Skip to content

Data protection

Part of: Data & AI

Personal Data Protection in Morocco: A Guide to Law 09-08

By KaperX Editorial Team5 min read

Contents

What Law 09-08 covers

The law applies to any information relating to an identified or identifiable individual: name, phone number, email address, customer number, CCTV image, purchase history. It covers any "processing", meaning any operation performed on that data: collection, recording, consultation, transmission, storage or deletion.

Two parties sit at the centre of the framework:

  • The data controller: the organisation that decides why and how the data is processed. The obligations rest with the controller.
  • The processor: the service provider that processes the data on the controller's behalf (hosting provider, software vendor, call centre). It must offer sufficient guarantees and be bound by a written contract.

Some processing falls outside the scope of the law, notably processing carried out for purely personal or household purposes, or for national defence and state security.

The six core obligations

  1. A specified purpose and proportionate data (Article 3). Collect only what is needed for a precise objective, and keep the data only for as long as it is useful.
  2. A legal basis (Article 4). The individual's consent, or one of the exceptions provided for: legal obligation, performance of a contract, protection of vital interests, a task carried out in the public interest, or legitimate interest.
  3. Informing individuals (Article 5). The controller's identity, the purposes, the recipients and the individual's rights must be communicated at the point of collection.
  4. Formalities with the CNDP (Article 12). A prior notification for most processing, and a prior authorisation for the most sensitive.
  5. Security and confidentiality (Articles 23 and 24). Appropriate technical and organisational measures, and a written contract with every processor.
  6. Safeguards for transfers abroad (Articles 43 and 44). A transfer is only possible to a country offering adequate protection, or in the exceptional cases provided for.

Individuals' rights

  • Right of access (Article 7): to know whether one's data is being processed and to obtain an intelligible copy of it.
  • Right to rectification (Article 8): to have inaccurate data corrected or erased. The controller has ten days to make the requested corrections.
  • Right to object (Article 9): to object to processing on legitimate grounds, and to object to direct marketing free of charge.
  • Protection against automated marketing (Article 10): marketing by automated calling system, fax or email requires the individual's prior consent.

What has changed in recent years

  • Morocco has been a party to Council of Europe Convention 108 since 1 September 2019, which anchors Law 09-08 in an international framework.
  • The CNDP has moved to an enforcement footing. In 2025 it sent letters to non-compliant businesses, set a deadline of the end of May for them to regularise their situation, and reminded them of the penalties for persistent failure to comply.
  • Support is available. The CNDP's DATA-TIKA programme allows public and private organisations to receive support with their compliance work under a formal agreement.

Compliance as a matter of customer trust

A customer who sees that their data is handled rigorously is more willing to extend trust. Conversely, a data leak or unsolicited marketing damages the relationship for the long term. Data protection is therefore not only a legal obligation: it is a component of customer experience (CX).

Pages in this domain

  • CNDP Compliance: The 8-Step Method

    Compliance with Law 09-08 on personal data protection follows eight steps: list your data processing activities, determine the formality each one requires, check its purpose and legal basis, file the notifications or authorisation applications with the CNDP (Morocco's data protection authority), inform individuals, secure the data and put safeguards around processors, regularise transfers abroad, and then organise how you handle requests from individuals exercising their rights.

    5 min read

  • Transferring Personal Data Abroad: The CNDP Rules

    In Morocco, personal data may only be transferred abroad to a country on the list of States providing adequate protection set by the CNDP (Morocco's data protection authority) in deliberation No. 236-2015, or in one of the exceptional cases set out in Article 44 of Law 09-08 on personal data protection. Outside those cases, the transfer requires authorisation from the CNDP, applied for using form F118.

    4 min read

  • Privacy by Design: The Principle Explained and Applied in Morocco

    Privacy by Design means building data protection into a product, website or process from the design stage, rather than adding it afterwards. Formalised by Ann Cavoukian as seven principles, it became an obligation in the European Union through Article 25 of the GDPR. Law 09-08 on personal data protection does not use the term, but its proportionality and security requirements lead to the same approach.

    4 min read

  • CNDP Fines and Penalties: The Law 09-08 Schedule

    Law 09-08 on personal data protection provides for criminal penalties ranging from 10,000 to 300,000 MAD in fines depending on the offence, with prison terms of three months to one year for most breaches. Fines are doubled for legal entities (Article 64) and for repeat offences (Article 65). The CNDP (Morocco's data protection authority) can also withdraw a receipt or an authorisation.

    4 min read

  • The Data Protection Officer in Morocco: Role and Obligations

    Law 09-08 on personal data protection does not require the appointment of a data protection officer (DPO). A Moroccan company may nevertheless be required to appoint one under the GDPR if it targets people located in the European Union and meets the criteria in Article 37. In every case, designating a person responsible for data protection is good practice, and in 2025 the CNDP (Morocco's data protection authority) asked companies to clearly designate who is responsible internally.

    4 min read

  • Law 09-08 vs GDPR: A Point-by-Point Comparison

    Law 09-08 on personal data protection and the GDPR share the same core principles (purpose limitation, proportionality, security, individuals' rights), but their underlying logic differs profoundly. Moroccan law relies on prior formalities with the CNDP (Morocco's data protection authority) and criminal penalties. The GDPR relies on organisational accountability, internal documentation and administrative fines of up to 4% of worldwide turnover.

    4 min read

  • Health Data in Morocco: CNDP Obligations for Healthcare Providers

    Health data is sensitive data within the meaning of Article 1 of Law 09-08 on personal data protection. In principle, processing it requires prior authorisation from the CNDP (Morocco's data protection authority). Article 22, however, provides for a simple notification where the processing serves prevention, diagnosis, care or the management of health services and is carried out by a professional bound by secrecy. In every case, clinics, practices, laboratories and platforms must complete the correct formality, inform patients and strictly secure access to records.

    4 min read

  • Data Protection in Banking and Insurance in Morocco

    Banks and insurers process some of the most sensitive data there is: identity, income, transactions and, in insurance, health. Law 09-08 on personal data protection applies in full, on top of professional secrecy and know-your-customer obligations. The points to watch are health data, which in principle requires authorisation from the CNDP (Morocco's data protection authority), transfers to the cloud, direct marketing, automated decisions and data sharing between bank and insurer.

    4 min read

Guides by situation

Our other domains

Further reading

Frequently asked questions

Which businesses does Law 09-08 apply to?

Any organisation, whatever its size, that processes personal data relating to individuals in Morocco: customer files, personnel records, CCTV, website forms. Only a few types of processing are excluded, such as those carried out for strictly personal or household purposes.

Is Law 09-08 Morocco's equivalent of the GDPR?

It shares several principles with the GDPR (purpose limitation, proportionality, individuals' rights), but it relies on prior formalities with the CNDP, contains no general obligation to appoint a DPO or to notify breaches, and its penalties are criminal. See our detailed comparison.

What does a non-compliant business risk?

Fines ranging from 10,000 to 300,000 MAD depending on the offence, prison sentences for most offences, and doubled fines for legal entities. The CNDP can also withdraw a receipt or an authorisation.

This guide is for information only and does not constitute legal advice.

Share

Share on LinkedIn (opens in a new tab)Share on WhatsApp (opens in a new tab)

References (7)