Not publishable as-is. 2 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
Based mainly on secondary sources. Only 1 of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.
KM-M Data Protection & Privacy Regulation
KM-Mschema gdpri-v2trajectory: not yet assessedunregulated gap
Last updated · 10 categories · 14
claims · 14 sources in the cumulative register
The clearest development on the data-protection file for Mohéli, administered within the Union of the Comoros' national legal framework, concerns funding rather than law.
Data collected · Data published
AI-assembled from cited sources
Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (3 open gaps).
Evidence re-verified:·Position last changed:·Record history & provenance ▾
Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.
Traffic-light mix(sums to 10 rendered categories; click to filter)
Jurisdiction lead brief
Standing brief, as of 4 November 2026.
Lead Signal
The clearest development on the data-protection file for Mohéli, administered within the Union of the Comoros' national legal framework, concerns funding rather than law. The African Development Bank has approved EUR 9.51 million for a project to support digitisation of the Comorian economy, and that project is understood to include the establishment and operationalisation of a National Authority for the Protection of Personal Data and Access to Information. No general supervisory authority for personal data has existed in an operational form to date, and this funding commitment is the most concrete signal available that this may change.
Other Developments
Consistent with the absence of a constituted authority, no data-protection enforcement decisions have been recorded for the Union of the Comoros as of the most recent verification point in late September 2026.
Cross-Monitor Connections
The AfDB-funded digitisation programme touches institutional capacity-building that may be of interest to those tracking financial-integrity developments in the region, given the programme's broader digital-economy scope, though the detail of that financing sits outside this review.
Outlook
Whether the AfDB-funded project translates into an operational National Authority for the Protection of Personal Data and Access to Information remains to be seen; its current implementation status has not been independently confirmed. Until such an authority is constituted, enforcement capacity in the Comorian data-protection space is expected to remain effectively dormant regardless of what the underlying statute says on paper.
Key regulatory facts for KM-M
Regulatory Dimension
KM-M Standing Position
Jurisdiction
KM-M (KM-M)
Regulatory Scope
Data Protection & Privacy Regulation (10 modules, 14 sourced findings)
Regulator & Framework
No supervisory authority, no enabling statute, no registration/filing regime identified after targeted research; confirmed gap rather than a sourcing failure.
Lawful Processing & Special Data
No instrument exists to extract rule-level findings from.
Data Subject Rights
Confirmed absence of any DSR statute.
Controller/Processor Duties
Confirmed absence; no instrument found despite targeted search for Comorian cyber/data instruments.
Primary Instruments Cited
IAPP, EUR-Lex / Official Journal, LawLab Africa - Data Protection in Comoros, e-Governance Academy NCSI - Comoros
Last Confirmed / Updated
2026-11-04 (14 sources in cumulative register)
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
No supervisory authority, no enabling statute, no registration/filing regime identified after targeted research; confirmed gap rather than a sourcing failure.
Traffic-light rationale — RedNo supervisory authority, no enabling statute, no registration/filing regime identified after targeted research; confirmed gap rather than a sourcing failure.
Sub-modules (5)
Regulator And AuthorityRed
No DPA has been established in Comoros/Mohéli.
Claims (2):
No data protection authority has been established in the Union of the Comoros (which includes Mohéli/Mwali as a constituent island) as of the research date; the IAPP directory records no DPA or comprehensive data protection legislation for Comoros.
No general personal-data protection authority is operational in the Union of the Comoros.
Act And InstrumentsRed
No national data-protection act exists; the only identified instrument touching personal data is the treaty-level Samoa Agreement commitment.
Claims (2):
The Union of the Comoros is a named signatory party to the OACPS-EU Samoa Partnership Agreement, Article 15 of which commits parties to maintain data-protection regimes and establish independent supervisory authorities, but no domestic implementing statute has been identified giving this commitment direct effect.
Comorian sources materially conflict on whether a comprehensive personal-data protection statute is in force.
Material ScopeRed
No statutory material scope exists to research; absent_field_provenance recorded on the governing claim.
Territorial ScopeRed
No territorial-scope provision (no Art 3(2)-style targeting/monitoring limb) exists in Comorian law.
Regulator Registration And FilingRed
No registration, notification, or fee regime exists absent a DPA or statute.
Category narrative108 words
No data protection authority and no comprehensive data-protection statute exist for the Union of the Comoros, of which Mohéli (Mwali) is one of three constituent islands under a unitary national legal order; Mohéli has no separate island-level DP regime. The IAPP's Global Privacy Law and DPA Directory expressly states it is unaware of either a DPA or comprehensive DP legislation for Comoros. The country is a signatory to the OACPS-EU Samoa Partnership Agreement, whose Article 15 commits parties to maintain data-protection regimes and establish independent supervisory authorities, but this is a forward-looking treaty commitment, not a self-executing domestic instrument conferring rights on data subjects or obligations on controllers.
Sources and claims (4)
UncertainIAPP — No data protection authority has been established in the Union of the Comoros (which includes Mohéli/Mwali as a constituent island) as of the research date; the IAPP directory records no DPA or comprehensive data protection legislation for Comoros.observed
UncertainEUR-Lex / Official Journal — The Union of the Comoros is a named signatory party to the OACPS-EU Samoa Partnership Agreement, Article 15 of which commits parties to maintain data-protection regimes and establish independent supervisory authorities, but no domestic implementing statute has been identified giving this commitment direct effect.observed
DisputedLawLab Africa - Data Protection in Comoros — Comorian sources materially conflict on whether a comprehensive personal-data protection statute is in force.observed
Uncertaine-Governance Academy NCSI - Comoros — No general personal-data protection authority is operational in the Union of the Comoros.observed
No instrument exists to extract rule-level findings from.
Traffic-light rationale — RedNo instrument exists to extract rule-level findings from.
D2 · Lawful Processing — Full Module Record4 sub-modules · 32 words · 1 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Traffic-light rationale — RedConfirmed absence of any DSR statute.
Sub-modules (5)
Access RightRed
No statutory access right exists.
Claims (1):
No codified data-subject-rights regime (access, rectification, erasure, restriction, objection, portability, or statutory response deadlines) exists in Comorian law as of the research date.
Rectification And ErasureRed
No statutory erasure/rectification right exists.
Restriction And ObjectionRed
No statutory restriction/objection right exists.
Data PortabilityRed
No statutory portability right exists.
Deadlines And Response WindowsRed
No statutory response-deadline regime exists.
Category narrative12 words
No statutory subject-access, rectification/erasure, restriction/objection, portability, or response-deadline framework exists for Comoros/Mohéli.
Sources and claims (1)
UncertainIAPP — No codified data-subject-rights regime (access, rectification, erasure, restriction, objection, portability, or statutory response deadlines) exists in Comorian law as of the research date.observed
Confirmed absence; no instrument found despite targeted search for Comorian cyber/data instruments.
Traffic-light rationale — RedConfirmed absence; no instrument found despite targeted search for Comorian cyber/data instruments.
D4 · Controller & Processor — Full Module Record7 sub-modules · 21 words · 1 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No adequacy decision received or granted; no SCC/BCR uptake; treaty commitment only.
Traffic-light rationale — RedNo adequacy decision received or granted; no SCC/BCR uptake; treaty commitment only.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 57 words · 1 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No sectoral DP overlay identified; telecom-regulator existence unconfirmed (gap, not negative finding).
Traffic-light rationale — RedNo sectoral DP overlay identified; telecom-regulator existence unconfirmed (gap, not negative finding).
D6 · Sectoral Watch — Full Module Record8 sub-modules · 50 words · 1 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Confirmed absence; no ePrivacy-equivalent or consumer-protection adtech provision identified.
Traffic-light rationale — RedConfirmed absence; no ePrivacy-equivalent or consumer-protection adtech provision identified.
D7 · AdTech & Marketing — Full Module Record6 sub-modules · 18 words · 1 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Confirmed absence of any children/vulnerable-groups DP provision.
Traffic-light rationale — RedConfirmed absence of any children/vulnerable-groups DP provision.
D9 · Children's Privacy — Full Module Record5 sub-modules · 17 words · 1 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No DPA, no DP-specific penalty regime, no enforcement record — confirmed gap.
Traffic-light rationale — RedNo DPA, no DP-specific penalty regime, no enforcement record — confirmed gap.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 53 words · 2 traced claims · Re-verified 2026-11-04
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Filters combine as OR inside a group and AND across
groups.
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score. Not shown on this page.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 14 claim(s) (14 category placement(s)), 14 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 24 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.
KM-M