🇲🇦Law No. 09-08 on Personal Data Protection
Law No. 09-08 on Personal Data Protection
The law and Decree No. 2-09-165 create Morocco's general framework for personal-data processing and the CNDP's notification and authorisation procedures.
Core operational duties
Processing principles: Articles 3-5 require fair and lawful collection, specified purposes, proportionality, accurate data, controlled retention, information and a valid legal basis.
Individual rights: Articles 7-9 provide access, rectification and objection rights that need authenticated, timely response workflows.
Formalities and safeguards: Articles 12 and 18-26 distinguish declarations from prior authorisations and impose confidentiality, processor and security controls.
International transfers: Articles 43-44 restrict transfers to countries lacking sufficient protection unless an exception and, where required, CNDP authorisation applies.
CNDP filing requirements depend on the data, purpose and processing configuration; they should be assessed before a new or materially changed processing operation begins.