In short
This is an unofficial explanatory note; only the Arabic text published in the Bulletin officiel is authoritative. Law No. 09-08 regulates the collection and use of personal data in Morocco and set up the national data protection authority (CNDP). It imposes obligations on organisations that process data and grants rights to the individuals concerned.
Who this law applies to
The law applies to companies, public bodies, associations, professionals and any organisation that collects or processes data about individuals in Morocco: customer files, employee records, CCTV, websites, mobile apps and direct marketing. It protects everyone whose data is processed.
Key rules
- Data must be collected fairly and lawfully, for specified purposes, and must be adequate, relevant and not excessive.
- Processing is in principle based on the consent of the person concerned, subject to exceptions set out in the law.
- Individuals have rights to information, access, rectification and objection.
- The data controller must ensure the security and confidentiality of data, including when using a processor.
- Processing must be declared to the CNDP in advance or, for certain sensitive categories, authorised by it beforehand.
Key deadlines and figures
- Data must not be kept longer than necessary for the purpose of the processing.
- Sensitive data (origin, opinions, religious beliefs, trade union membership, health) is subject to a restrictive regime.
- Data may only be transferred abroad to a country offering an adequate level of protection or with CNDP authorisation, subject to statutory exceptions.
- Failure to comply exposes organisations to administrative and criminal sanctions, including fines.
What this means in practice
A business that installs cameras, keeps a customer database or uses tools hosted abroad must check its formalities with the CNDP and inform the people concerned. Privacy notices and contracts with service providers need to be adapted.
An individual can ask an organisation what data it holds about them, have it corrected, or object to its use for marketing. If difficulties arise, a complaint can be filed with the CNDP.
Reforms and recent developments
The CNDP regularly publishes decisions and guidelines, notably on CCTV, direct marketing and international transfers. Morocco has acceded to Council of Europe Convention 108 on data protection, bringing the Moroccan framework closer to international standards.
When to consult a lawyer
Support is useful to map your processing activities, prepare CNDP formalities, draft privacy notices and contractual clauses, or respond to a data breach. An individual may also seek advice if they believe their data has been used unlawfully.
Explanatory note prepared by the firm and unofficial translation. Only the text published in the Official Bulletin is authoritative. The information on this website is general and does not replace legal advice. Every situation requires an analysis of its own facts and documents.