Morocco

Law No. 09-08 of 18 February 2009 on the Protection of Individuals with regard to the Processing of Personal Data IN FORCE

commenced 2009-02-18 (promulgated by Dahir No. 1-09-15) · Official full text ↗

Scope

Any processing of personal data: information of any nature and format relating to an identified or identifiable natural person: by private or public controllers established in Morocco or using means located in Morocco.

Key obligations

Prior declaration to the CNDP for ordinary processing, with a compliance commitment and detailed filing content; Prior CNDP authorisation for sensitive data, purpose changes, genetic data (outside medical use), offence data (outside court officers), and national-ID-number processing; Standard processing principles: lawfulness, purpose limitation, proportionality, accuracy, limited retention, security and confidentiality; Data subject rights: information, access, rectification, objection (incl. to direct marketing)

DPO required

No: Law 09-08 contains no DPO requirement (the reform under discussion is expected to introduce one).

Registration

Yes: prior declaration or prior authorisation with the CNDP depending on the processing category.

Cross-border transfers

Transfers abroad require a sufficient level of protection in the destination state as assessed by the CNDP, and CNDP authorisation; intended transfers must be disclosed in the declaration/authorisation filing.

Breach notification

No breach-notification requirement under Law 09-08 (GDPR may apply in parallel to Morocco-based processors serving EU controllers).

Penalties

Criminal regime (arts. 50-64): fines of MAD 10,000 to 600,000 and/or imprisonment of three months to four years; fines double for legal persons, which additionally risk partial confiscation of property, seizure, and closure of establishments involved in the offence.

Authority

Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP)

Verified 2026-07-07

Law No. 31-13 on the Right of Access to Information 2018 IN FORCE