Law 09-08 and the CNDP: what a Moroccan company actually has to do

On Monday, the integrator of the new HR system asks for the CNDP receipt number to put in the privacy notice on the employee portal. Nobody has it. The customer database moved to a CRM hosted in the United States, and the only filing anyone can find dates from a 2014 prize draw. A common scene, which becomes a problem the day a dismissed employee complains to the CNDP or a European client demands a GDPR annex. Here is what law 09-08 actually requires, and in what order to tackle it.

The text, the regulator and its reach

Law 09-08 on the protection of individuals with regard to the processing of personal data was enacted by dahir 1-09-15 of 18 February 2009 (Official Bulletin 5714 of 5 March 2009); its implementing decree, 2-09-165, dates from 21 May 2009. It applies to a controller established in Morocco and to one established elsewhere that uses equipment located in the country; the latter notifies the CNDP of a representative in Morocco (Article 2).

The National Commission for the Control of Personal Data Protection (CNDP), established by Article 27, has seven members appointed by the King for five years. It handles declarations and authorisations, sets the list of countries with sufficient protection, authorises transfers and receives complaints. Article 30 gives it powers of investigation, access to premises, and the power to order data to be blocked or erased and to prohibit processing.

Declaration or prior authorisation

Article 12 sets the rule. Prior authorisation from the CNDP is required in six cases: sensitive data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health and genetics), use of data for purposes other than those of collection, genetic data outside medical use, data on offences and convictions, data containing the national identity card number, and the interconnection of files with different purposes. Everything else falls under prior declaration. Since the national ID number sits in almost every HR file, the share of processing that needs only a declaration is smaller than people assume.

The declaration covers the items of Article 15 and is filed per purpose or set of related purposes (Article 14). The CNDP issues a receipt within 24 hours of filing, and processing may start on receipt (Article 19); it has eight days to move a declared operation into the authorisation regime if it sees a manifest danger (Article 20). For an authorisation, its website announces a two-month period, extendable once, counted from a complete file.

For routine processing, deliberations set standard declaration models: customer management (32-2015), online sales (508-AU-2014), workplace CCTV (350-2013), mail handling (D-113-2020) and, since November 2025, cookies (D-939-2025) and newsletters (D-940-2025). Forms F-214 (declaration), F-112 and F-113 (authorisation) are downloaded from cndp.ma.

Rights that turn into procedures

Chapter II grants four rights. Information at collection (Article 5): the controller’s identity, purposes, recipients, whether answers are mandatory or optional, access and rectification rights. Access (Article 7): confirmation that processing exists and a copy of the data. Rectification (Article 8): free of charge, within ten clear days, failing which the person may take the matter to the CNDP. Objection (Article 9): on legitimate grounds, and without condition or charge where marketing is concerned.

Article 10 targets marketing: prospecting by automated calling systems, fax or email is prohibited without prior consent, except towards existing customers, for similar products, with a simple and free way to refuse in every message. Article 11 prohibits any decision with legal effects from resting solely on automated processing that assesses personality (scoring, automated CV screening).

Moving data outside Morocco, cloud included

Article 43 prohibits transfers to a State that does not ensure a sufficient level of protection and tasks the CNDP with drawing up the list. It comes from deliberation 465-2013, as amended by deliberation 236-2015 of 18 December 2015, and holds thirty-two States: twenty-six of the current twenty-seven EU Member States (Croatia is missing), the United Kingdom, Iceland, Liechtenstein, Norway, Switzerland and Canada. The United States is absent. Check the version in force on cndp.ma before any filing.

For a country outside the list, Article 44 opens four routes: the person’s express consent; a necessity from a closed list, including performance of a contract with the person; an international agreement binding Morocco; or a reasoned CNDP authorisation based on contractual clauses or binding corporate rules. The request is filed on form F-118 and presupposes that the underlying processing has already been declared or authorised.

Hosting payroll, the CRM or email with a provider whose servers sit outside Morocco is a transfer; support access from abroad is one too. Even towards a listed country, the 2015 deliberation reminds controllers that the transfer must be notified to the CNDP, and Article 15 requires it to appear in the declaration. Hence three habits: a hosting region in a listed country, the provider’s list of sub-processors with their countries, the basis for the transfer documented before signing.

When the GDPR stacks on top of law 09-08

A contact centre serving French subscribers or a SaaS vendor selling to Spanish SMEs falls under both regimes. The GDPR applies directly (Article 3) to a company established outside the Union that offers goods or services to people there or monitors their behaviour; Article 27 then requires a representative in the Union, unless the processing is occasional and low-risk. The processor of a European client is also bound by the Article 28 contract. Since Morocco is absent from the European Commission’s adequacy list, data coming from the Union rests on appropriate safeguards, in practice the Commission’s standard contractual clauses (Decision 2021/914).

Law 09-08 requires prior formalities, a receipt number on collection media and CNDP authorisation for certain transfers; the GDPR asks for none of these. The GDPR requires a record of processing (Article 30), breach notification within 72 hours (Article 33), an impact assessment for high-risk processing (Article 35) and sometimes a data protection officer (Article 37); law 09-08 provides for none of those tools, although the CNDP does encourage impact assessments (deliberation D-188-2020).

Penalties on the books, reform under discussion

Chapter VII provides for criminal penalties. A file operated without the required declaration or authorisation: a fine of 10,000 to 100,000 dirhams (Article 52). Refusal of access, rectification or objection rights: 20,000 to 200,000 dirhams per offence (Article 53). Misuse of purpose, excessive retention, processing without a legal basis, failure to secure data (Articles 23 and 24) or an irregular transfer abroad: three months to one year of imprisonment and 20,000 to 200,000 dirhams, or one of the two (Articles 54 to 56 and 58 to 60). Sensitive data processed without express consent: 50,000 to 300,000 dirhams (Article 57).

Article 61 targets the controller, the processor and anyone entrusted with the processing who, even through negligence, facilitates misuse or discloses data to unauthorised third parties. Article 64 doubles fines for legal entities, without prejudice to the penalties against their executives, and allows the establishment to be closed; repeat offences double them again (Article 65). The CNDP may also withdraw a receipt or authorisation (Article 51) and order data to be blocked or erased (Article 30).

The CNDP’s president listed the updating of law 09-08 among the Commission’s priorities in a January 2025 interview relayed by the General Secretariat of the Government’s legal watch, and commentators expect a text closer to the GDPR: accountability, impact assessments, a processing record, administrative fines. As far as we know, no such bill had been published by the General Secretariat of the Government at the time of writing; the 2009 text remains the applicable law.

Where to start

1. 1Map processing by purpose: payroll, recruitment, customers, CCTV, website. For each one, record the data, whether the national ID number or health data is present, the subcontractors, the hosting country and the retention period.
2. 2Keep that map as a record of processing. Law 09-08 does not require one; it nevertheless covers the fields of Article 15 and of the GDPR record, and becomes the central exhibit in any inspection.
3. 3Qualify each operation (declaration, authorisation, transfer), file forms F-214, F-112 or F-113 and F-118 using the standard declaration models, then log the receipt numbers.
4. 4Update privacy notices, forms, employment contracts, terms and conditions and CCTV signage from the CNDP’s model notices, receipt number included.
5. 5Re-read subcontracting contracts against Article 23: processing on instruction, security measures, onward subcontracting subject to approval, destruction at the end of the contract. The CNDP offers a model clause.
6. 6Organise the handling of rights and of marketing: one channel, a response template, a dated log, and consent or an existing customer relationship behind every electronic campaign.
7. 7Document the security measures of Articles 23 and 24, appoint an owner for the system and notify every change to the CNDP without delay: processing that was never declared is easier to regularise before a complaint than after one.