Call recording for businesses in Morocco: law 09-08, the CNDP and how to set it up

The short answer: in Morocco, recording business calls is possible, but it is processing of personal data under law 09-08, since the voice of an identifiable person is personal data. Before enabling recording, you must define what it is for, notify the processing to the CNDP, inform callers and employees at the start of the call, set a justified retention period and restrict access to the files. 3CX, Yeastar and Grandstream phone systems handle the technical side; the framework is your responsibility.

This guide summarises the published texts and how to translate them into a phone system. It is not legal advice: for a specific case, contact the CNDP or a legal adviser.

What law 09-08 says

Law 09-08 on the protection of individuals with regard to the processing of personal data defines personal data as any information about an identifiable person, whatever its medium, including sound and image. A call recording therefore falls within its scope, for the caller and for the employee who answers. We cover the whole law in Morocco’s data protection law 09-08.

Applied to recording, its principles give the following:

Principle of law 09-08	What it means for call recording
Specific, explicit and legitimate purpose (article 3)	Write down why you record: training, quality control, evidence of an order or commitment
Adequate, non-excessive data (article 3)	Record only the calls needed for that purpose, not everything by default
Retention limited to what is necessary (article 3)	Set a duration and delete automatically beyond it
Consent or cases provided by law (article 4)	Identify the basis for processing, and let callers object where possible
Prior information (article 5)	Announce recording at the start of the call and give access to full information
Notification to the CNDP (article 12)	Declare the processing, or request authorisation where required
Security and confidentiality	Restricted access, logging, protected backup, contracts with processors

Declaration or authorisation with the CNDP

The CNDP publishes a procedure for notifying processing on its website, updated in 2025. It distinguishes processing subject to prior declaration (standard declaration form) from processing subject to prior authorisation, under article 12 of the law. It also links some processing to sector-specific deliberations. We found no deliberation specific to call recording in general; however, processing by customer-relations employers in a remote-work setting falls under a specific deliberation (D-107-EUS-2020) and requires prior authorisation.

Two situations need particular care:

• Sensitive data, including health data: processing it requires authorisation. A clinic recording conversations about patients’ health falls into this case; see phone systems for clinics.
• Storage outside Morocco: recordings hosted in a foreign cloud or a phone system hosted abroad. This is a data transfer, governed by the law and subject to CNDP formalities.

The right form for your case can be checked on the CNDP website, or directly with the CNDP.

Informing callers and employees

The announcement at the start of the call

Information must come before recording. In practice, a short message in the greeting or queue is enough, for example: “For service quality and staff training, this call may be recorded. To learn about your rights, visit our website or ask your adviser.” The full information (company identity, purpose, recipients, rights of access, rectification and objection, CNDP receipt reference) is on your website or provided on request.

Also think about outbound calls: a salesperson calling a prospect must inform them at the start of the conversation, since no greeting does it for them.

Employees

Recorded employees must know which calls are recorded, why, who listens and how long files are kept. An internal memo or a clause in the internal rules, given to every new hire, is the minimum. Avoid using recordings for anything other than the stated purpose: a recording declared for training does not become an individual surveillance tool.

How long should recordings be kept?

Law 09-08 does not set a specific duration for phone recordings. It requires that data is not kept longer than needed for the purpose. In practice:

• Training and quality control: the time needed to listen, assess and train, then deletion.
• Evidence of a commitment (order, subscription): a duration tied to the period during which that evidence may be useful, to be justified.
• In every case: the duration is stated in the CNDP notification, applied automatically by the phone system, and checked with the CNDP when in doubt.

We deliberately give no typical duration: in the absence of a text, it is set case by case with the CNDP. Remember that the duration also applies to copies: archives on a remote server, backups and files downloaded to a workstation must be deleted at the same time as the original, or the retention rule is only respected on paper.

Setting it up on 3CX, Yeastar and Grandstream

The three phone systems we deploy cover the technical needs. Their documentation describes the following functions.

Function	3CX	Yeastar P-Series	Grandstream UCM
What can be recorded	User and queue calls, depending on configuration and edition	Extensions, trunks, queues, conferences, IVRs, paging and intercom	Extensions, queues, trunks, meeting rooms (“Auto Record”)
Announcement	Message in the greeting or queue	Custom prompt before recording, separate for internal, inbound and outbound calls	Recording prompt and indicator in the Wave app
Pause during sensitive data	To be checked per version	Pause and resume from phones and Linkus	To be checked per version
Storage	Local, then archive to FTP, SFTP, SMB, Google Cloud, Amazon S3 or SharePoint	Storage attached to the phone system	Local, USB, NAS or GDMS cloud storage, with priority order
Automatic deletion	Quota and deletion of temporary files after a set delay	Retention in days, storage threshold	Storage switchover and capacity alerts
Access control	Admin rights and recordings page	Management rights granted by the administrator; each user sees their own recordings	Admin rights

A few points are worth highlighting. Yeastar digitally signs each recording at the end of the call, so you can check it has not been altered: useful when the recording serves as evidence. 3CX advises against storing recordings in the software’s installation folders, which are removed on uninstall. With 3CX, recording also depends on the licence edition; see which 3CX licence to choose.

As a 3CX partner in Morocco and a Yeastar certified partner, we configure these functions according to the purpose you have defined, not the other way round.

Rights of the people recorded

Law 09-08 gives data subjects rights of access, rectification and objection. For call recording, this is very concrete: a customer may ask whether their calls were recorded, ask to hear them or obtain a copy, or object, on legitimate grounds, to their conversations being recorded.

Prepare the answer before the first request:

• A contact point stated in the information given to callers, an email address or a dedicated department.
• Easy search: finding the recordings of a number over a given period, from the phone system’s recordings page.
• Identity checks before sharing any recording.
• A no-recording option for callers who object, where the purpose allows: an IVR choice, or an instruction given to agents.

Transcription and automated analysis

Recent phone systems offer call transcription and AI-generated summaries; 3CX, for example, highlights them in its latest versions. A transcript is new personal data, often easier to search and copy than an audio file. It falls under the same framework: purpose, information, retention period, restricted access. If processing is handled by an external service, check where the data is processed and under which contract.

Protecting recordings

A recordings folder contains voices, names, sometimes order numbers or personal information. It deserves the same protection as a customer file:

• Named access limited to those who need it, with multi-factor authentication on the phone system admin where available.
• No bulk downloads to workstations or mailboxes.
• Encrypted backup, also subject to the retention period.
• A contract with the provider and the host, stating access, confidentiality and storage location.
• Hosting location decided upfront if the phone system is in the cloud; see cloud or on-premises phone system.

Mistakes we fix

1. Recording of all calls enabled by default, with no defined purpose.
2. No announcement, or a message placed after the call is connected.
3. Outbound calls recorded without informing the other party.
4. No retention period: years of recordings on the phone system.
5. Full storage, which stops recording without anyone noticing.
6. Shared admin access to listen to calls.
7. Processing never notified to the CNDP.

Checklist before enabling recording

• Purpose written down and recorded calls defined.
• CNDP notification made (declaration or authorisation as applicable).
• Announcement in place for inbound calls; instruction for outbound calls.
• Employees informed in writing.
• Retention period set and automatic deletion configured.
• Access restricted, named and protected.
• Storage location and backup validated.
• Procedure to answer a caller’s access request.

For customer service or a call centre, recording is part of a broader setup described in call queues, IVR and statistics and 3CX call centres in Morocco.

How we work

We start with a free audit of your telephony: calls concerned, purpose, current phone system, storage and access. We then configure recording, announcements, retention and permissions, and give you the technical description needed for your CNDP file. CNDP formalities remain yours, or your adviser’s. After go-live, the phone system is monitored 24/7, including recording storage.

Explore our IP telephony in Morocco offering, then request your free telephony audit: we reply within 24 business hours.