The Data Protection Officer in Morocco: Role and Obligations

What Moroccan law provides#

Law 09-08 contains no general obligation to appoint a DPO. The obligations rest with the data controller, meaning the organisation itself and its management.

In practice, an organisation with nobody in charge of the subject struggles to keep its formalities up to date, to respond to rights requests on time, or to react when an inspection comes. During its 2025 campaign, the CNDP in fact asked companies to clearly designate who is responsible internally.

When the GDPR applies to a Moroccan company#

The GDPR applies beyond the European Union when an organisation:

• offers goods or services to people located in the European Union (a website targeting those customers, distance selling);
• or monitors the behaviour of those people (profiling, advertising tracking).

This is often the case for call centres and BPOs that process data on European customers, e-commerce platforms that deliver to Europe, and tourism businesses. In that situation, Article 37 of the GDPR requires a DPO if the core activities consist of regular and systematic monitoring on a large scale, or large-scale processing of sensitive data. Article 27 also requires, subject to exceptions, the appointment of a representative in the Union.

A DPO's tasks#

Drawing on the GDPR, the role involves four tasks:

1. Informing and advising management and staff on their obligations.
2. Monitoring compliance with internal rules and with the law.
3. Cooperating with the supervisory authority and acting as its point of contact.
4. Acting as the point of contact for individuals exercising their rights.

The right profile#

An effective DPO combines legal, technical and organisational skills. The DPO must also be independent: they cannot monitor decisions they take themselves. European guidelines therefore consider that a chief executive, an IT director or a marketing director will generally face a conflict of interest.

Internal or external DPO?#

Recommendation for a Moroccan company#

• With no GDPR exposure: at a minimum, designate an internal data protection lead with dedicated time, a written mandate and direct access to management.
• With GDPR exposure: check whether the Article 37 criteria apply. If in doubt, voluntarily appointing a DPO remains the safest position.