Contents
Why health is a special case
Law 09-08 classifies health data, including genetic data, as sensitive data. Three consequences follow:
- A stricter formality with the CNDP. The principle is prior authorisation (Articles 12 and 21). Article 22 creates an exception: a simple notification is enough where the processing serves preventive medicine, diagnosis, the administration of care or the management of health services, and is carried out by a health professional bound by secrecy. Processing that falls outside this framework, such as a platform that reuses the data, reverts to the authorisation regime. Collecting the national identity card number also requires authorisation (Article 12).
- The patient's express consent is the rule for processing their data, except in the cases provided for by law.
- The penalties are the heaviest in the schedule: processing sensitive data without express consent is punishable by three months to one year's imprisonment and/or a fine of 50,000 to 300,000 MAD, doubled for a legal entity.
Who is affected
- medical and dental practices;
- clinics and care centres;
- medical laboratories and imaging centres;
- pharmacies that keep patient files;
- appointment booking and teleconsultation platforms;
- insurers and organisations that process medical information.
Processing activities to identify first
| Processing | Point to watch |
|---|---|
| Patient medical record | Notification (Article 22) or authorisation depending on the processing; access limited to authorised care staff |
| Online appointment booking | The provider is a processor: written contract, and hosting to be checked |
| Sending test results | Secure channel; never send results through an uncontrolled channel |
| Exchanges with patients on WhatsApp | Limit medical information, inform the patient, keep control of archiving |
| Management software hosted abroad | Transfer of sensitive data to be regularised |
| CCTV at the facility | Separate CNDP formality; avoid any camera in treatment areas |
Medical transfers
Article 44 of Law 09-08 allows a transfer to a country not on the CNDP's list where it is necessary for medical diagnosis, prevention or treatment, for example sending a file so that a patient can be treated abroad. This exception does not cover routine hosting of management software abroad, which must be regularised under the general rules on transfers.
A sector under close watch
The CNDP has launched a joint initiative with organisations representing the medical sector to monitor healthcare providers' compliance with Law 09-08. On 28 November 2025 it also published deliberation D-941-2025, which sets a standard model authorisation application for patient follow-up processing, and deliberation D-942-2025, on authorisation applications for CCTV in healthcare facilities. For a healthcare provider, compliance is also a matter of trust: a patient who doubts the confidentiality of their record will hesitate to share information that matters for their care.
Practical checklist
- Appropriate CNDP formality (notification or authorisation) completed for each processing of health data.
- Patients informed at reception and on forms.
- Access to records restricted by profile and logged.
- Written contract with every provider (software, hosting, online booking).
- Transfers abroad identified and regularised.
- Written rules for exchanges with patients via messaging apps.
To design a patient journey built around Law 09-08 from the outset, see the portals we build for health professions.
Further reading
- 5 min read
- 4 min read
- 4 min read
Frequently asked questions
Should a medical practice file a notification or apply for authorisation with the CNDP?
It depends. Health data in principle requires prior authorisation, but Article 22 of Law 09-08 provides for a simple notification for prevention, diagnosis, care or health-service management by a professional bound by secrecy. Collecting the CIN number or reusing the data requires authorisation. The CNDP published a model for patient follow-up (D-941-2025).
Can test results be sent by WhatsApp?
It is not advisable. Consumer messaging apps do not give the data controller the control over archiving, access and security that sensitive data requires. A patient portal or a secure channel is preferable.
Is medical software hosted abroad allowed?
It is possible, but it amounts to a transfer of sensitive data outside Morocco. It must be checked against the CNDP's list of adequate countries and, where necessary, authorised using form F118.
General information, not legal advice.
Report an errorReferences (4)
- Law No. 09-08 on the protection of individuals with regard to the processing of personal data (Dahir No. 1-09-15 of 18 February 2009). (opens in a new tab)
- CNDP — Formalities: prior notification and prior authorisation (cndp.ma). (opens in a new tab)
- CNDP — Transfer of data abroad and form F118 (cndp.ma). (opens in a new tab)
- CNDP — List of offences under Law No. 09-08 and the applicable penalties (cndp.ma, 2024).