Data protection & privacy laws in Comoros (2026)

The Law of 26 June 2014 on the Protection of Personal Data is the principal statute, available on the official Comoros Ministry of Justice portal. It establishes definitions, lawful-processing grounds, data-subject rights, and controller obligations aligned with broadly accepted data protection principles.

Article 27 of the Constitution of the Union of the Comoros protects the confidentiality of correspondence and telecommunications and individual computer data, providing constitutional grounding for the legislative framework.

The 2014 law creates the National Authority for the Protection of Personal Data (ANPDP) as an independent public body with powers to investigate, issue warnings, and impose administrative sanctions. As of mid-2024 the ANPDP had not been formally constituted or made operational, leaving enforcement largely theoretical.

Law No. 14-031/AU of 17 March 2014 on Electronic Communications (promulgated by Decree 14-197/PR) contains additional data-protection provisions for the telecom sector. It was amended by Law 23-024/AU, promulgated by Decree 24-003/PR of 2 February 2024, updating the electronic-communications regulatory framework.

Law 21-012/AU of 25 June 2021 on Cyber Security and the Fight against Cybercrime, promulgated by Decree 22-003, designates ANADEN (National Agency for Digital Development) as the competent cybersecurity authority and complements the personal data protection regime with cyber-incident and criminal-liability provisions.

A USD 10 million African Development Bank digital-government grant awarded in October 2024 includes explicit financing to establish and operationalize the ANPDP and construct a national data centre, indicating the authority's operationalization is a near-term government priority but not yet complete.