Contents
The official schedule
The table below reproduces the list of offences and penalties published by the CNDP.
| Article | Offence | Imprisonment | Fine (MAD) |
|---|---|---|---|
| 52 | Processing without notification or authorisation, or continuing after withdrawal | — | 10,000 to 100,000 |
| 53 | Refusing the rights of access, rectification or objection | — | 20,000 to 200,000 |
| 54 | Unfair collection, or processing for purposes other than those notified | 3 months to 1 year | 20,000 to 200,000 |
| 55 | Retention beyond the stated period | 3 months to 1 year | 20,000 to 200,000 |
| 56 | Processing without consent where consent is required | 3 months to 1 year | 20,000 to 200,000 |
| 57 | Processing sensitive data without express consent | 3 months to 1 year | 50,000 to 300,000 |
| 58 | Failure to implement the required security measures | 3 months to 1 year | 20,000 to 200,000 |
| 59 | Processing despite a legitimate objection, or unauthorised marketing | 3 months to 1 year | 20,000 to 200,000 |
| 60 | Unlawful transfer of data abroad | 3 months to 1 year | 20,000 to 200,000 |
| 61 | Misuse or unauthorised disclosure of data | 3 months to 1 year | 20,000 to 200,000 |
| 62 | Obstructing the CNDP | 3 to 6 months | 10,000 to 50,000 |
| 63 | Refusing to comply with the CNDP's decisions | 3 months to 1 year | 10,000 to 100,000 |
For most offences the law provides for imprisonment "and/or" a fine: the judge may impose either penalty or both.
Aggravating circumstances
- Legal entities (Article 64). Fines are doubled. Additional penalties may also apply, such as partial confiscation of assets or closure of the establishment.
- Repeat offences (Article 65). Penalties are doubled for a further offence committed within a year of a final conviction.
- Additional measures. Where data has been misused, the court may order the seizure of equipment and the erasure of the data.
For a company, processing sensitive data without consent can therefore lead to a fine of up to 600,000 MAD, twice the 300,000 MAD ceiling.
Who imposes penalties?
Fines and prison sentences are imposed by the courts. For its part, the CNDP has investigative powers, can issue formal notices, withdraw a notification receipt or an authorisation (Article 51), and refer cases to the public prosecutor.
Enforcement is stepping up
In 2025 the CNDP sent letters to non-compliant businesses asking them to regularise their situation before the end of May: notifying their processing activities, clearly designating who is responsible internally, and obtaining the required authorisations. The letters reminded them of the penalties for persistent failure to comply.
Beyond the fine
The amount of the fine is often not the main cost. Public proceedings, a data leak that makes the news, or the loss of an institutional client that demands compliance guarantees usually weigh far more heavily. The best protection remains documented compliance.
Further reading
- 5 min read
- 4 min read
- 4 min read
Frequently asked questions
What is the maximum fine under Law 09-08?
The ceiling is 300,000 MAD, for processing sensitive data without express consent. For a legal entity the fine is doubled, to as much as 600,000 MAD, and it can double again for a repeat offence.
Can a company director be imprisoned for an offence under Law 09-08?
The law provides for prison terms of three months to one year for most offences, and three to six months for obstructing the CNDP. They are imposed by a court, either alone or together with a fine.
Can the CNDP impose a fine directly?
Criminal fines are imposed by the courts. The CNDP can investigate, issue formal notices, withdraw a receipt or an authorisation, and refer the case to the public prosecutor.
General information, not legal advice.
Report an errorReferences (3)
- CNDP — List of offences under Law No. 09-08 and the applicable penalties (cndp.ma, 2024).
- Law No. 09-08 on the protection of individuals with regard to the processing of personal data (Dahir No. 1-09-15 of 18 February 2009). (opens in a new tab)
- Maroc24 (24 May 2025). La CNDP intensifie ses contrôles et demande aux entreprises de se conformer avant fin mai.