--- title: "KM Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/km-data-protection-privacy-regulation/ source_html: /jurisdictions/comoros/index.html description: "KM data protection and privacy regulation: 10 categories, 14 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 1260e3e4997ce30dcbf54788d5bafdf99ad161b8c0584efc06aa865af1382bde generator: "fe-fleet/md-twin@1.0" --- # KM Data Protection & Privacy Regulation | Data Protection Monitor Based mainly on secondary sources. Only 1 of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved. # KM Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap Last updated 2026-10-25 · 10 categories · 14 claims · 11 sources in the cumulative register Download report (PDF) Expand all Summary answer not yet published for this jurisdiction Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress. Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=COMOROS)[Build Report](/reports/?j=COMOROS)[Compare](/compare/?j=COMOROS) Framework posture Unregulated gap 6 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Statutory Supervisory Authority Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 6 / 10 modules assessed 0 Confirmed · 4 Probable · 2 Uncertain · 4 Not yet assessed 10 Categories 6 Red categories 58 Sub-modules 14 Claims 0 Tier-1 sources Traffic-light mix 6 red 4 n/a (sums to 10 rendered categories; click to filter) 6 categories flagged red ## Jurisdiction brief Standing operating brief 89 words KM operates under a unregulated gap supervised by Statutory Supervisory Authority , with 6 regulatory modules assessed in the current cycle. - D1 · Regulator & Framework: No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID. - D3 · Data Subject Rights: No rights framework identified in the absence of a national data protection statute. - D4 · Controller & Processor: No controller/processor obligations regime identified. - D5 · Cross-Border & Adequacy: No cross-border transfer mechanism or adequacy framework identified for this JID. All 6 module posture summaries - D1 · Regulator & Framework: No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID. - D3 · Data Subject Rights: No rights framework identified in the absence of a national data protection statute. - D4 · Controller & Processor: No controller/processor obligations regime identified. - D5 · Cross-Border & Adequacy: No cross-border transfer mechanism or adequacy framework identified for this JID. - D8 · AI, Biometrics & Automated: No algorithmic/biometric/surveillance governance regime identified. - D10 · Enforcement & Redress: No enforcement or redress regime identified; no DPA exists to exercise powers or generate an enforcement record. Key regulatory facts for KM Regulatory Dimension KM Standing Position Jurisdiction KM (KM) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 14 sourced findings) Regulator & Framework No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID. Lawful Processing & Special Data No lawful-basis, consent, or special-category regime identified; absence consistent with unregulated_gap status. Data Subject Rights No rights framework identified in the absence of a national data protection statute. Controller/Processor Duties No controller/processor obligations regime identified. Primary Instruments Cited KM Official Instrument (research.lawlab.africa comoros), ConsentStack, anuragverma.co Last Confirmed / Updated 2026-10-25 (11 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### KM: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID. Traffic-light rationale — Red No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID. #### Sub-modules (5) #### Regulator And AuthorityRed No national data protection authority identified for the Union of the Comoros in any surveyed source. Claims (2): - A Comorian Personal Data Protection Law exists on the books but its supervisory authority has not been constituted/is not operational, so the law remains effectively unenforced. - National Authority for the Protection of Personal Data — Provided for by Law No. 14-029/AU but not constituted/operational #### Act And InstrumentsRed No comprehensive data protection act or instrument located; absent_field_provenance records the searches run. Claims (1): - Law No. 14-029/AU on the Protection of Personal Data — Adopted 26 June 2014; reported 29 June 2021 promulgation flagged as unverified by one specialist tracker, with no decree located #### Material ScopeRed Not applicable in the absence of an identified instrument. Claims (1): - Law No. 14-029/AU on the Protection of Personal Data — Covers automated/non-automated processing by controllers/processors established in Comoros plus extraterritorial reach over foreign entities processing data of individuals in Comoros in connection with offering goods/services or monitoring behaviour; exemptions for personal/domestic and conditional journalistic/artistic/literary processing #### Territorial ScopeRed Territorial/material scope cannot be assessed absent a national instrument; the only regional instrument potentially touching Comoros (Malabo Convention) has unconfirmed ratification status for this JID. Claims (1): - One secondary tracker describes the law as having broad territorial scope covering foreign entities processing the data of Comorian residents, but this is not confirmed against a primary text. #### Regulator Registration And FilingRed No registration, notification or fee regime identified. Extensive searching across cross-jurisdictional legal trackers (OneTrust DataGuidance jurisdiction/African Bodies pages, IAPP Global Privacy Law and DPA Directory commentary, UNCTAD-referenced cyberlaw sources), French-language searches for a Comorian 'loi sur la protection des données personnelles' or 'informatique et libertés' instrument, and searches for an ITU/telecoms-sector privacy regulator, returned no comprehensive national data-protection statute and no named Comorian data-protection authority. The Union of the Comoros is an African Union member state and is in the orbit of the AU Malabo Convention on Cyber Security and Personal Data Protection, but no ratification or signature record for Comoros specifically was located in the sources surveyed. Sources and claims (5) - [https://research.lawlab.africa/comoros/](https://research.lawlab.africa/comoros/) — National Authority for the Protection of Personal Data — Provided for by Law No. 14-029/AU but not constituted/operational - [https://research.lawlab.africa/comoros/](https://research.lawlab.africa/comoros/) — Law No. 14-029/AU on the Protection of Personal Data — Adopted 26 June 2014; reported 29 June 2021 promulgation flagged as unverified by one specialist tracker, with no decree located - [https://research.lawlab.africa/comoros/](https://research.lawlab.africa/comoros/) — Law No. 14-029/AU on the Protection of Personal Data — Covers automated/non-automated processing by controllers/processors established in Comoros plus extraterritorial reach over foreign entities processing data of individuals in Comoros in connection with offering goods/services or monitoring behaviour; exemptions for personal/domestic and conditional journalistic/artistic/literary processing - Primary statutory record — A Comorian Personal Data Protection Law exists on the books but its supervisory authority has not been constituted/is not operational, so the law remains effectively unenforced. - Primary statutory record — One secondary tracker describes the law as having broad territorial scope covering foreign entities processing the data of Comorian residents, but this is not confirmed against a primary text. ### KM: D2 Lawful Processing & Special Data 4 sub-modules Not assessed ▾ No lawful-basis, consent, or special-category regime identified; absence consistent with unregulated_gap status. Traffic-light rationale — Not assessed No lawful-basis, consent, or special-category regime identified; absence consistent with unregulated_gap status. #### Sub-modules (4) #### Lawful BasesRed No lawful-basis enumeration (consent, contract, legitimate interest, etc.) identified for this JID. Claims (1): - No statutory subject-access, rectification, erasure, restriction, objection or portability rights regime could be confirmed as operative for Comoros in the absence of an enforced national data-protection law. #### Consent ThresholdsRed No statutory consent-validity standard identified. #### Special CategoriesRed No special/sensitive-category data regime identified. #### Pseudonymisation And AnonymisationRed No pseudonymisation/anonymisation safe-harbour or identifiability test identified. No enumerated lawful-basis framework, consent-validity standard, or special-category/sensitive-data regime was located for the Union of the Comoros. This is the heaviest-weighted gap module and the absence is recorded rather than an obligation being inferred or fabricated. ### KM: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No rights framework identified in the absence of a national data protection statute. Traffic-light rationale — Red No rights framework identified in the absence of a national data protection statute. #### Sub-modules (5) #### Access RightRed Not identified. Claims (1): - No statutory subject-access, rectification, erasure, restriction, objection or portability rights regime could be confirmed as operative for Comoros in the absence of an enforced national data-protection law. #### Rectification And ErasureRed Not identified. #### Restriction And ObjectionRed Not identified. #### Data PortabilityRed Not identified. #### Deadlines And Response WindowsRed Not identified. No subject-access, rectification, erasure, restriction, objection or portability framework was located for the Union of the Comoros in any searched source; no statutory response-deadline regime was identified. Sources and claims (1) - Primary statutory record — No statutory subject-access, rectification, erasure, restriction, objection or portability rights regime could be confirmed as operative for Comoros in the absence of an enforced national data-protection law. ### KM: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No controller/processor obligations regime identified. Traffic-light rationale — Red No controller/processor obligations regime identified. D4 · Controller & Processor — Full Module Record 7 sub-modules · 33 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM: D5 Cross-Border & Adequacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No cross-border transfer mechanism or adequacy framework identified for this JID. Traffic-light rationale — Red No cross-border transfer mechanism or adequacy framework identified for this JID. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 57 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM: D6 Sectoral Watch 8 sub-modules Not assessed ▾ No sectoral data-protection overlay identified for any sub-module. Traffic-light rationale — Not assessed No sectoral data-protection overlay identified for any sub-module. #### Sub-modules (8) #### Financial Sector OverlayRed Not identified. #### Health Sector OverlayRed Not identified. #### Telecoms And EprivacyRed Not identified. #### Employment DataRed Not identified. #### Credit And ScoringRed Not identified. #### EducationRed Not identified. #### InsuranceRed Not identified. #### Data Access SharingRed No EU Data Act implementing/enforcement law or local smart-data/data-portability scheme identified for this JID (and none would be expected absent EU-market-facing legislative uptake). No sector-specific data-access/sharing, financial-sector, health-sector, telecoms/ePrivacy, employment, credit-scoring, education or insurance overlay touching personal data was located for the Union of the Comoros in the sources searched, including banking-secrecy rules potentially administered by the Banque Centrale des Comores, for which no DP-specific overlay text was found. ### KM: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No adtech/commercial-privacy regime identified. Traffic-light rationale — Not assessed No adtech/commercial-privacy regime identified. #### Sub-modules (6) #### Cookies And TrackersRed Not identified. #### Dark PatternsRed Not identified. #### Opt Out SignalsRed Not identified. #### Clean Rooms And DcrRed Not identified. #### Cross Context AdvertisingRed Not identified. #### Direct MarketingRed Not identified. No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rule, or direct-marketing consent regime was located for the Union of the Comoros. ### KM: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No algorithmic/biometric/surveillance governance regime identified. Traffic-light rationale — Red No algorithmic/biometric/surveillance governance regime identified. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 20 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### KM: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No children/vulnerable-groups data-protection regime identified. Traffic-light rationale — Not assessed No children/vulnerable-groups data-protection regime identified. #### Sub-modules (5) #### Age VerificationRed Not identified. #### Parental ConsentRed Not identified. #### Minor Profiling BansRed Not identified. #### Education SettingsRed Not identified. #### Dependent AdultsRed Not identified. No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-sector rule, or dependent-adult protection was located for the Union of the Comoros. ### KM: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No enforcement or redress regime identified; no DPA exists to exercise powers or generate an enforcement record. Traffic-light rationale — Red No enforcement or redress regime identified; no DPA exists to exercise powers or generate an enforcement record. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 30 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties