Transferring Personal Data Abroad: The CNDP Rules

What counts as a transfer abroad?#

A transfer takes place as soon as personal data collected in Morocco is communicated, made accessible or hosted outside the country. The most common situations:

• a CRM, payroll software or customer support tool hosted abroad;
• an email marketing or messaging service whose servers are outside Morocco;
• a foreign parent company or subsidiary that receives personnel or customer data;
• a foreign service provider that accesses the data remotely, for example for maintenance.

The principle: a country offering adequate protection#

Article 43 of Law 09-08 restricts transfers to States that ensure a sufficient level of protection. The CNDP has published the list of those States in its deliberation No. 236-2015. If the destination country is on the list, the transfer is possible, provided the original processing has itself been notified or authorised.

The Article 44 exceptions#

A transfer to a country not on the list remains possible in the following cases:

• the data subject has expressly consented to the transfer;
• the transfer is necessary to protect the individual's life;
• it is necessary to safeguard the public interest;
• it is necessary for the establishment, exercise or defence of legal claims;
• it is necessary for the performance of a contract concluded with the individual, or concluded in their interest with a third party;
• it falls under international judicial cooperation;
• it is necessary for medical diagnosis, prevention or treatment;
• it results from an international agreement to which Morocco is a party.

CNDP authorisation and form F118#

If none of these cases applies, the CNDP may authorise the transfer where sufficient safeguards are provided, for example through contractual clauses or internal company rules. The application is made using form F118.

Two practical points:

• Transfer authorisation is only granted if the original processing has already been notified or authorised. A transfer never regularises processing that is not itself in order.
• The CNDP gives its opinion within two months, which can be extended once. This period only starts once the file is complete.

Choosing the right mechanism#

This table suggests lines of analysis, not a definitive legal assessment of your situation.

The risks of an unlawful transfer#

According to the official list of offences published by the CNDP, a transfer in breach of Articles 43 and 44 is punishable by three months to one year's imprisonment and/or a fine of 20,000 to 200,000 MAD. For a legal entity, the fine is doubled. See the full penalty details.

A special case: systems of vital importance#

For entities and infrastructure of vital importance (major banks, telecoms operators, certain public infrastructure), Law 05-20 on cybersecurity and its implementing texts add requirements to host sensitive systems and data within Morocco. These rules apply on top of Law 09-08; they do not replace it.