Data protection & privacy law in Comoros (2026)

Legal framework

Law of 26 June 2014 on the Protection of Personal Data (Loi du 26 juin 2014 portant protection des données à caractère personnel); supplemented by Electronic Communications Law No. 14-031/AU (2014, amended 2024) and Cybersecurity Law 21-012/AU (2021). Supervisory body: National Authority for the Protection of Personal Data (ANPDP), established in law but not yet operational.

Key points: data & privacy in Comoros

1. 01Primary Law (2014)

   The Law of 26 June 2014 on the Protection of Personal Data is the principal statute, available on the official Comoros Ministry of Justice portal. It establishes definitions, lawful-processing grounds, data-subject rights, and controller obligations aligned with broadly accepted data protection principles.

   justice.gouv.km

2. 02Constitutional Basis

   Article 27 of the Constitution of the Union of the Comoros protects the confidentiality of correspondence and telecommunications and individual computer data, providing constitutional grounding for the legislative framework.

   dataprotection.africa internews.org

3. 03Supervisory Authority (ANPDP), Not Yet Operational

   The 2014 law creates the National Authority for the Protection of Personal Data (ANPDP) as an independent public body with powers to investigate, issue warnings, and impose administrative sanctions. As of mid-2024 the ANPDP had not been formally constituted or made operational, leaving enforcement largely theoretical.

   dataprotection.africa techhiveadvisory.africa

4. 04Electronic Communications Law

   Law No. 14-031/AU of 17 March 2014 on Electronic Communications (promulgated by Decree 14-197/PR) contains additional data-protection provisions for the telecom sector. It was amended by Law 23-024/AU, promulgated by Decree 24-003/PR of 2 February 2024, updating the electronic-communications regulatory framework.

   justice.gouv.km justice.gouv.km

5. 05Cybersecurity & Cybercrime Law (2021)

   Law 21-012/AU of 25 June 2021 on Cyber Security and the Fight against Cybercrime, promulgated by Decree 22-003, designates ANADEN (National Agency for Digital Development) as the competent cybersecurity authority and complements the personal data protection regime with cyber-incident and criminal-liability provisions.

   ancs.gouv.km

6. 06AfDB Grant & ANPDP Operationalization

   A USD 10 million African Development Bank digital-government grant awarded in October 2024 includes explicit financing to establish and operationalize the ANPDP and construct a national data centre, indicating the authority's operationalization is a near-term government priority but not yet complete.

   biometricupdate.com techpoint.africa

Sources

1. 1.justice.gouv.km/texte/loi-du-26-juin-2014-portant-protection-des-donnees-a-caractere-
2. 2.justice.gouv.km/texte/decret-n14-197pr-portant-promulgation-de-la-loi-n14-031-au-rela
3. 3.justice.gouv.km/wp-content/uploads/2025/03/decret-n-24-003pr-du-2-fevrier-2024-portan
4. 4.ancs.gouv.km/wp-content/uploads/2024/02/DEC-N%C2%B022-003-promul-loi-N%C2%B022-003
5. 5.dataprotection.africa/comoros/
6. 6.techhiveadvisory.africa/insights/review-of-the-comoros-data-protection-law
7. 7.internews.org/wp-content/uploads/2023/11/ARISA-IEA-CHAPTER-5-Comoros.pdf
8. 8.biometricupdate.com/202410/comoros-to-implement-digital-govt-program-with-10m-afdb-grant
9. 9.unctad.org/page/data-protection-and-privacy-legislation-worldwide
10. 10.ancs.gouv.km/wp-content/uploads/2024/02/DEC-N%C2%B022-003-promul-loi-N%C2%B021-012
11. 11.techpoint.africa/2024/10/03/comoros-gets-funding-from-afdb/