ComorosLaw on the Protection of Personal Data, the Commission and sanctions
Loi n° 14-029/AU, arts. 19-40, 47, 54-65 (enforcement, sanctions and offenses)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect the Commission to inform and advise you of your rights and obligations, to receive and answer complaints about your processing, and to alert the public prosecutor to a violation amounting to a criminal offense.
- Comply with a warning or formal notice the Commission issues within the period it sets, no more than eight days, or face a pecuniary sanction, an injunction to stop the processing, withdrawal of an authorization, or a data lock, after a contradictory procedure.
- Do not obstruct the Commission's action and take useful measures to facilitate its mission, including letting its members and agents access the premises where processing is carried out.
- Expect a person harmed by your processing to be able to seek damages before the competent court, and expect criminal liability of five to ten years' imprisonment and a fine of 10,000,000 to 35,000,000 Comorian francs, or either penalty alone, for obstructing the Commission, processing without required formalities, or another article 64 offense.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 65 punishes every offense article 64 lists, including obstructing the Commission's action, processing without the required formalities, unauthorized processing of sensitive or national identification data, fraudulent collection, diverting or manipulating personal data, processing despite a data subject's rectification demand or legitimate objection, failing to give the required information or honor access rights, exceeding the declared retention period, and unauthorized disclosure harming a person's consideration or privacy, with five to ten years' imprisonment and a fine of 10,000,000 to 35,000,000 Comorian francs, or either penalty alone. Complicity and attempt draw the same penalties, and the court may order the erasure of all or part of the personal data involved.
Penalty structure
Article 65's fine applies to every article 64 offense, alternatively or cumulatively with five to ten years' imprisonment; the law does not scale the fine to turnover or to a per violation count.
- Rule
- Fixed only
- As of
- 19 September 2026
- Minimum
- 10,000,000
- Currency
- KMF
- Fixed cap
- 35,000,000
Who enforces it
Enforcement body
Commission Nationale de l'Informatique et des Libertés (CNIL)
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 19 creates the Commission Nationale de l'Informatique et des Libertés (CNIL) as the body charged with protecting personal data and controlling its processing, and article 20 gives it its own legal personality, administrative and management autonomy, and independence from every administrative and political authority.
Article 21 lists the Commission's missions, including informing and advising controllers and data subjects of their rights and obligations, controlling the creation of processing, receiving and answering complaints, alerting the public prosecutor to violations amounting to criminal offenses, and proposing legislative improvements. Articles 23 to 30 fix the Commission's nine member composition, their nomination, oath, five year renewable term, incompatibilities, and professional secrecy.
Article 39 bars ministers, public authorities, and public or private enterprise directors from obstructing the Commission's action and requires them to take useful measures to facilitate its mission, and article 47 lets Commission members and agents access the premises where processing is carried out, subject to judicial authorization if the controller objects, and requires a report of the visit.
Article 54 lets the Commission issue a warning or a formal notice fixing a deadline of up to eight days to end a violation, and article 55 lets it, where the controller does not comply, impose a pecuniary sanction, an injunction to stop the processing, withdrawal of an authorization, or a data lock, after a contradictory procedure under articles 56 to 59; article 60 lists what counts as a serious violation, including unlawful collection of sensitive, offense related or national identification data and obstructing the Commission's inspection.
Article 63 lets an injured person seek damages before the competent court, and article 65 punishes every offense article 64 lists, including obstructing the Commission, processing without required formalities, and unauthorized disclosure harming a person's privacy, with five to ten years' imprisonment and a fine of 10,000,000 to 35,000,000 Comorian francs, or either penalty alone, extending the same penalties to complicity and attempt.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisions
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.