Loi relative à la protection des données à caractère personnel (Comoros Personal Data Protection Act 2021)

The Union of the Comoros enacted a Law on the protection of personal data, reported to date from 29 June 2021, establishing a legal framework that applies broadly to personal data processing activities. The law sits alongside the Comoros' cybersecurity and cybercrime legislation (Law No. 21-012/AU) and the country's broader digital-code reforms. The law provides for an oversight Commission, composed of nine members, responsible for supervising the implementation of personal data processing in accordance with its provisions. Decisions of the Commission that affect citizens' interests are subject to appeal before the competent administrative court, indicating a structured administrative-law framework around the authority's decisions. Consistent with the francophone Convention 108 / ECOWAS-influenced model, the law is understood to establish data-quality principles, conditions for lawful processing, data-subject rights, and restrictions on sensitive-data processing, though the detailed provisions are not fully confirmed from available secondary sources. Importantly, while the law provides for a nine-member supervisory Commission, no operational data protection authority has been clearly and publicly identified as functioning; the national ICT regulator (ANRTIC) exists but has not been confirmed as the data protection supervisor. For that reason no Regulator record is linked to this instrument. This entry was created from a June 2026 verification search rather than from a pre-existing ATLPF research file; older sources had described Comoros as having no comprehensive law, so the 2021 enactment should be treated as confirmed-but-thinly-sourced. The primary text is available via ANADEN. Reviewer should confirm the exact enactment reference, substantive provisions, and the operational status of the Commission. Source language: French.

1. 1Comoros enacted a comprehensive personal data protection law, reported to date from 29 June 2021, applying broadly to data-processing activities.
2. 2Provides for a supervisory Commission composed of nine members overseeing implementation.
3. 3Commission decisions affecting citizens' interests are appealable to the competent administrative court.
4. 4Understood to follow the francophone Convention 108 model (principles, lawful bases, data-subject rights, sensitive-data restrictions), though detail is not fully confirmed.
5. 5No operational supervisory authority has been clearly identified; ANRTIC (ICT regulator) is not confirmed as the DP supervisor.
6. 6Reviewer action: confirm enactment reference and substantive provisions against the ANADEN primary text; confirm whether the Commission is operational and create a Regulator record if so.