Comoros Data Protection Law 2021
Law on the Protection of Personal Data (June 29, 2021)
Key Facts
Overview
The Union of the Comoros enacted a comprehensive data protection law on June 29, 2021, establishing broad territorial scope that covers foreign entities processing data of Comorian individuals. The law requires consent or a lawful basis for data processing and mandates 72-hour breach notification aligning with GDPR standards. However, it remains effectively unenforced because no operational supervisory authority has been established, making practical compliance demands minimal at present.
What This Means for Your Website
If your website collects data from Comorian residents, the law technically applies to you through its broad extraterritorial scope. While enforcement is currently non-existent due to the absence of a supervisory authority, best practice is to implement basic consent mechanisms and data protection practices in anticipation of future enforcement. The 72-hour breach notification and cross-border transfer restrictions exist on paper.
Key Requirements
Consent or a lawful basis is required for data processing. Breach notification must be made within 72 hours. Cross-border transfers require adequate protection in the recipient country or appropriate safeguards such as standard contractual clauses. The law has broad territorial scope covering entities outside Comoros. Data subjects have rights of access, rectification, and deletion. Data security measures are mandatory.
How ConsentStack Handles This
ConsentStack helps organizations prepare for the Comoros data protection law by providing a consent management platform that captures lawful consent. Even though enforcement is currently inactive, ConsentStack's consent banner, timestamped records, and audit trails position your website for compliance when supervisory authority operations begin.
Penalties
Fines escalating by severity and frequency of breach; operational restrictions possible. Specific amounts not publicly detailed.
Key Requirements
- Consent or lawful basis required for data processing
- 72-hour breach notification to relevant authorities
- Cross-border transfers require adequate protection or appropriate safeguards
- Broad territorial scope covering entities outside Comoros processing Comorian data
- Data subjects have rights of access, rectification, and deletion
- Data security measures mandatory
Notable Provisions
- Law enacted but NOT ENFORCED — no operational supervisory authority
- Broad extraterritorial scope unusual for a small island nation
- 72-hour breach notification aligns with GDPR standards
- Risk-based approach to cross-border transfers
Other Sub-Saharan Africa Regulations
Frequently Asked Questions
Is the Comoros data protection law enforced?
No, the law was enacted in 2021 but remains effectively unenforced because no operational supervisory authority has been established.
Does the Comoros law have extraterritorial scope?
Yes, the law has broad territorial scope covering foreign entities processing personal data of Comorian individuals, which is unusual for a small island nation.
What breach notification timeline does the Comoros require?
The law mandates 72-hour breach notification to relevant authorities, aligning with GDPR standards.
Should I comply with the Comoros law now?
While enforcement is inactive, implementing basic consent mechanisms is recommended as a best practice to prepare for future enforcement when the supervisory authority becomes operational.
Stay compliant with Comoros Data Protection Law 2021
ConsentStack helps you implement Opt-in consent for Union of the Comoros automatically.