ComorosLaw on the Protection of Personal Data
Loi n° 14-029/AU portant protection des données à caractère personnel deliberated and adopted by the Assemblée de l'Union des Comores in plenary session on , arts. 1-5, 41-42, 43(a) and (e)-(g), 44-46, 49-53 and 66-68 (comprehensive regime, formalities and obligations)
In force.
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Governance, Security, Retention
- Audit expectation
- none
What it requires
- Collect and process personal data lawfully and fairly, only for determined and legitimate purposes, keep it accurate and up to date, and do not retain it beyond the period necessary for those purposes.NIST Privacy FrameworkGV.PO-P1
- Declare personal data processing to the Commission before implementing it, or enter it in a register kept by a designated person, unless it is exempt as general accounting, payroll, supplier management, or a non profit association's membership processing.NIST Privacy FrameworkGV.PO-P5
- Obtain the Commission's prior authorization before processing a national identification number or a national census, processing concerning state security, defense or public safety or the investigation and prosecution of offenses, interconnecting files serving different purposes, or processing that could exclude a person from a right, a benefit or a contract.NIST Privacy FrameworkGV.PO-P5
- State in your declaration the controller's identity and address, the processing's purposes, the data collected and its retention period, who may access it, any transfer abroad, and the security measures you have taken.NIST Privacy FrameworkGV.PO-P5
- Collect personal data for an electronic certification service directly from the data subject, and use it only for the purpose it was collected for, unless the data subject expressly consents otherwise.NIST Privacy FrameworkGV.PO-P1
- Take precautions appropriate to the nature of the data and the risks the processing presents to preserve its security, including against distortion, damage, or access by unauthorized third parties.NIST Privacy FrameworkPR.DS-P5
- Confine a sub processor to your instructions under a contract addressing security and confidentiality, without relieving yourself of the duty to see those measures respected.NIST Privacy FrameworkID.DE-P3
- Notify the Commission without delay of any change to the information in your declaration and of the discontinuation of the processing.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 41 requires every automated processing of personal data by a public or private body, before it starts, either to be declared to the Commission or to be entered in a register kept by the person the controller designates (English: automated processing must, before it is put into operation, be declared to the Commission or be entered in a register kept by the person designated by the controller). Article 45 lists what the declaration holds (controller, purposes, the data recorded with their origin and retention period, who may access, transfers, security measures) and Article 52 requires every change, and the end of the processing, to be notified without delay. Those contents are categories of processing and not events, so no log contents are coded, and Article 5(f) on keeping data no longer than needed limits the personal data and not the record. Article 42 lists the exempt processing. No article cited provides for a review of the register, and the Commission's powers to inspect and to demand information are in Articles 37 and 47, which this row does not cite. Article 1 states the matters the law covers and no territorial clause, so no hook is coded. The Comoros text cited is the law as deliberated and adopted by the Assemblee de l'Union on , reproduced by ANADEN; no promulgation or Official Gazette copy was read.
- Kind
- Explicit
- As of
- Provision
- Article 41 (a declaration to the Commission, or entry in a register kept by a person the controller designates), with the content of the declaration in Article 45 and the duty to notify changes in Article 52
- Trigger
- personal_data_processing
What this law does
Article 1 applies the law to any automated processing of personal data held in a digitized or manual file, and article 5 requires data to be collected and processed lawfully and fairly, for determined and legitimate purposes, kept accurate and up to date, and not retained beyond the period the purpose requires.
Article 41 requires processing carried out by a public or private body to be declared to the Commission before it is implemented, or entered in a register kept by a person the controller designates, and article 42 exempts general accounting, payroll, supplier management, and a non profit association's membership processing from that duty.
Articles 43(a) and 43(e) to (g) require the Commission's prior authorization for processing bearing a national identification number or a national census, processing concerning state security, defense or public safety or the investigation and prosecution of offenses, an interconnection of files serving different purposes, and processing that could exclude a person from a right, a benefit or a contract, and article 44 gives the Commission two months to decide on such a request, with silence counting as approval outside the article 17 state security procedure.
Articles 45 and 46 fix what a declaration must state, including the controller's identity, the processing's purposes, the data and its retention period, who may access it, and the security measures taken. Article 49 requires an electronic certification provider to collect personal data directly from the data subject and to use it only for the purpose for which it was collected, unless the data subject expressly consents otherwise.
Article 50 requires the controller to take precautions appropriate to the data and to the risks the processing presents, and article 51 confines a sub processor to the controller's instructions under a contract addressing security and confidentiality.
Article 52 requires the controller to notify the Commission without delay of any change to the declared processing or of its discontinuation, and article 53 allows retention beyond the article 5 period only for historical, statistical or scientific purposes, with the data subject's express consent, or with the Commission's authorization. The Law names no day for its entry into force, and no promulgation decree or commencement notice for it has been located.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .