Morocco's Law 09-08 and the CNDP: what companies must put in place

Law 09-08 on the protection of individuals with regard to the processing of personal data applies to every Moroccan company that processes data about customers, patients, employees or prospects. In other words, all of them. It created the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel), which enforces it. For an SMB manager, the hard part is not understanding the principle but knowing what to do on Monday morning: which files to declare, which protections to put in place, which clauses to require from providers. This guide covers the obligations that have a direct IT translation, with the corresponding articles of the law.

Who is affected, and by what?

The law covers any “processing” of personal data: collection, recording, consultation, transmission, storage. An Excel file of prospects, payroll, patient management software, access badges, video surveillance, the CRM and email all count. The data controller is the company that decides the purpose; it carries the obligations, even when the data is hosted or managed by a provider.

The core principles are in Article 3: data collected for specified and legitimate purposes, adequate and not excessive, accurate, and kept no longer than necessary. Article 4 sets the rule of the data subject’s consent, with exceptions (legal obligation, performance of a contract, legitimate interest in particular).

Step 1: take inventory, then declare or request authorisation

Every processing operation (customer file, payroll, video surveillance, health data) must be declared to the CNDP, some being subject to prior authorisation. Article 12 draws the line:

Type of processing	Formality with the CNDP	Company examples
General case	Prior declaration	Customer file, CRM, payroll, HR management, website with a form
Sensitive data (origin, opinions, religion, union membership, health, including genetic data)	Prior authorisation	Patient records, employees’ medical data
Using data for a purpose other than the one it was collected for	Prior authorisation	Reusing a customer file for another use
Data on offences or convictions	Prior authorisation	Criminal record extracts at hiring
Data including the national ID card (CIN) number	Prior authorisation	Customer or HR files that record the CIN
Interconnection of files with different purposes	Prior authorisation	Matching databases between two entities

For some health data processing carried out by professionals bound by secrecy, for care or the management of health services, Article 22 only requires a declaration. Declaration and authorisation forms are published on the CNDP website.

The first step is therefore an inventory: which data, where, for what, for how long, and who can access it. IT is essential here, because only IT sees where data actually flows: file shares, mailboxes, backups, laptops, cloud applications. An IT audit produces a good part of this map.

Step 2: secure the data

Article 23 requires “appropriate technical and organisational measures” to protect data against destruction, loss, alteration, disclosure or unauthorised access, especially when data travels over a network. The expected level depends on the state of the art, cost and the risks linked to the nature of the data. Concretely:

• Access control: named accounts, rights limited to actual need, MFA on email and remote access.
• Endpoints and media: encryption of laptops and external drives, automatic session lock.
• Protected backups: offline or immutable copies, tested restores.
• Traceability: logging of access to sensitive data, log retention.
• Account lifecycle: former employees’ accounts removed on their last day.
• Network: up-to-date firewall, encrypted remote access, segmentation of sensitive equipment.

For sensitive and health data, Article 24 goes further and lists specific controls: entry to premises, data media, input, use, access, transmission, transport, and the ability to check afterwards who entered which data and when. Clinics and medical practices are directly affected; we cover this case in our article on clinic cybersecurity.

Step 3: frame your contractors

Your hosting provider, your ERP vendor, your managed service provider, your payroll provider process your data on your behalf. Article 23 requires choosing a contractor that offers sufficient security guarantees, and binding it by a written contract stating that it acts only on your instructions and is subject to the same security obligations. Our managed services contracts include this clause.

Check in every contract: where the data is located, the security measures applied, staff confidentiality, any use of further subcontractors, and the return and deletion of data at the end of the contract.

Step 4: control transfers outside Morocco

Hosting data with a foreign cloud provider is a transfer. Article 43 only allows it to a country that ensures a sufficient level of protection; the CNDP draws up the list of those countries. To any other country, Article 44 provides limited exceptions, including the person’s express consent, performance of a contract with them, or an express and reasoned authorisation from the CNDP, in particular on the basis of contractual clauses.

In practice, this concerns cloud email and storage, online CRMs, support and emailing tools. The choice of hosting region (Europe or Morocco) is part of our recommendations in Microsoft 365 and Azure cloud projects, and it is easier to make before the migration than after.

Step 5: inform people and answer them

Article 5 requires informing people at the time of collection: identity of the controller, purpose, recipients, whether answers are mandatory or optional, the existence of access and rectification rights, and the references of the CNDP declaration receipt or authorisation. These notices must appear on paper and web forms.

People then have three main rights:

• Access (Article 7): to know whether data about them is processed and to obtain it.
• Rectification (Article 8): updating, correcting, erasing or blocking non-compliant data, which the controller must do free of charge within ten clear days.
• Objection (Article 9): to object to processing on legitimate grounds, and free of charge to commercial prospecting.

Article 10 also prohibits prospecting by email or automated calling without prior consent. The only exception: email prospecting for similar products or services, to a customer whose details were collected during a sale or service, and who can easily opt out with each message. On the IT side, you need a dedicated address for requests, a procedure to find all of a person’s data (including in email and backups), and retention periods that are actually applied.

The most common mistakes

The same gaps come up again and again:

Mistake	Why it is a problem	Fix
Declaring a file once, then forgetting it	Processing changes (new tool, new use) with no update	Regular review of the inventory, with every new tool
Collecting the CIN “out of habit”	Triggers prior authorisation, often for no real need	Collect only what is strictly necessary
Former employees’ accounts still active	Unauthorised access to data remains possible	Offboarding procedure with same-day deactivation
No contract with the host or software vendor	Article 23 obligation not met	Subcontracting clause in every contract
Data copied to USB drives or personal mailboxes	Loss of control, possible leak	Encryption, sharing through managed tools
Cloud chosen without checking the region	Unplanned transfer outside Morocco	Choose the region before migrating

And GDPR?

If you process data of European residents, customers or partners, GDPR applies as well. The technical measures are largely the same: access control, encryption, backups, traceability, subcontracting contracts. A company that has seriously implemented Law 09-08 has already done a large part of the technical work.

Checklist to get started

• List every personal data processing operation, including video surveillance and cloud tools.
• Identify those requiring prior authorisation (sensitive data, CIN, offences, interconnection).
• File the missing declarations and authorisation requests with the CNDP.
• Enable MFA, encrypt laptops, check backups and access logs.
• Add a subcontracting clause to every provider contract that touches your data.
• Check where your cloud data is hosted.
• Update the information notices on your forms and set up a procedure to answer requests.

How we can help

We do not replace a lawyer for the CNDP filings, but we handle the technical side: mapping data across the information system, security measures, traceability and hosting choices. These measures are built into our cybersecurity service. To review your situation, contact us.