Law 09-08, Law 05-20, the Bank Al-Maghrib directive: what the texts require, the criteria that separate offers, and a method for deciding batch by batch.
A Casablanca distribution company is replacing its ERP. The vendor offers a hosted edition in a cloud region in Paris. Three weeks after the quote is approved, the compliance officer asks whether payslips, customers’ bank details and contracts signed with a public body may leave the country. Nobody has the answer, and the project stalls for a legal review that would have taken a day at the outset. We see this scene in most of the migrations we support. Three questions settle almost everything: which data, under which regime, and how do you get out again. This is the grid we use.
Law 09-08 on the protection of individuals with regard to the processing of personal data has been the reference text since 2009. Article 43 sets the rule: a data controller may transfer personal data to a foreign state only if that state ensures a sufficient level of protection, and the CNDP draws up the list of those states. The list sits in deliberation no. 236-2015 of 18 December 2015. It names thirty-two countries: nearly all of the European Union, the United Kingdom, Switzerland, Norway, Iceland, Liechtenstein and Canada. The United States is absent.
Two consequences. Even towards a listed country, the transfer must be notified to the CNDP, and the notification procedure the Commission published in 2025 provides a dedicated form, the F-118. Towards an unlisted country, Article 44 opens only exceptions: the express consent of the individuals, contractual or judicial necessity, an international agreement, or an express and reasoned authorisation from the CNDP where contractual clauses or internal rules guarantee sufficient protection. A SaaS whose data, backups or support pass through the United States therefore falls under Article 44.
In April 2022 the CNDP announced with Microsoft an accelerated procedure for Moroccan Office 365 customers, while recalling that transfers abroad remain subject to prior authorisation and that a CNDP authorisation never replaces those the DGSSI or a sector regulator may require.
Law no. 05-20 on cybersecurity was enacted by dahir no. 1-20-69 of 25 July 2020. It covers first the “entities”, meaning state administrations, local authorities, public establishments and companies and any other legal person governed by public law, then the critical infrastructures, designated sector by sector after an opinion from the DGSSI. Article 11 fits in one sentence: sensitive data must be hosted exclusively on national territory. Article 14 extends the rule to critical infrastructures, and Article 49 punishes hosting sensitive data outside the territory with a fine of 200,000 to 400,000 dirhams.
Two clarifications. A private company that has not been designated a critical infrastructure is outside Article 11; Law 09-08 and its sector regulator continue to apply to it. And sensitive data is defined through the classification in decree no. 2-21-406 of 15 July 2021: each organisation concerned analyses the impact an incident would have on the confidentiality, availability or integrity of its assets, and systems rated class A or B are deemed sensitive.
Decree no. 2-24-921 of 22 October 2024, published in the Official Bulletin in February 2025, settles the cloud case. For its sensitive systems or data, an entity or critical infrastructure must use a provider qualified by the DGSSI. Level 1 covers hosting and operating sensitive systems and requires a company under Moroccan law whose infrastructure is installed on national territory. Level 2 covers processing and storing sensitive data and adds majority Moroccan ownership, storage and administration exclusively from Morocco, and operations staff of Moroccan nationality. The framework set by order no. 3-17-25 of 1 August 2025 spells out the rest: encryption in transit and at rest, keys known only to the customer at level 2, reversibility with documented formats or APIs, notice of any change of subcontractor, and an agreement governed by Moroccan law.
A transition is provided for. Where no equivalent qualified offer exists, an unqualified provider remains possible after a risk analysis covering localisation, reversibility and the supplier’s legal regime, with migration as soon as a qualified service becomes available. Organisations already in the cloud have twenty-four months from entry into force, which came with the publication of the order in August 2025. At the time of writing we found no published list of qualified providers.
For credit institutions, Bank Al-Maghrib issued directive no. 4/W/2022 of 19 May 2022 setting minimum rules for outsourcing to the cloud. It requires a data classification that defines, for each class, the eligible hosting locations. It makes any outsourcing of a significant function subject to the central bank’s prior approval, and requires a register of outsourced functions stating the hosting country and region, a tested exit strategy and notification to the CNDP of the processing concerned. Its risk analysis names judicial requisitions under foreign law and the provider’s ability to let the bank manage its own keys.
For insurance, we have not identified an ACAPS circular devoted to the cloud at the time of writing. Law 09-08 applies in full to policyholder data, and it is wise to consult the Authority before committing to a migration.
This is the only model that satisfies Article 11 of Law 05-20 without debate and avoids any transfer formality. inwi runs a Tier III certified centre at Technopolis Rabat, with ISO 27001 certification on its hosting services. Orange Maroc runs a Casablanca site certified Tier III Design and Constructed Facility. N+ONE Datacenters holds Uptime Institute Tier III certifications for its Nouaceur and Settat sites. Atlas Cloud Services in Benguerir has announced Tier III and Tier IV certifications. The weak point remains the depth of the managed services catalogue.
The nearest regions are in Spain and France: AWS (Aragon, Paris), Microsoft Azure (Madrid, Paris), Google Cloud (Madrid, Paris). Those countries are on the CNDP list, which reduces the formality to a notification. The model does, however, rule out the sensitive data of entities and critical infrastructures, and it exposes you to the extraterritorial laws of the provider’s home country. A variant appeared in April 2026: Oracle opened a public cloud region in Casablanca, hosted at N+ONE, with a second region announced in Settat. What remains to be checked, offer by offer, is whether it obtains DGSSI qualification.
A platform such as Jelastic, taken over by Virtuozzo in 2021, is installed at a Moroccan or European hosting provider and runs containerised applications. You choose the host, hence the jurisdiction, and you keep standard formats that make reversibility real. The model suits web and line-of-business applications built in-house, less so the packaged software that demands a specific infrastructure.
Almost every organisation ends up hybrid: sensitive data and core systems in Morocco, elastic workloads, test environments and office collaboration in a European region. Hybrid works when the flows between the two worlds are inventoried, encrypted and measured.
Five steps, before any tender.
An RTO negotiated in a meeting remains an intention until the first timed drill. What separates the plan from reality: restore arithmetic, backup immutability, forgotten dependencies, and the drill as the only admissible proof.
Read the articleCNDP declaration or authorisation, individual rights, transfers outside Morocco, how it meets the GDPR, penalties: a practical guide to Morocco’s law 09-08.
Read the articleWhy a Moroccan SME pursues ISO/IEC 27001, what the 2022 edition contains, the steps in order, realistic timelines and the mistakes that cost an audit.
Read the articleDescribe your situation in a few lines. We come back within one business day with an initial read and the questions that matter.
