Contents
Two laws, two eras
Law 09-08 dates from 2009. The GDPR was adopted in 2016 and has applied since 25 May 2018. In between, the logic changed: from upfront control through formalities to organisational accountability, where organisations must demonstrate their own compliance.
The comparison
| Point | Law 09-08 (Morocco) | GDPR (European Union) |
|---|---|---|
| Authority | CNDP | One authority per Member State, coordinated at European level |
| Logic | Prior formalities (notification, authorisation) | Accountability and internal documentation |
| Record of processing activities | Not required as such | Mandatory (Article 30), with exceptions |
| DPO | No general obligation | Mandatory in certain cases (Article 37) |
| Impact assessment | No general obligation | Mandatory for high-risk processing (Article 35) |
| Breach notification | No general regime | To the authority within 72 hours (Article 33), and to individuals where the risk is high (Article 34) |
| Individuals' rights | Information, access, rectification, objection | The same, plus erasure, restriction, portability and safeguards around automated decisions |
| Transfers | List of adequate countries, exceptions, CNDP authorisation | Adequacy decisions, standard contractual clauses, binding corporate rules |
| Penalties | Criminal: up to 300,000 MAD, doubled for legal entities, possible imprisonment | Administrative: up to 20 million euros or 4% of total worldwide annual turnover |
| Reach | Processing carried out in Morocco | Also organisations outside the EU that target or monitor people in the EU |
What the two laws have in common
- A specified, legitimate purpose for each processing activity.
- Data that is adequate, relevant and limited to what is necessary.
- A limited retention period.
- A legal basis: consent or another ground provided for in the text.
- Appropriate security measures and safeguards around processors.
- A stricter regime for sensitive data.
When a Moroccan company must apply both
A company established in Morocco is subject to the GDPR if it offers goods or services to people located in the European Union, or if it monitors their behaviour. This is common for call centres and BPOs, e-commerce businesses that deliver to Europe, tourism and software publishers. The company must then comply with both laws at once: CNDP formalities for processing carried out in Morocco, and GDPR requirements for people located in the EU.
In that case, the simplest approach is to align the organisation with whichever of the two is stricter on each point: record of processing activities, breach notification procedure, impact assessments, without forgetting the formalities specific to the CNDP.
Morocco's international framework
Morocco is a party to Council of Europe Convention 108, which entered into force for Morocco on 1 September 2019, and to its additional protocol on supervisory authorities and transborder data flows. This brings the Moroccan framework closer to European standards, without making it an equivalent of the GDPR.
Further reading
- 4 min read
- 4 min read
- 4 min read
Frequently asked questions
Is a GDPR-compliant company automatically compliant with Law 09-08?
No. The GDPR has no prior formalities, whereas Law 09-08 requires notifications and authorisations with the CNDP. A GDPR-compliant company has a solid foundation, but still has to complete those formalities.
Can a Moroccan company be penalised under the GDPR?
Yes, if it falls within the scope of the GDPR because it targets or monitors people located in the European Union. European authorities can then impose penalties, and its European clients can require contractual guarantees.
Does Law 09-08 require data breaches to be notified?
Law 09-08 has no general notification regime comparable to the GDPR's. A prompt, documented response remains essential, and incident reporting obligations may arise under other legislation, such as Law 05-20 on cybersecurity for the entities it covers.
General information, not legal advice.
Report an errorReferences (5)
- Law No. 09-08 on the protection of individuals with regard to the processing of personal data (Dahir No. 1-09-15 of 18 February 2009). (opens in a new tab)
- Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation, GDPR). (opens in a new tab)
- Council of Europe (2019). Morocco becomes the 55th State Party to Convention 108.
- CNDP — Deliberation No. 236-2015 setting the list of States providing adequate protection.
- CNDP — List of offences under Law No. 09-08 and the applicable penalties (cndp.ma, 2024).