Data Protection Monitor
Global Privacy & Data Protection Intelligence

KM-A Data Protection & Privacy Regulation

KM-A schema gdpri-v2 trajectory: not yet assessed unregulated gap

Last updated · 10 categories · 20 claims · 8 sources in the cumulative register

Sources materially disagree on whether Comoros-Anjouan has ever had a comprehensive data-protection law in force.

Data collected Data published

AI-assembled from cited sources

Not fully checked this cycle: Regulator & Framework (2 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Framework postureUnregulated gap10 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityOneTrust DataGuidancePrimary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence10 / 10 modules assessed0 Confirmed · 9 Probable · 1 Uncertain

Jurisdiction lead brief

Standing brief, as of 25 October 2026.

Lead Signal

Sources materially disagree on whether Comoros-Anjouan has ever had a comprehensive data-protection law in force. A 2023 civil-society legal review states that Comoros does not have a dedicated data protection law, and that a 2014 draft bill does not appear to have been enacted. A compliance-vendor summary, by contrast, describes a Law on the Protection of Personal Data as enacted on 29 June 2021, with GDPR-aligned obligations including a seventy-two-hour breach-notification duty, though it describes that law as unenforced for want of an operational supervisory authority. No primary gazette text has been located to resolve this disagreement either way.

Key regulatory facts for KM-A
Regulatory DimensionKM-A Standing Position
JurisdictionKM-A (KM-A)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 20 sourced findings)
Regulator & FrameworkAbsence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan.
Lawful Processing & Special DataNo lawful-basis or consent framework exists absent an enacted DP statute.
Data Subject RightsNo data-subject-rights framework exists absent an enacted DP statute.
Controller/Processor DutiesNo controller/processor accountability regime exists absent an enacted DP statute.
Primary Instruments CitedOneTrust DataGuidance, International Association of Privacy Professionals (IAPP), International Association of Privacy Professionals (IAPP), Internews ARISA Internet Environment Assessment -- Comoros chapter, Digital Watch Observatory
Last Confirmed / Updated2026-11-04 (8 sources in cumulative register)

#

Absence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan.

Traffic-light rationale — RedAbsence of any identifiable comprehensive DP statute, DPA, or ratified regional DP instrument binding on Comoros/Anjouan.

Sub-modules (5)

Regulator And AuthorityRed

No national or island-level (Anjouan) data-protection regulator identified.

Claims (3):

  • No independent or sectoral data-protection supervisory authority for the Union of the Comoros (including the autonomous island of Anjouan) is listed in current regional data-protection regulator trackers.
  • Union of the Comoros — No operational data-protection supervisory authority exists; a designated authority is described as 'not operational'.
  • Comoros data-protection supervisory authority — No dedicated KM-A (or KM-national) data protection authority has been confirmed operational as of this cycle.

Act And InstrumentsRed

No comprehensive omnibus statute identified; Comoros not listed among Malabo Convention ratifiers.

Claims (5):

  • The Union of the Comoros does not appear in the current global inventory of countries with comprehensive data-protection and privacy laws in effect.
  • The Union of the Comoros is not identified among the African Union member states reported to have ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection), so that regional instrument does not currently bind Comoros domestically.
  • Comoros (national-level, Loi n°14-029/AU) — A 2023 civil-society legal mapping and a 2025-dated Africa DP factsheet state Comoros has no dedicated data-protection law and that the 2014 draft (Loi n°14-029/AU) does not appear enacted; a 2026 country-profile source states Comoros 'has a personal data protection law'.
  • Union of the Comoros — A 2023 civil-society legal review states Comoros does not have a dedicated data protection law, and a 2014 draft bill does not appear to have been enacted.
  • Comoros Law on the Protection of Personal Data — A compliance-vendor summary describes a 'Law on the Protection of Personal Data' as enacted 29 June 2021, with GDPR-aligned obligations including 72-hour breach notification, though unenforced for lack of an operational authority.

Material ScopeRed

No statutory material-scope test (personal data definition, processing scope) exists absent an enacted law.

Territorial ScopeRed

No extraterritorial/targeting test, household exemption, or representative-appointment duty exists absent an enacted law.

Regulator Registration And FilingRed

No registration, notification, or fee regime exists absent a designated regulator.

Category narrative 101 words

No dedicated data-protection supervisory authority or comprehensive data-protection statute could be located for the Union of the Comoros, of which Anjouan (Nzwani) is an autonomous island. Global and regional trackers of data-protection law (IAPP's 144-country directory, OneTrust DataGuidance's African Bodies tracker) do not list Comoros as having an operative DPA or omnibus statute, and Comoros does not appear among the African Union member states reported to have ratified the Malabo Convention. Anjouan's well-known autonomous-island offshore-finance and company-registration functions did not surface any dedicated data-protection instrument in this research pass. This is recorded as a gap finding rather than an invented obligation.

Periodic update · new data 2026-11-04

Regulator & Framework

The underlying state of Comoros data-protection law, which bears directly on Anjouan as an island within the Union, is unsettled in a way that is itself the finding rather than a gap to be filled later. A 2023 civil-society legal mapping states plainly that Comoros does not have a dedicated data protection law, and identifies a 2014 draft, Loi n 14-029/AU, that does not appear to have been enacted. A separate, more general country-level source likewise states that Comoros currently has no comprehensive data protection legislation. Against this, a 2026-dated country-profile source states that Comoros has a personal data protection law providing the basis for regulating personal data processing, while noting that public information on an operational supervisory authority remains limited. These two positions are in direct conflict on the most basic question, whether any data-protection statute has ever been enacted at national level, and the conflict cannot be resolved from the material gathered.

What is understood to be consistent across both positions is that no dedicated data-protection supervisory authority has been confirmed operational for Comoros, or for Anjouan specifically. Even the source asserting that a law exists stops short of identifying a functioning regulator exercising powers under it. For Anjouan, this means that whatever the resolution of the statutory question turns out to be, the practical absence of a confirmed operational authority is the more immediately relevant fact: there is, on the evidence gathered, no body known to be receiving complaints, issuing guidance, or exercising enforcement powers over data processing on the island or at the national level that would reach it.

The disputed status of Loi n 14-029/AU sits at the centre of the disagreement. If the 2014 draft was never enacted, as the civil-society and general country sources suggest, then any claim of a Comoros personal data protection law resting on that instrument would be describing a draft rather than an enacted statute. No primary text from the Journal Officiel des Comores has been located to settle which account is accurate. This is presented here as a disputed state of the law, to be read by readers as an open legal question rather than as a research shortfall that a future search is expected to close.

Outlook

The path to resolution runs through a primary legislative text. Should the Journal Officiel des Comores record show Loi n 14-029/AU, or a successor instrument, formally enacted, that would settle the statutory question in one direction; continued absence of such a record across further monitoring would reinforce the no-enactment account. Separately, and regardless of how the statutory question resolves, confirmation of any operational supervisory body with actual complaint-handling or enforcement activity would mark a materially different development from anything found, since no such body has been identified under either account of the law.

Sources and claims (8)
  1. Probable OneTrust DataGuidance — No independent or sectoral data-protection supervisory authority for the Union of the Comoros (including the autonomous island of Anjouan) is listed in current regional data-protection regulator trackers. observed
  2. Probable International Association of Privacy Professionals (IAPP) — The Union of the Comoros does not appear in the current global inventory of countries with comprehensive data-protection and privacy laws in effect. observed
  3. Probable International Association of Privacy Professionals (IAPP) — The Union of the Comoros is not identified among the African Union member states reported to have ratified the Malabo Convention (African Union Convention on Cyber Security and Personal Data Protection), so that regional instrument does not currently bind Comoros domestically. observed
  4. Disputed Internews ARISA Internet Environment Assessment -- Comoros chapter — Comoros (national-level, Loi n°14-029/AU) — A 2023 civil-society legal mapping and a 2025-dated Africa DP factsheet state Comoros has no dedicated data-protection law and that the 2014 draft (Loi n°14-029/AU) does not appear enacted; a 2026 country-profile source states Comoros 'has a personal data protection law'. observed
  5. Disputed Digital Watch Observatory — Union of the Comoros — No operational data-protection supervisory authority exists; a designated authority is described as 'not operational'. observed
  6. Uncertain dataprotection.africa — Union of the Comoros — A 2023 civil-society legal review states Comoros does not have a dedicated data protection law, and a 2014 draft bill does not appear to have been enacted. observed
  7. Uncertain Digital Watch Observatory — Comoros Law on the Protection of Personal Data — A compliance-vendor summary describes a 'Law on the Protection of Personal Data' as enacted 29 June 2021, with GDPR-aligned obligations including 72-hour breach notification, though unenforced for lack of an operational authority. observed
  8. Uncertain dataprotection.africa — Comoros data-protection supervisory authority — No dedicated KM-A (or KM-national) data protection authority has been confirmed operational as of this cycle. observed

#

No lawful-basis or consent framework exists absent an enacted DP statute.

Traffic-light rationale — RedNo lawful-basis or consent framework exists absent an enacted DP statute.
D2 · Lawful Processing — Full Module Record4 sub-modules · 26 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

#

No data-subject-rights framework exists absent an enacted DP statute.

Traffic-light rationale — RedNo data-subject-rights framework exists absent an enacted DP statute.

Sub-modules (5)

Access RightRed

No subject-access-request framework identified.

Claims (1):

  • No statutory subject-access, rectification, erasure, restriction, objection, or portability rights regime could be identified for Comoros in the absence of a national data-protection law.

Rectification And ErasureRed

No erasure/rectification right identified.

Restriction And ObjectionRed

No restriction/objection right identified.

Data PortabilityRed

No portability right identified.

Deadlines And Response WindowsRed

No statutory response deadline identified.

Category narrative 16 words

No statutory subject-access, rectification/erasure, restriction/objection, portability right, or statutory response-deadline framework could be identified for Comoros/Anjouan.

Sources and claims (1)
  1. Probable International Association of Privacy Professionals (IAPP) — No statutory subject-access, rectification, erasure, restriction, objection, or portability rights regime could be identified for Comoros in the absence of a national data-protection law. observed

#

No controller/processor accountability regime exists absent an enacted DP statute.

Traffic-light rationale — RedNo controller/processor accountability regime exists absent an enacted DP statute.
D4 · Controller & Processor — Full Module Record7 sub-modules · 26 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

#

No domestic transfer-mechanism regime exists; adjacent cybercrime-cooperation instrument status is unconfirmed.

Traffic-light rationale — RedNo domestic transfer-mechanism regime exists; adjacent cybercrime-cooperation instrument status is unconfirmed.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 104 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

#

No sectoral DP overlays identified for any of the eight declared sub-modules.

Traffic-light rationale — RedNo sectoral DP overlays identified for any of the eight declared sub-modules.
D6 · Sectoral Watch — Full Module Record8 sub-modules · 42 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

#

No adtech/commercial-privacy regime exists absent an enacted DP or ePrivacy statute.

Traffic-light rationale — RedNo adtech/commercial-privacy regime exists absent an enacted DP or ePrivacy statute.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 21 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

#

No algorithmic/biometric governance regime exists absent an enacted DP statute.

Traffic-light rationale — RedNo algorithmic/biometric governance regime exists absent an enacted DP statute.
D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 25 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

#

No children/vulnerable-groups DP regime exists absent an enacted statute.

Traffic-light rationale — RedNo children/vulnerable-groups DP regime exists absent an enacted statute.
D9 · Children's Privacy — Full Module Record5 sub-modules · 18 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

#

No enforcement or redress regime exists absent an enacted DP statute and designated regulator.

Traffic-light rationale — RedNo enforcement or redress regime exists absent an enacted DP statute and designated regulator.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 38 words · 1 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 20 claim(s) (20 category placement(s)), 8 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsaccess right
Art. 14Data Subject Rightsaccess right
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrectification and erasure
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer impact assessment
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redresscollective redress and class actions
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties