CNDP Compliance: The 8-Step Method

Step 1: list your processing activities#

List every use of personal data in the organisation. The most common processing activities are:

• personnel and payroll management;
• customer and prospect management (CRM, invoicing, customer service);
• CCTV on the premises;
• website forms and analytics tools;
• building access control;
• customer exchanges on WhatsApp or by email.

For each processing activity, record its purpose, the categories of data, the individuals concerned, the recipients, the retention period and the service providers involved. This inventory is not a form required by law, but without it none of the following steps is reliable.

Step 2: determine the formality for each processing activity#

The law provides for two regimes:

• Prior notification, for most processing. The receipt issued by the CNDP allows the processing to begin.
• Prior authorisation, for the most sensitive processing. According to the CNDP, this covers in particular: sensitive data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, including genetic data), the use of data for purposes other than those for which it was originally collected, data relating to offences and convictions, certain processing that uses the national identity card number, and the interconnection of files serving different purposes.

If in doubt about how to classify a processing activity, the CNDP's "Formalities" page remains the reference.

Step 3: check purpose, legal basis and proportionality#

For each processing activity, ask three questions:

• Why is this data being collected? The purpose must be precise.
• On what basis? Consent, or one of the exceptions in Article 4 (contract, legal obligation, legitimate interest, and so on).
• Is all of it necessary? Remove form fields that serve no purpose and set a retention period.

Step 4: file the formalities with the CNDP#

File your notifications and authorisation applications using the forms provided by the CNDP. Keep the receipts and authorisations you obtain: they are your first evidence of compliance in the event of an inspection.

Step 5: inform individuals#

Article 5 requires each individual to be informed at the point of collection: the controller's identity, the purposes, the recipients, whether answers are mandatory or optional, and the rights available to them. In practice:

• a privacy notice beneath every form on the website;
• an accessible privacy policy;
• a clause in employment contracts and customer contracts;
• a visible sign informing people who are filmed that CCTV is in operation and of their rights.

Step 6: secure the data and manage processors#

Articles 23 and 24 require appropriate technical and organisational measures: access management, strong passwords, backups, logging, staff awareness. Every service provider that processes data on your behalf must be bound by a written contract requiring it to follow your instructions and to keep the data secure.

Step 7: regularise transfers abroad#

Online software hosted outside Morocco, a parent company that receives HR data, a foreign email marketing tool: all of these involve a transfer. Check whether the destination country appears on the CNDP's list or whether an exception applies. Otherwise, an authorisation is required (form F118). See our guide to transferring data abroad.

Step 8: organise how you handle rights requests#

Designate a contact address, a responsible person and an internal procedure for handling requests for access, rectification and objection. For rectification, the law sets a ten-day deadline.

What comes next#

Compliance is not a one-off project. Every new processing activity (a new application, a new service provider, a new marketing campaign) must go through these steps again before it begins. The CNDP stepped up its inspections in 2025: organisations that have documented their approach are in a far more comfortable position. See also the penalties under Law 09-08.

Practical checklist#

• Inventory of processing activities completed and kept up to date.
• Formality (notification or authorisation) identified and filed for each processing activity.
• Privacy notices in place at every collection point.
• Contracts signed with all processors.
• Transfers abroad identified and regularised.
• Procedure in place for responding to rights requests.