Not publishable as-is. 2 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
Based mainly on secondary sources. Only 1 of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.
KM Data Protection & Privacy Regulation
KMschema gdpri-v2trajectory: not yet assessedunregulated gap
Last updated · 10 categories · 14
claims · 11 sources in the cumulative register
Summary answer not yet published for this jurisdiction
Data collected · Data published
AI-assembled from cited sources
Not covered: Regulator & Framework, Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Cross-Border & Adequacy, Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups, Enforcement & Redress.
Evidence re-verified:·Position last changed:·Record history & provenance ▾
Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.
Traffic-light mix(sums to 10 rendered categories; click to filter)
Jurisdiction brief
KM operates under a unregulated gap supervised by Statutory Supervisory Authority, with 6 regulatory modules assessed in the current cycle.
D1 · Regulator & Framework: No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID.
D3 · Data Subject Rights: No rights framework identified in the absence of a national data protection statute.
D4 · Controller & Processor: No controller/processor obligations regime identified.
D5 · Cross-Border & Adequacy: No cross-border transfer mechanism or adequacy framework identified for this JID.
All 6 module posture summaries
D1 · Regulator & Framework: No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID.
D3 · Data Subject Rights: No rights framework identified in the absence of a national data protection statute.
D4 · Controller & Processor: No controller/processor obligations regime identified.
D5 · Cross-Border & Adequacy: No cross-border transfer mechanism or adequacy framework identified for this JID.
No comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID.
Traffic-light rationale — RedNo comprehensive omnibus or sectoral data-protection statute, and no dedicated supervisory authority, could be identified for this JID.
Sub-modules (5)
Regulator And AuthorityRed
No national data protection authority identified for the Union of the Comoros in any surveyed source.
Claims (2):
A Comorian Personal Data Protection Law exists on the books but its supervisory authority has not been constituted/is not operational, so the law remains effectively unenforced.
National Authority for the Protection of Personal Data — Provided for by Law No. 14-029/AU but not constituted/operational
Act And InstrumentsRed
No comprehensive data protection act or instrument located; absent_field_provenance records the searches run.
Claims (1):
Law No. 14-029/AU on the Protection of Personal Data — Adopted 26 June 2014; reported 29 June 2021 promulgation flagged as unverified by one specialist tracker, with no decree located
Material ScopeRed
Not applicable in the absence of an identified instrument.
Claims (1):
Law No. 14-029/AU on the Protection of Personal Data — Covers automated/non-automated processing by controllers/processors established in Comoros plus extraterritorial reach over foreign entities processing data of individuals in Comoros in connection with offering goods/services or monitoring behaviour; exemptions for personal/domestic and conditional journalistic/artistic/literary processing
Territorial ScopeRed
Territorial/material scope cannot be assessed absent a national instrument; the only regional instrument potentially touching Comoros (Malabo Convention) has unconfirmed ratification status for this JID.
Claims (1):
One secondary tracker describes the law as having broad territorial scope covering foreign entities processing the data of Comorian residents, but this is not confirmed against a primary text.
Regulator Registration And FilingRed
No registration, notification or fee regime identified.
Category narrative101 words
Extensive searching across cross-jurisdictional legal trackers (OneTrust DataGuidance jurisdiction/African Bodies pages, IAPP Global Privacy Law and DPA Directory commentary, UNCTAD-referenced cyberlaw sources), French-language searches for a Comorian 'loi sur la protection des données personnelles' or 'informatique et libertés' instrument, and searches for an ITU/telecoms-sector privacy regulator, returned no comprehensive national data-protection statute and no named Comorian data-protection authority. The Union of the Comoros is an African Union member state and is in the orbit of the AU Malabo Convention on Cyber Security and Personal Data Protection, but no ratification or signature record for Comoros specifically was located in the sources surveyed.
Sources and claims (5)
Uncertainhttps://research.lawlab.africa/comoros/ — National Authority for the Protection of Personal Data — Provided for by Law No. 14-029/AU but not constituted/operational
Uncertainhttps://research.lawlab.africa/comoros/ — Law No. 14-029/AU on the Protection of Personal Data — Adopted 26 June 2014; reported 29 June 2021 promulgation flagged as unverified by one specialist tracker, with no decree located
Uncertainhttps://research.lawlab.africa/comoros/ — Law No. 14-029/AU on the Protection of Personal Data — Covers automated/non-automated processing by controllers/processors established in Comoros plus extraterritorial reach over foreign entities processing data of individuals in Comoros in connection with offering goods/services or monitoring behaviour; exemptions for personal/domestic and conditional journalistic/artistic/literary processing
UncertainPrimary statutory record — A Comorian Personal Data Protection Law exists on the books but its supervisory authority has not been constituted/is not operational, so the law remains effectively unenforced.
UncertainPrimary statutory record — One secondary tracker describes the law as having broad territorial scope covering foreign entities processing the data of Comorian residents, but this is not confirmed against a primary text.
No lawful-basis, consent, or special-category regime identified; absence consistent with unregulated_gap status.
Traffic-light rationale — Not assessedNo lawful-basis, consent, or special-category regime identified; absence consistent with unregulated_gap status.
Sub-modules (4)
Lawful BasesRed
No lawful-basis enumeration (consent, contract, legitimate interest, etc.) identified for this JID.
Claims (1):
No statutory subject-access, rectification, erasure, restriction, objection or portability rights regime could be confirmed as operative for Comoros in the absence of an enforced national data-protection law.
Consent ThresholdsRed
No statutory consent-validity standard identified.
Special CategoriesRed
No special/sensitive-category data regime identified.
Pseudonymisation And AnonymisationRed
No pseudonymisation/anonymisation safe-harbour or identifiability test identified.
Category narrative36 words
No enumerated lawful-basis framework, consent-validity standard, or special-category/sensitive-data regime was located for the Union of the Comoros. This is the heaviest-weighted gap module and the absence is recorded rather than an obligation being inferred or fabricated.
No rights framework identified in the absence of a national data protection statute.
Traffic-light rationale — RedNo rights framework identified in the absence of a national data protection statute.
Sub-modules (5)
Access RightRed
Not identified.
Claims (1):
No statutory subject-access, rectification, erasure, restriction, objection or portability rights regime could be confirmed as operative for Comoros in the absence of an enforced national data-protection law.
Rectification And ErasureRed
Not identified.
Restriction And ObjectionRed
Not identified.
Data PortabilityRed
Not identified.
Deadlines And Response WindowsRed
Not identified.
Category narrative27 words
No subject-access, rectification, erasure, restriction, objection or portability framework was located for the Union of the Comoros in any searched source; no statutory response-deadline regime was identified.
Sources and claims (1)
UncertainPrimary statutory record — No statutory subject-access, rectification, erasure, restriction, objection or portability rights regime could be confirmed as operative for Comoros in the absence of an enforced national data-protection law.
No controller/processor obligations regime identified.
Traffic-light rationale — RedNo controller/processor obligations regime identified.
D4 · Controller & Processor — Full Module Record7 sub-modules · 33 words · 3 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No cross-border transfer mechanism or adequacy framework identified for this JID.
Traffic-light rationale — RedNo cross-border transfer mechanism or adequacy framework identified for this JID.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 57 words · 1 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No sectoral data-protection overlay identified for any sub-module.
Traffic-light rationale — Not assessedNo sectoral data-protection overlay identified for any sub-module.
Sub-modules (8)
Financial Sector OverlayRed
Not identified.
Health Sector OverlayRed
Not identified.
Telecoms And EprivacyRed
Not identified.
Employment DataRed
Not identified.
Credit And ScoringRed
Not identified.
EducationRed
Not identified.
InsuranceRed
Not identified.
Data Access SharingRed
No EU Data Act implementing/enforcement law or local smart-data/data-portability scheme identified for this JID (and none would be expected absent EU-market-facing legislative uptake).
Category narrative46 words
No sector-specific data-access/sharing, financial-sector, health-sector, telecoms/ePrivacy, employment, credit-scoring, education or insurance overlay touching personal data was located for the Union of the Comoros in the sources searched, including banking-secrecy rules potentially administered by the Banque Centrale des Comores, for which no DP-specific overlay text was found.
Traffic-light rationale — Not assessedNo adtech/commercial-privacy regime identified.
Sub-modules (6)
Cookies And TrackersRed
Not identified.
Dark PatternsRed
Not identified.
Opt Out SignalsRed
Not identified.
Clean Rooms And DcrRed
Not identified.
Cross Context AdvertisingRed
Not identified.
Direct MarketingRed
Not identified.
Category narrative22 words
No cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal framework, clean-room rule, or direct-marketing consent regime was located for the Union of the Comoros.
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No children/vulnerable-groups data-protection regime identified.
Traffic-light rationale — Not assessedNo children/vulnerable-groups data-protection regime identified.
Sub-modules (5)
Age VerificationRed
Not identified.
Parental ConsentRed
Not identified.
Minor Profiling BansRed
Not identified.
Education SettingsRed
Not identified.
Dependent AdultsRed
Not identified.
Category narrative20 words
No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-sector rule, or dependent-adult protection was located for the Union of the Comoros.
No enforcement or redress regime identified; no DPA exists to exercise powers or generate an enforcement record.
Traffic-light rationale — RedNo enforcement or redress regime identified; no DPA exists to exercise powers or generate an enforcement record.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 30 words · 2 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Filters combine as OR inside a group and AND across
groups.
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score. Not shown on this page.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 14 claim(s) (14 category placement(s)), 11 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 24 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.
KM