#
Absence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan.
Sub-modules (5)
Regulator And AuthorityRed
No national or island-level (Anjouan) data-protection regulator identified.
Claims (3):
- No independent or sectoral data-protection supervisory authority for the Union of the Comoros (including the autonomous island of Anjouan) is listed in current regional data-protection regulator trackers.
- Union of the Comoros — No operational data-protection supervisory authority exists; a designated authority is described as 'not operational'.
- Comoros data-protection supervisory authority — No dedicated KM-A (or KM-national) data protection authority has been confirmed operational as of this cycle.
Act And InstrumentsRed
No comprehensive omnibus statute identified; Comoros not listed among Malabo Convention ratifiers.
Claims (5):
- The Union of the Comoros does not appear in the current global inventory of countries with comprehensive data-protection and privacy laws in effect.
- The Union of the Comoros is not identified among the African Union member states reported to have ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection), so that regional instrument does not currently bind Comoros domestically.
- Comoros (national-level, Loi n°14-029/AU) — A 2023 civil-society legal mapping and a 2025-dated Africa DP factsheet state Comoros has no dedicated data-protection law and that the 2014 draft (Loi n°14-029/AU) does not appear enacted; a 2026 country-profile source states Comoros 'has a personal data protection law'.
- Union of the Comoros — A 2023 civil-society legal review states Comoros does not have a dedicated data protection law, and a 2014 draft bill does not appear to have been enacted.
- Comoros Law on the Protection of Personal Data — A compliance-vendor summary describes a 'Law on the Protection of Personal Data' as enacted 29 June 2021, with GDPR-aligned obligations including 72-hour breach notification, though unenforced for lack of an operational authority.
Material ScopeRed
No statutory material-scope test (personal data definition, processing scope) exists absent an enacted law.
Territorial ScopeRed
No extraterritorial/targeting test, household exemption, or representative-appointment duty exists absent an enacted law.
Regulator Registration And FilingRed
No registration, notification, or fee regime exists absent a designated regulator.
Regulator & Framework
The underlying state of Comoros data-protection law, which bears directly on Anjouan as an island within the Union, is unsettled in a way that is itself the finding rather than a gap to be filled later. A 2023 civil-society legal mapping states plainly that Comoros does not have a dedicated data protection law, and identifies a 2014 draft, Loi n 14-029/AU, that does not appear to have been enacted. A separate, more general country-level source likewise states that Comoros currently has no comprehensive data protection legislation. Against this, a 2026-dated country-profile source states that Comoros has a personal data protection law providing the basis for regulating personal data processing, while noting that public information on an operational supervisory authority remains limited. These two positions are in direct conflict on the most basic question, whether any data-protection statute has ever been enacted at national level, and the conflict cannot be resolved from the material gathered.
What is understood to be consistent across both positions is that no dedicated data-protection supervisory authority has been confirmed operational for Comoros, or for Anjouan specifically. Even the source asserting that a law exists stops short of identifying a functioning regulator exercising powers under it. For Anjouan, this means that whatever the resolution of the statutory question turns out to be, the practical absence of a confirmed operational authority is the more immediately relevant fact: there is, on the evidence gathered, no body known to be receiving complaints, issuing guidance, or exercising enforcement powers over data processing on the island or at the national level that would reach it.
The disputed status of Loi n 14-029/AU sits at the centre of the disagreement. If the 2014 draft was never enacted, as the civil-society and general country sources suggest, then any claim of a Comoros personal data protection law resting on that instrument would be describing a draft rather than an enacted statute. No primary text from the Journal Officiel des Comores has been located to settle which account is accurate. This is presented here as a disputed state of the law, to be read by readers as an open legal question rather than as a research shortfall that a future search is expected to close.
Outlook
The path to resolution runs through a primary legislative text. Should the Journal Officiel des Comores record show Loi n 14-029/AU, or a successor instrument, formally enacted, that would settle the statutory question in one direction; continued absence of such a record across further monitoring would reinforce the no-enactment account. Separately, and regardless of how the statutory question resolves, confirmation of any operational supervisory body with actual complaint-handling or enforcement activity would mark a materially different development from anything found, since no such body has been identified under either account of the law.
Sources and claims (8)
- Probable OneTrust DataGuidance — No independent or sectoral data-protection supervisory authority for the Union of the Comoros (including the autonomous island of Anjouan) is listed in current regional data-protection regulator trackers. observed
- Probable International Association of Privacy Professionals (IAPP) — The Union of the Comoros does not appear in the current global inventory of countries with comprehensive data-protection and privacy laws in effect. observed
- Probable International Association of Privacy Professionals (IAPP) — The Union of the Comoros is not identified among the African Union member states reported to have ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection), so that regional instrument does not currently bind Comoros domestically. observed
- Disputed Internews ARISA Internet Environment Assessment -- Comoros chapter — Comoros (national-level, Loi n°14-029/AU) — A 2023 civil-society legal mapping and a 2025-dated Africa DP factsheet state Comoros has no dedicated data-protection law and that the 2014 draft (Loi n°14-029/AU) does not appear enacted; a 2026 country-profile source states Comoros 'has a personal data protection law'. observed
- Disputed Digital Watch Observatory — Union of the Comoros — No operational data-protection supervisory authority exists; a designated authority is described as 'not operational'. observed
- Uncertain dataprotection.africa — Union of the Comoros — A 2023 civil-society legal review states Comoros does not have a dedicated data protection law, and a 2014 draft bill does not appear to have been enacted. observed
- Uncertain Digital Watch Observatory — Comoros Law on the Protection of Personal Data — A compliance-vendor summary describes a 'Law on the Protection of Personal Data' as enacted 29 June 2021, with GDPR-aligned obligations including 72-hour breach notification, though unenforced for lack of an operational authority. observed
- Uncertain dataprotection.africa — Comoros data-protection supervisory authority — No dedicated KM-A (or KM-national) data protection authority has been confirmed operational as of this cycle. observed