g., any instrument administered via the Comorian ICT/telecoms regulator) contain data-protection-adjacent provisions not indexed by the trackers searched?
  • Is there a pending or drafted data protection bill before the Assemblée Nationale des Comores or within the Comorian government's digital-economy strategy?
  • Does the Comorian Civil Code or Constitution contain a general right-to-privacy provision that could ground a future data protection framework?

Escalate to primary-source review: yes