Morocco's Law 09-08 and the CNDP: what companies must put in place

Law 09-08 on personal data protection applies to every Moroccan company that processes data about customers, patients, employees or prospects. In other words, all of them. The CNDP enforces it. Here are the obligations with a direct IT translation.

Declare or request authorisation

Every processing operation (customer file, payroll, video surveillance, health data) must be declared to the CNDP, some subject to prior authorisation. The first step is therefore an inventory: which data, where, for what, for how long.

Secure the data

The law requires “appropriate technical and organisational measures”. Concretely: access control with MFA, laptop encryption, protected backups, logging of access to sensitive data, deletion of former employees’ accounts, an up-to-date firewall.

Frame your contractors

Your hosting provider, your ERP vendor, your managed service provider process your data on your behalf. A contract must specify their security and confidentiality obligations. Our managed services contracts include this clause.

Transfers outside Morocco

Hosting data with a foreign cloud provider is a transfer, subject to CNDP authorisation except to countries recognised as offering adequate protection. The choice of hosting region (Europe or Morocco) is part of our recommendations in cloud projects.

Inform and respond

Information notices on forms, a procedure to answer access or deletion requests, defined retention periods.

And GDPR?

If you process data of European residents, customers or partners, GDPR applies as well. The technical measures are largely the same, and we build them into our cybersecurity service.