Contents
Sensitive data at scale
A bank or insurer holds several categories of data: identity and national identity card number, contact details, family and employment situation, income, assets, transaction history and, for life and health insurance, medical information. This data is subject at once to Law 09-08, to the professional secrecy laid down by banking regulation, and to the sector rules of Bank Al-Maghrib (Morocco's central bank) and the ACAPS (Morocco's insurance and social welfare supervisor).
Processing activities to map
| Processing | Likely legal basis | Point to watch |
|---|---|---|
| Account opening and know-your-customer | Legal obligation (anti-money laundering) | Collect only what regulation requires, with controlled retention |
| Credit management and scoring | Performance of the contract | No decision based solely on automated processing (Article 11) |
| Life and health insurance | Express consent for health data | Sensitive data: prior authorisation in principle, unless the Article 22 exception applies |
| Direct marketing | Consent for emails, text messages and automated calls (Article 10) | Free objection at any time (Article 9) |
| Bancassurance | Depends on the case | Inform the customer that their data is shared between bank and insurer |
| Call recording | Legitimate interest or legal obligation, depending on the use | Prior notice to the customer, retention period |
| Branch CCTV | Security | CNDP formality and visible signage |
Cloud and service providers
Banks are making growing use of the cloud and of technology providers. Two regimes overlap:
- Law 09-08: a written contract with each processor, and safeguards for transfers abroad (Articles 43 and 44). See transferring data abroad.
- Bank Al-Maghrib's directive of 19 May 2022 on outsourcing to the cloud, which notably requires prior approval for material outsourcing arrangements and audit rights.
Automated decisions
Refusing credit solely on the basis of an automated score, with no human intervention and no opportunity for the customer to put forward their point of view, runs up against Article 11 of Law 09-08. See AI in banking and insurance.
Customers' rights
Customers can request access to their data and its rectification (within ten days), and can object to direct marketing. A centralised procedure, known to branches and customer service alike, avoids inconsistent responses from one channel to another.
Practical checklist
- Processing activities listed, and notified to or authorised by the CNDP.
- Appropriate CNDP formality completed for processing of health data.
- Privacy notices up to date in contracts, in branches and online.
- Consent obtained for automated marketing.
- Service providers and cloud hosting listed, with contracts and transfers properly covered.
- Human review in place for adverse decisions based on a score.
Further reading
- 4 min read
- 5 min read
- 4 min read
- 5 min read
Frequently asked questions
Does Law 09-08 apply alongside banking secrecy?
The two regimes coexist. Professional secrecy prohibits disclosing customer information, and Law 09-08 additionally governs how that data is collected, used, retained and transferred.
Does an insurer need CNDP authorisation for health data?
In principle, yes: health data is sensitive, subject to prior authorisation and, as a rule, to express consent. Article 22 of Law 09-08 does provide for a simple notification in certain cases, notably selecting people eligible for a right, a benefit or a contract. The exact formality is checked processing activity by processing activity.
Can a bank send offers to its customers by text message or email?
Marketing by automated calling system, fax or email requires the individual's prior consent (Article 10 of Law 09-08), and the individual can also object to it free of charge at any time.
General information, not legal advice.
Report an errorReferences (6)
- Law No. 09-08 on the protection of individuals with regard to the processing of personal data (Dahir No. 1-09-15 of 18 February 2009). (opens in a new tab)
- CNDP — Formalities: prior notification and prior authorisation (cndp.ma). (opens in a new tab)
- CNDP — Transfer of data abroad and form F118 (cndp.ma). (opens in a new tab)
- Bank Al-Maghrib. Directive No. 4/W/2022 of 19 May 2022 setting the minimum rules for outsourcing to the cloud.
- Law No. 103-12 on credit institutions and similar bodies.
- CNDP — List of offences under Law No. 09-08 and the applicable penalties (cndp.ma, 2024).