GDPR and Moroccan companies: when it applies and what to do if you work with Europe

The short answer: the GDPR does not apply to a Moroccan company simply because it holds data about European citizens. It applies directly in three cases: the company has an establishment in the European Union, it offers goods or services to people located there, or it monitors their behaviour in the Union. If you are a supplier to a European client, you are bound mainly by contract. And in every case, Morocco’s Law 09-08 still applies: one does not replace the other.

This guide draws on the text of the GDPR, Guidelines 3/2018 of the European Data Protection Board (EDPB), the European Commission’s publications on adequacy and standard contractual clauses, and the text of Law 09-08. It helps you place your company and prepare the technical side. It is not legal advice: to assess a specific case, a lawyer or a data protection officer remains the reference.

Which situation are you in?

Article 3 of the GDPR targets processing activities, not companies as a whole. The same company can be subject to the GDPR for one activity and not for another. These are the most common cases:

Your situation	Example	Does the GDPR apply?	What it means
Establishment in the EU	Subsidiary or branch in France	Yes, Article 3(1), for that establishment’s activities	Full compliance
Offer aimed at people in the EU	Online shop delivering to Europe, travel sold to European customers	Yes, Article 3(2)(a)	Full compliance and representative
Monitoring behaviour in the EU	Targeted advertising, tracking cookies, geolocation for marketing	Yes, Article 3(2)(b)	Full compliance and representative
Supplier to a controller established in the EU	Support, payroll, development, contact centre	Not merely because of this service	Article 28 contract and transfer clauses
Supplier to a non-EU controller targeting Europe	Prospecting European customers for a non-European company	Yes, Article 3(2), according to the EDPB	Processor obligations and representative
Employees on assignment in Europe	Reimbursing travel expenses	No, as an offer of services, according to the EDPB	Law 09-08
European customer living in Morocco, local business	Bank or clinic with no offer towards Europe	No, without an offer or monitoring aimed at the EU	Law 09-08

That last case corrects a common belief. The EDPB states that processing the data of EU citizens or residents in a third country does not trigger the GDPR if the processing relates neither to an offer directed at people in the Union nor to monitoring their behaviour in the Union. What matters is where the person is at the time of the offer or monitoring, not their nationality.

How to tell whether you are “targeting” Europe

Having a website that can be viewed from Paris or Madrid is not enough. Recital 23 of the GDPR rules out mere website accessibility, an email address, or the use of a language generally used in the company’s own country. On our reading, French alone, commonly used in Morocco, does not therefore prove targeting.

The EDPB does, however, list factors that, taken together, show an intention to address the Union:

• one or more EU countries named in connection with the offer;
• delivery offered to EU countries;
• payment in euros, or a language other than the one generally used in your country;
• advertising campaigns or paid search aimed at a European audience;
• a .fr, .de or .eu domain name, or a dedicated phone number for reaching the company from the Union;
• prominently displayed European customers, with reviews or references.

Run this test on your pages and campaigns: if several of these factors are present, assume the GDPR applies to that activity and have your adviser confirm the analysis.

If the GDPR applies to you directly

Obligation	Article	What it means in practice
Legal basis and information	5, 6, 12 to 14	Justify each processing activity, keep a privacy policy up to date
Data subject rights	15 to 22	A procedure for access, erasure and objection requests
Representative in the Union	27	Written mandate to a representative established in a relevant Member State
Records of processing	30	The exemption below 250 employees is very narrow: it falls away if processing is not occasional
Processor contracts	28	Mandatory clauses with each supplier and cloud vendor
Security	32	Risk-appropriate measures, tested regularly
Personal data breaches	33 and 34	Authority notified within 72 hours where feasible, individuals informed if the risk is high
Impact assessment and DPO	35, 37 to 39	Depending on the nature and scale of processing
Transfers	44 to 49	Safeguard transfers to countries with no adequacy decision

Two points are often missed. Without an establishment in the Union, you do not benefit from the “one-stop shop”: you may have to deal with the authority of each country concerned. And appointing a representative does not remove your own liability.

A reform is under discussion: the Commission’s “Digital Omnibus” proposal, presented in November 2025 (procedure 2025/0360(COD)), would notably raise the breach notification threshold and extend the deadline to 96 hours. At our last check, this text had not been adopted: the 72-hour deadline is still the one to apply. Check its status before changing your procedures.

If you are a supplier to a European client

This is the most common case in Morocco: contact centres, development, accounting, payroll, IT support. The EDPB states that the European controller must bind you by a contract covering all the requirements of Article 28(3), and may impose by contract the obligations that the GDPR places on processors. A processor outside the Union thus becomes indirectly subject to those obligations.

The contract must notably provide that you:

• process data only on the client’s documented instructions, including for transfers;
• bind your staff to confidentiality and apply the Article 32 security measures;
• use a sub-processor only with the client’s written authorisation, and remain liable for it;
• help the client respond to data subject requests and handle breaches, which you report without undue delay;
• delete or return the data at the end of the contract, at the client’s choice;
• provide evidence of compliance and accept audits.

Check that each commitment is achievable before signing. An audit clause or a notification commitment your teams cannot honour is a real risk. Our article on the key clauses of a managed IT contract helps review this kind of commitment from the IT side.

Standard contractual clauses: what you need to know

Morocco is not on the list of countries recognised by a European Commission adequacy decision (list checked in November 2026). To entrust you with data, a European client therefore usually relies on the standard contractual clauses (SCCs) in Implementing Decision 2021/914, which can be used without prior authorisation from an authority. The Commission organises them into four modules:

Module	Data flow	Example
1	Controller to controller	European agency sending bookings to a hotel in Morocco
2	Controller to processor	European company outsourcing its payroll to a Moroccan provider
3	Processor to sub-processor	European provider delegating part of the work to Morocco
4	Processor to controller	Moroccan customer of a Luxembourg cloud retrieving its data, an example given by the Commission

Some practical rules from the Commission’s questions and answers:

• The text is not negotiable. You choose the modules and options, complete the annexes and sign Annex I. Changing the substance loses the benefit of the tool.
• Modules 2 and 3 include the Article 28 requirements. There is no need to add a second processor contract for this transfer.
• The annexes take technical work. Description of the transfers and security measures: describe what actually exists, not an ideal.
• A local law assessment is expected. Since the Schrems II ruling, the client assesses the framework of the destination country and any access requests from authorities. Prepare the information that concerns you, with your adviser.
• An important limit. These SCCs are not designed for a recipient whose processing is itself directly subject to the GDPR. If that is your case, ask your adviser which instrument to use.

Law 09-08 still applies

Complying with the GDPR does not exempt you from Moroccan law, and vice versa. Article 2 of Law 09-08 covers a controller established in Morocco, but also a controller not established there that uses means located in Morocco, other than for mere transit. In that second case, the controller must notify the CNDP of the identity of a representative based in Morocco. This point is worth examining with your client and your adviser if you process their data here. A processor contract is also required by Article 23.

When you are the controller yourself, your transfers abroad, Europe included, fall under Articles 43 and 44: our guide on transferring data outside Morocco details the process. Declarations and authorisations are explained in our article on Law 09-08 and CNDP obligations.

Topic	GDPR	Law 09-08
Scope	Establishment in the EU, or offering and monitoring aimed at people in the EU	Controller established in Morocco, or means located in Morocco
Main formality	Records and company accountability	Prior declaration or authorisation with the CNDP
Breach notification	Provided for in Articles 33 and 34	No equivalent obligation in the text of the law
Penalties	Administrative fines, Article 83	Penalties that are notably criminal

A reform of Law 09-08 has been publicly discussed, with no adopted text that we could identify. Keep an eye on CNDP publications.

The shared technical foundation

Article 32 of the GDPR and Article 23 of Law 09-08 require risk-appropriate measures. The good news: the same measures serve both texts and feed the SCC annexes. They fall under cybersecurity for businesses in Morocco in the broad sense:

Requirement from the client or the text	Practical measure
Limited, traceable access	MFA on all accounts, separate admin accounts, access logs
Confidentiality	Encryption of laptops and backups, separation of data by client
Availability and recovery	Protected backups, documented restore tests
Regular testing	Security audit and penetration test with a defined scope
Breach handling	Incident response plan with contacts and a notification template
Cloud control	Hosting region recorded for each tool, particularly on Microsoft 365 and Azure

If clients keep asking for assurances, a structured approach saves answering every questionnaire from scratch. Our guide to ISO 27001 for SMBs in Morocco explains where to start.

The action plan, in order

1. List your Europe-related activities. Customers, prospects, employees, websites, campaigns, services for European companies.
2. Classify each activity. Establishment, targeting, monitoring, processing for a client, or out of scope. Have this analysis validated.
3. Map data and tools. What data, hosted where, who accesses it, which sub-processors.
4. Bring contracts up to standard. Article 28, SCCs and annexes, contracts with your own suppliers.
5. Close the security gaps. Start with access, encryption, backup and logging.
6. Prepare breach handling. Who decides, who informs the client, with what information.
7. Check your position with the CNDP. Declarations, authorisations, transfers.
8. Build an evidence file. Records, contracts, configuration screenshots, test reports, kept up to date.

The most common mistakes

Mistake	Consequence	Fix
Believing the GDPR applies as soon as a European appears in a file	Misdirected effort	Reason by activity, using Article 3
Believing that being outside the EU protects you from everything	Online shop targeting Europe with no representative or records	Test the targeting factors
Signing SCC annexes without checking them	Security commitments not met	Have the technical team review the annexes
Forgetting your own suppliers	Cloud or support not disclosed to the client	List sub-processors and get them authorised
Ignoring Law 09-08 after signing the SCCs	Irregular position in Morocco	Handle both frameworks together

How we help

ALLSAFE SOLUTIONS prepares the technical side of these files: inventory of tools and data flows, answers to your clients’ security questionnaires, factual drafting of the security measures annexes, MFA, encryption, backups, logs and incident response plan. For the legal assessment and formalities, we work with the company’s adviser. We reply within 24 business hours and work on site from Casablanca.

A European client is asking for assurances, or you are opening a market in Europe? Request your free initial audit: we review your data flows, the measures in place and the gaps to close.