Data Protection and Privacy Law in Morocco
By Zakaria Korte, Korte Law in association with Amereller
In short: Law No. 09-08 (Dahir No. 1-09-15 of 18 February 2009) governs the processing of personal data by a controller established in Morocco, or by a controller that uses means of processing located in Morocco. Before it starts, every processing operation must be declared to the CNDP or, in certain cases, authorised by it (art. 12). Processing without the required formality is punishable by a fine of MAD 10,000 to 100,000 (art. 52). Processing sensitive data without express consent is punishable by 3 months to 1 year of imprisonment and/or a fine of MAD 50,000 to 300,000 (art. 57). For a legal entity, the fines are doubled (art. 64). Law as at 19 October 2026.
A data-protection or CNDP question for your Morocco business? A partner replies within one business day →
What does Law 09-08 say?
Law 09-08 protects natural persons with regard to the processing of their personal data. It was promulgated by Dahir No. 1-09-15 of 18 February 2009 and published in Official Bulletin No. 5714 of 5 March 2009. It lays down principles, grants rights to individuals, subjects processing to formalities, creates the CNDP and provides for criminal penalties.
Article 1 first sets a general rule. Information technology is at the service of the citizen. It must not infringe human identity, rights, or collective or individual freedoms. Decree No. 2-09-165 of 21 May 2009 sets out how the law is applied. It deals in particular with the procedure before the CNDP. The law has 8 chapters and 67 articles.
What are the key definitions (art. 1)?
Personal data is any information, of whatever nature, relating to an identified or identifiable natural person, directly or indirectly (art. 1-1). The concept expressly covers sound and image.
| Concept | Content (art. 1 of Law 09-08) |
|---|---|
| Processing | Any operation, automated or not: collection, recording, storage, consultation, disclosure, interconnection, blocking, erasure or destruction (art. 1-2) |
| Sensitive data | Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or concerning health, including genetic data (art. 1-3) |
| Controller | The person who, alone or jointly with others, determines the purposes and means of the processing (art. 1-5) |
| Processor | The person who processes the data on behalf of the controller (art. 1-6) |
| Consent | A free, specific and informed expression of will (art. 1-9) |
Who does the law apply to (art. 2)?
The law applies to any controller established in Morocco. A controller that carries on an activity in Morocco through an installation is deemed to be established there, whatever the legal form of that installation (art. 2-2-a). A branch or a liaison office is such an installation. A Moroccan subsidiary is itself a controller established in Morocco.
The law also covers a controller not established in Morocco that uses means of processing located on Moroccan territory (art. 2-2-b). It does not apply to means used solely for transit through Moroccan territory or through the territory of a State whose legislation is recognised as equivalent. That controller must notify the CNDP of the identity of a representative based in Morocco, who takes its place (art. 2-3).
The law excludes several types of processing (art. 2-4). It excludes processing for purely personal or household purposes. It also excludes processing relating to national defence and to the internal or external security of the State. Processing for the prevention and punishment of crimes and offences follows the text that creates it, after an opinion of the CNDP. Data collected under a specific law are also excluded.
What principles apply to the data (art. 3)?
Data must be processed fairly and lawfully, for specified, explicit and legitimate purposes (art. 3-1). It must be adequate, relevant and not excessive. It must be accurate. It is kept for a limited period (art. 3-1-e). The CNDP may authorise longer retention for historical, statistical or scientific purposes (art. 3-2).
Article 3 is the basis for criminal prosecution. Collecting data by fraudulent, unfair or unlawful means, or processing it for another purpose, in breach of points a), b) and c) of article 3, is punishable by 3 months to 1 year of imprisonment and/or a fine of MAD 20,000 to 200,000 (art. 54). Retaining data in breach of point e) of article 3 carries the same penalties (art. 55).
Is consent always required (art. 4)?
No. The unambiguous consent of the data subject is the rule. Article 4 allows five exceptions:
- compliance with a legal obligation;
- performance of a contract to which the data subject is a party, or of pre-contractual measures taken at their request;
- protection of the vital interests of the data subject, if they are unable to give consent;
- performance of a task in the public interest or in the exercise of official authority;
- the legitimate interest of the controller or the recipient, provided that the interest or the fundamental rights and freedoms of the data subject are not disregarded.
Disclosure of the data to a third party also requires the prior consent of the data subject, except in the same cases (art. 4, para. 2). Processing without consent and outside these cases is punishable by 3 months to 1 year of imprisonment and/or a fine of MAD 20,000 to 200,000 (art. 56).
Sensitive data has its own regime (art. 21). Its processing must be authorised by law or, failing that, by the CNDP. The CNDP authorises it on the basis of the express consent of the data subject, or where the processing is essential to the legal or statutory functions of the controller. Other cases are provided for, such as the defence of a legal claim or data made public by the data subject (art. 21-3). Processing sensitive data without express consent is punishable under article 57.
What must individuals be told (art. 5)?
At the time of collection, the controller must inform the data subject expressly, precisely and unambiguously (art. 5). The information covers the identity of the controller and, where applicable, of its representative. It also covers the purposes of the processing. Where needed for fair processing, it states the recipients, whether replies are compulsory or optional, and the existence of the rights of access and rectification. The details of the CNDP's declaration receipt or authorisation must be stated (art. 5-1-d). In practice, the notices in forms and privacy policies need to be reviewed after each formality.
What rights do individuals have (art. 7 to 9)?
The data subject has a right of access (art. 7). They can obtain the updating, rectification, erasure or blocking of data that does not comply. The controller does so free of charge within ten clear days (art. 8). Finally, they have a right to object (art. 9).
An objection may be based on legitimate grounds. It is also possible free of charge and without giving reasons where the data is used for direct marketing, in particular commercial marketing. Refusing these rights is punishable by a fine of MAD 20,000 to 200,000 per offence (art. 53). Continuing processing despite a well-founded objection, or despite an objection to direct marketing, is punishable by 3 months to 1 year of imprisonment and/or a fine of MAD 20,000 to 200,000 (art. 59). The law provides for no right to data portability. It provides for no general right to restriction, only the blocking under article 8.
Can you send marketing by e-mail or SMS (art. 10)?
Not without prior consent. Article 10 prohibits direct marketing by automated calling machine, fax, e-mail or any means using a technology of the same nature, without the prior consent of the data subject. SMS falls, in our view, into this last category.
One exception applies to e-mail only. It requires that the contact details were obtained from the data subject in the course of a sale or the provision of services. The marketing must concern similar products or services supplied by the same company. The data subject must be able to object simply and free of charge, at the time of collection and then with each message.
On 3 August 2026, the CNDP published ten rules for electoral operations. It restates the ban on direct marketing without prior consent (art. 10). Electronic marketing despite an objection falls under article 59.
Declaration or authorisation: which CNDP formality (art. 12 et seq.)?
Unless a specific text provides otherwise, prior declaration is the rule (art. 12-2). Prior authorisation is required in the cases of article 12-1: sensitive data, use for other purposes, genetic data, offences and convictions, the national identity card number (art. 12-1-e) and interconnection of files.
| Step | Time limit | Text |
|---|---|---|
| Declaration receipt | 24 hours | Law 09-08, art. 19 |
| Decision to make the processing subject to authorisation | 8 days | Law 09-08, art. 20 |
| CNDP silence on an authorisation request | 2 months, extendable once by reasoned decision, after which authorisation is deemed granted | Decree 2-09-165, art. 28 |
| Transfer subject to CNDP authorisation (art. 44-3) | Authorisation procedure, so the same time limit | Decree 2-09-165, art. 48 |
The files and practical cases are covered in detail in our article “CNDP Filings in Practice: Declaration, Authorisation, Transfers and Employee Data”. On 28 November 2025, the CNDP adopted five model deliberations, published on cndp.ma. Two are templates for a simplified declaration: cookies (D-939-2025) and newsletters (D-940-2025). Three are templates for an authorisation request: patient monitoring (D-941-2025), video surveillance in healthcare facilities (D-942-2025) and access control to private business premises (D-943-2025). Video surveillance in the workplace follows Deliberation No. 350-2013 of 31 May 2013. Images are kept for three months at most.
What security and processor obligations apply (art. 23 to 25)?
The controller must implement appropriate technical and organisational measures. They protect the data against accidental or unlawful destruction, accidental loss, alteration, and unauthorised disclosure or access (art. 23-1). For sensitive and health data, article 24 imposes reinforced measures: control of entry to the premises, of data media, of access, and of the transmission and transport of the data.
If it uses a processor, the controller must choose one that provides sufficient guarantees (art. 23-2). A contract or legal act must bind the parties. It provides that the processor acts only on the instructions of the controller (art. 23-3 and 25). The elements of the contract relating to data protection are recorded in writing (art. 23-4).
Processing without these measures is punishable by 3 months to 1 year of imprisonment and/or a fine of MAD 20,000 to 200,000 (art. 58). Causing or facilitating, even through negligence, the misuse or fraudulent use of the data carries the same penalties (art. 61). The law provides for no general obligation to notify data breaches.
Can data be transferred abroad (art. 43 and 44)?
A transfer is permitted only to a State that ensures a sufficient level of protection (art. 43). That level is assessed in light of the law of the destination State, the security measures applied there, the characteristics of the processing, and the nature, origin and destination of the data.
Article 44 allows derogations. The first is the express consent of the data subject. A transfer is also permitted if it is necessary, in particular to protect the data subject's life, for an important public interest, for a legal claim or for a contract with the data subject. It is also permitted under a bilateral or multilateral agreement to which Morocco is a party. Finally, the CNDP may authorise it, expressly and with reasons, where the processing offers sufficient guarantees, in particular through contractual clauses or internal rules.
The list of adequate countries is set by Deliberation No. 465-2013 of 6 September 2013, as amended by Deliberation No. 236-2015 of 18 December 2015. It contains 32 States, including France, Switzerland, the United Kingdom and Canada. Not all EU States are on it: Croatia is missing. Even to these countries, the transfer must be notified to the CNDP under the appropriate regime. A transfer in breach of articles 43 and 44 is punishable by 3 months to 1 year of imprisonment and/or a fine of MAD 20,000 to 200,000 (art. 60).
What is the CNDP (art. 27 et seq.)?
The CNDP is the supervisory authority established under the Prime Minister, now the Head of Government, by article 27 of Law 09-08. It informs, advises, examines declarations and authorisation requests, and carries out documentary and on-site inspections (art. 28 to 30). It has seven members appointed by the King (art. 32). The president is appointed directly. The other six members are proposed, two each, by the Head of Government, the President of the House of Representatives and the President of the House of Councillors. The term is five years and can be renewed only once.
If a processing operation undermines security or public order, or is contrary to morality and good morals, the CNDP may withdraw the receipt or the authorisation without delay (art. 51). Article 51 creates no fine. It is the basis for an administrative measure, without prejudice to criminal penalties.
What are the exact criminal penalties (art. 51 to 66)?
Fines range from MAD 10,000 to 300,000. Most come with 3 months to 1 year of imprisonment. The court may impose both penalties or only one of them.
| Article | Offence | Fine (MAD) | Imprisonment |
|---|---|---|---|
| 51 | Processing contrary to security or public order, morality or good morals | Withdrawal of the receipt or authorisation by the CNDP | None |
| 52 | Processing without declaration or authorisation, or continued after their withdrawal | 10,000 to 100,000 | None |
| 53 | Refusal of the rights of access, rectification or objection | 20,000 to 200,000 per offence | None |
| 54 | Fraudulent or unfair collection, use for another purpose | 20,000 to 200,000 | 3 months to 1 year |
| 55 | Retention beyond the stated period | 20,000 to 200,000 | 3 months to 1 year |
| 56 | Processing without consent or another basis under article 4 | 20,000 to 200,000 | 3 months to 1 year |
| 57 | Sensitive data without express consent, data on offences and convictions | 50,000 to 300,000 | 3 months to 1 year |
| 58 | Lack of security measures (art. 23 and 24) | 20,000 to 200,000 | 3 months to 1 year |
| 59 | Processing despite objection, direct marketing (art. 9 and 10) | 20,000 to 200,000 | 3 months to 1 year |
| 60 | Unlawful transfer abroad | 20,000 to 200,000 | 3 months to 1 year |
| 61 | Misuse or fraudulent use of the data, even through negligence | 20,000 to 200,000 | 3 months to 1 year |
| 62 | Obstruction of CNDP inspections | 10,000 to 50,000 | 3 to 6 months |
| 63 | Refusal to apply CNDP decisions | 10,000 to 100,000 | 3 months to 1 year |
| 64 | Offence committed by a legal entity | Fines doubled | One penalty at the court's choice: partial confiscation of assets, confiscation (art. 89 of the Criminal Code) or closure of the establishment |
| 65 | Repeat offence | Penalties doubled | Penalties of the chapter doubled |
| 66 | Recording of offences | Report by sworn CNDP officers | Sent to the public prosecutor within 5 days |
For a legal entity, the maximum fine therefore reaches MAD 600,000, excluding repeat offences (art. 57 and 64). Directors who committed the offence themselves can also be punished (art. 64). The legal entity can also be given one of the three penalties of article 64. A repeat offence exists where a person already convicted by a final decision commits an offence of the same nature within the following year (art. 65). In case of misuse (art. 61), the court may also order the seizure of the equipment and the erasure of the data. Article 52 states that civil liability towards victims remains open.
What does Decree No. 2-09-165 of 21 May 2009 provide?
The decree organises the CNDP: appointment of members, operation, administration and control. It then sets the procedure for opinions, declarations and authorisations. It also deals with health and genetic data, the rights of individuals and transfers. Its most useful rule in practice concerns the CNDP's silence. An authorisation request left unanswered for 2 months, a period that can be extended once, is deemed granted (art. 28). A transfer that requires CNDP authorisation follows the same procedure (art. 48).
Law 09-08 and the GDPR: what are the differences?
The principles are close. The logic differs. Moroccan law controls before the processing. The GDPR rests on the responsibility of the controller (accountability).
| Point | Law 09-08 | GDPR |
|---|---|---|
| Prior formality | Declaration or authorisation (art. 12) | None, internal record |
| Breach notification | No general obligation | 72 hours |
| Portability, impact assessment (DPIA) | Absent | Provided for |
| DPO | Not provided for | Mandatory in certain cases |
| Penalties | Criminal, up to MAD 300,000, doubled for a legal entity | Administrative, up to EUR 20 million or 4 % of worldwide turnover |
| Transfers | Adequate countries or derogations under article 44, including CNDP authorisation | Adequacy, standard clauses, BCRs |
GDPR compliance is not enough in Morocco. Morocco has no adequacy decision from the European Commission.
Where does the reform of Law 09-08 stand in 2025-2026?
As at 19 October 2026, Law 09-08 and Decree No. 2-09-165 remain in force with no reform adopted. We have identified no government bill. A private member's bill from a parliamentary group, tabled in 2024 in the House of Representatives, concerned the status of the CNDP. It has not been passed to date.
| Status | Item |
|---|---|
| In force | Law 09-08, Decree 2-09-165, CNDP deliberations |
| CNDP practice (2025-2026) | Statement on AI of 18 March 2025, announcing a deliberation on AI processing; model deliberations of 28 November 2025; rules published on 3 August 2026 before the legislative elections |
| Under discussion, no text adopted | Alignment with the GDPR, more dissuasive penalties, ex post control |
What international companies underestimate
The formality comes first. Processing cannot start before the receipt or the authorisation (art. 14 and 19). Launching a CRM or an HR system “in the meantime” creates exposure under article 52.
The CIN number. An HR or customer file that contains the national identity card (CIN) number requires authorisation (art. 12-1-e), not a simple declaration.
Group tools. Hosting data in a cloud or a tool located outside Morocco, even in the EU, is a transfer. The CNDP requires a transfer formality as soon as data is hosted or transmitted abroad (art. 43 and 44).
Criminal liability. The penalties are criminal. The company faces doubled fines, and its directors can be punished if they committed the offence (art. 64). There is no negotiated administrative fine.
Updates. Using the data for a new purpose requires authorisation (art. 12-1-b). Any change to a declared processing operation must be reported to the CNDP without delay (art. 15).
Frequently Asked Questions
Is a Moroccan subsidiary covered by the group's GDPR programme compliant?
No. The GDPR imposes no prior formality, while Law 09-08 requires one for each processing operation (art. 12). The subsidiary must also deal with transfers to the group (art. 43 and 44).
Does a transfer of data from Morocco to France require any step?
Yes. France is on the CNDP's list of countries considered adequate, but the transfer must still be notified to it. A transfer in breach of articles 43 and 44 falls under article 60.
Can the managing director be prosecuted personally?
Yes, if they committed the offence themselves. Article 64 doubles the legal entity's fine without prejudice to the penalties applicable to its directors who committed the offence.
How long does the CNDP take to respond?
The declaration receipt is issued within 24 hours (art. 19). For an authorisation, silence for 2 months, a period that can be extended once, counts as approval (Decree 2-09-165, art. 28).
Must a data breach be notified to the CNDP?
The law does not require it in general. A breach may, however, reveal a security failure (art. 58) or an undeclared processing operation (art. 52). The incident should therefore be documented and an assessment made of whether to inform the CNDP.
Will a reform change the rules soon?
No amending text has been adopted as at 19 October 2026, and no government bill has been identified. Companies must comply with the current law.
For the filings themselves, from the choice between declaration and authorisation to transfers and employee data, see CNDP filings in practice.
Related Articles
- Intellectual Property Protection in Morocco
- Hiring Expatriates in Morocco: Work Permits and Payroll
- Company Formation in Morocco for Foreign Investors
- Fintech and Payment Institution Licensing in Morocco
- Mergers and Acquisitions in Morocco
A note on how this works in practice. Much of what decides the outcome sits below the statute, in the documents a particular registry expects and the order it expects them in, and that knowledge is held locally. Instructing Moroccan counsel at the outset is almost always less expensive than repairing a structure once it is in place.
Changes to the commercial register
Corporate work around the address
Working language