Comoros

Comoros has a comprehensive data protection law. A Law on the protection of personal data, reported to date from 29 June 2021, establishes a framework applying broadly to data-processing activities, sitting alongside the country's cybersecurity and cybercrime legislation. The law is now recorded in ATLPF's Instruments database (AI-draft), resolving earlier uncertainty in which older sources had described Comoros as having no comprehensive law. The law provides for a nine-member supervisory Commission whose decisions affecting citizens' interests are appealable to the competent administrative court, and is understood to follow the francophone Convention 108 model (principles, lawful bases, rights, sensitive-data restrictions), though detailed provisions remain thinly sourced. No operational data protection authority has been clearly identified as functioning, the ICT regulator (ANRTIC) is not confirmed as the data protection supervisor, so no Regulator record is on file. With an instrument on file but no confirmed operational regulator, Comoros scores in the one-instrument-without-an-operational-regulator band. The record is AI-drafted from a June 2026 verification search and requires confirmation against the ANADEN primary text.