Moroccan Processor for a European Client: Contract, Standard Clauses and Transfer Assessment

The starting point: no adequacy for Morocco#

The GDPR in principle prohibits transferring personal data outside the European Economic Area, except to a country recognised as adequate (Article 45) or with appropriate safeguards such as standard contractual clauses or binding corporate rules (Article 46). The derogations in Article 49 are reserved for exceptional situations and are not suitable for an ongoing service.

Morocco is not among the adequate countries. For a Moroccan contact centre, technical platform or IT service provider, this means three workstreams: the processing agreement, the standard clauses and the transfer impact assessment. The substantive differences between the two regimes are set out in our comparison of Law 09-08 and the GDPR.

The Article 28 contract: what it must contain#

GDPR Article 28(3) requires a contract that sets out the subject matter, duration, nature and purpose of the processing, the types of data, the categories of data subjects and the rights of the controller. It must also impose the following obligations on the processor.

For a contract between two entities located in the European Economic Area, the Commission has published separate standard clauses for controller–processor relationships (Decision 2021/915). For a transfer to Morocco, the clauses in Decision 2021/914 already contain these Article 28 requirements.

Module 2 or module 3: choosing the right standard clauses#

Commission Implementing Decision (EU) 2021/914 of 4 June 2021 offers four modules. The choice depends on each party's position in the chain.

Sending results back from the Moroccan centre to the European client is not a transfer out of the EU under the GDPR: it is covered by the module 2 or 3 clauses already signed. On the Moroccan side, it remains a transfer abroad under Law 09-08 (Articles 43 and 44); France and the other Member States appear on the CNDP's list of adequate countries.

A common mistake: signing module 2 with a European BPO that is only a processor. The actual arrangement determines the module, and Annex I of the clauses must describe precisely the categories of data, the purposes and the retention period.

The transfer impact assessment in six steps#

Recommendations 01/2020 of the European Data Protection Board (version 2.0 of 18 June 2021) propose a six-step approach to the exporter, for carrying out the assessment that clause 14 of the standard clauses makes mandatory. The CNIL (France's data protection authority) has published a practical guide to transfer impact assessments (TIA, "AITD" in French), with a spreadsheet template, that follows the same logic.

1. Know your transfers: which data, to which site, what remote access, which sub-processors.
2. Identify the transfer tool: here, the standard clauses.
3. Assess the law and practice of the third country: for Morocco, Law 09-08, the role of the CNDP (Morocco's data protection authority), Morocco's accession to Convention 108 and its additional protocol, in force for Morocco since 1 September 2019, and Parliament's adoption, on 2 February 2022, of the bill approving the protocol known as Convention 108+. The possibilities for public authorities to access the data must also be analysed.
4. Adopt supplementary measures if necessary: encryption, pseudonymisation, access restriction, logging.
5. Complete the formalities linked to the chosen tool.
6. Reassess at regular intervals and whenever the arrangement changes.

The European exporter owns the assessment, but it cannot carry it out without the service provider.

The evidence file the Moroccan service provider prepares#

A centre that presents these items from the tender stage onwards shortens negotiations and answering the compliance questionnaire:

• a map of data flows per client: data received, systems, hosting locations, access;
• the register of sub-processors, with their location and safeguards;
• a description of the technical and organisational security measures;
• the incident management procedure and the notification deadline to the client;
• the procedure for the exercise of rights and for deletion at the end of the contract;
• a factual note on the Moroccan framework: Law 09-08, CNDP formalities completed, Convention 108;
• the CNDP receipts or authorisations for the processing concerned;
• staff training certificates and confidentiality undertakings.

This file is as much a commercial tool as a legal one: it shows the client that it can defend its choice before its supervisory authority.

Sub-processors and transfers out of Morocco#

Article 28(2) prohibits engaging another processor without the controller's prior written authorisation, and Article 28(4) requires the same obligations to be passed down. In a centre, sub-processors are numerous: cloud telephony, CRM, transcription tool, backup host, chatbot vendor.

Moroccan rules come on top. When the centre transfers data from Morocco to another country, Law 09-08 applies: transfer permitted to a State on the CNDP's list (Article 43), subject to the applicable formalities, otherwise a derogation or CNDP authorisation based on contractual safeguards (Article 44). A tool hosted in a country not on the list therefore requires two checks: the European client's agreement and the CNDP regime. Details are in our guide to transferring data abroad.

Sending data back to the European client is a transfer to a country on the CNDP's list, which includes Member States such as France. The formalities for declaring or obtaining authorisation for the processing with the CNDP must nonetheless still be completed; the applicable procedure should be confirmed with the CNDP for each arrangement.

Checklist before signing#

1. Classify the arrangement: client as controller or processor, and choose module 2 or 3.
2. Check that the contract covers the eight points of Article 28(3).
3. Complete the annex to the standard clauses with the actual data, purposes and retention periods.
4. Draw up the list of sub-processors and obtain the client's agreement.
5. Provide the client with the factual elements for its transfer impact assessment.
6. Check CNDP formalities for the processing and for any transfer out of Morocco.
7. Set incident notification deadlines and the end-of-contract procedure.
8. Schedule an annual review and a review whenever a tool changes.