Transferring data outside Morocco and the cloud: what the CNDP requires

The short answer: as soon as personal data collected in Morocco is stored, backed up or accessed abroad, there is a transfer within the meaning of Law 09-08. That is the case for most cloud services: email, file storage, online CRM, payroll or support tools. Such a transfer is not prohibited, but it is regulated: it must go to a country on the list set by the CNDP, Morocco’s data protection authority, or fall under one of the cases in Article 44, including express authorisation from the CNDP. It is declared together with the processing, and it is prepared before the migration, not after.

This guide follows the text of Law 09-08 (Articles 15, 23, 43, 44 and 60, as published in the Official Bulletin), explains how to find out where your data really is with Microsoft and Google, and lists the technical measures that make a transfer defensible. It complements our in-depth article on Law 09-08 and CNDP obligations. It is not legal advice: for a complex case, a lawyer or the relevant CNDP department remains the reference.

When is there a transfer of data outside Morocco?

The law refers to a transfer “to a foreign State”. In practice, it is enough for personal data to leave the country, whatever the means: hosting, replication, backup or simple remote access from abroad. These are the situations we see most often in SMBs:

Situation	Data concerned	Transfer?
Email and files on Microsoft 365 or Google Workspace	Employees, customers, suppliers	Yes, if the datacentres are outside Morocco
Online CRM or ticketing software	Customers and prospects	Yes, depending on the vendor’s hosting
Offsite backup to a foreign cloud	All backed-up data	Yes
SaaS payroll or HR software	Employees, social data	Yes, depending on hosting
Parent company or subsidiary abroad accessing files	Depends on access	Yes
Foreign vendor connecting to your server for support	Data visible during the session	Yes, during access
Generative AI tools used with customer data	Whatever is pasted into the tool	Yes, often without the company knowing
Servers and backups hosted in Morocco, local access only	All	No

The last row is rarely the real situation. A single online tool adopted by one department is enough to create a transfer. That is one of the risks of shadow IT and generative AI in the workplace: data leaves the country without anyone deciding it should.

What Articles 43 and 44 of Law 09-08 say

Article 43 sets the principle. A data controller may only transfer personal data to a foreign State if that State ensures an adequate level of protection of privacy and of individuals’ rights. That level is assessed in particular according to the rules in force in the destination State, the security measures applied there, the purposes and duration of the processing, and the nature, origin and destination of the data. The CNDP draws up the list of States meeting these criteria.

Article 44 provides the exceptions. To a State that is not on the list, a transfer remains possible in the following cases:

Case under Article 44	Example	Suited to a lasting cloud tool?
Express consent of the person	Customer explicitly accepting processing abroad	Rarely: hard to collect and prove for everyone
Protecting the person’s life	Medical emergency	No
Preserving the public interest	Specific cases	No
Establishing, exercising or defending a legal claim	Litigation abroad	No
Performing a contract with the person, or pre-contractual steps at their request	Booking a trip abroad for a customer	Occasionally
Contract concluded in the person’s interest with a third party	Service ordered for a customer	Occasionally
International mutual legal assistance	Judicial proceedings	No
Prevention, diagnosis or treatment of medical conditions	Medical opinion abroad	Healthcare providers
Bilateral or multilateral agreement to which Morocco is a party	Depends on the agreement	Case by case
Express, reasoned authorisation from the CNDP	Processing secured by contractual clauses or internal rules	Yes, this is the usual route

For email, a CRM or backup, meaning permanent processing that involves many people, two routes are realistic: a destination country on the CNDP list, or a CNDP authorisation backed by solid contractual commitments from the provider.

The country list: where to find it

The list of States ensuring adequate protection is set by CNDP deliberation (deliberation no. 465-2013, amended by deliberation no. 236-2015). We do not reproduce it here: it can be changed by a new deliberation, and the version published on the CNDP website is authoritative. The right reflex is to check, for each tool, the exact hosting country stated by the provider, then compare it with the list in force.

Watch out for a common trap: a provider may advertise hosting “in Europe” without naming the country, or store some data (logs, backups, support data) somewhere other than the main data. What counts is the actual country for each category of data.

The CNDP process, step by step

Article 15 of the law requires the declaration of a processing to mention “the transfers of data planned to foreign States”. The transfer is therefore not a standalone formality: it is part of the processing file.

1. Inventory processing activities and tools. For each processing activity (payroll, CRM, email, CCTV, patient records), list the tools used and the hosting country of each.
2. Declare or obtain authorisation for the processing. The CNDP states that transfer authorisation is only granted if the underlying processing has itself been declared or authorised. If that is not done, it is the first step.
3. Qualify the transfer. Listed country, Article 44 case, or need for CNDP authorisation.
4. Complete the transfer request. The CNDP publishes a dedicated form for requesting a transfer of data abroad (referenced F118 on its website). It asks in particular for the identification of the controller in Morocco, of the recipient abroad, and the references of the processing receipt.
5. Attach the safeguards. Contract with the provider, data protection clauses, description of the security measures.
6. Wait for the answer before switching over. Plan the migration around the review period indicated by the CNDP, and keep the receipt or authorisation in the compliance file.

Forms and their versions change: always download the current version from cndp.ma when filing.

Cloud: knowing where your data really is

A serious transfer request relies on accurate information. Here is where to find it with the two providers most used by Moroccan SMBs, for which we are a Microsoft partner and a Google Workspace partner.

Microsoft 365. Microsoft documents each tenant’s data location in the admin centre: Settings, Org settings, Organization profile, Data location. This card shows, service by service (Exchange, SharePoint, Teams…), the region where data is stored. Microsoft notes that a customer’s data may be spread across several datacentres, so this card, for your tenant, is the reference. Additional data residency offers exist for certain regions.

Google Workspace. The “data regions” feature lets the administrator choose the location of covered data: United States, Europe or no preference. It depends on the edition and only covers certain services and data types; Google states for example that logs and cached content are not covered.

What to check	Microsoft 365	Google Workspace
Where to see the current region	“Data location” card in the admin centre	Admin console, data region policies
Choosing the region	Set when the tenant is created, additional residency offers	Data region policy, depending on edition
Data outside the scope	Read each service’s documentation	Logs, cache and unlisted data
Document for the file	Screenshot of the card, data protection terms	Screenshot of the policy, data protection terms

The region is ideally chosen when the environment is created. That is why we address it from the scoping phase of our managed Microsoft 365 and Azure cloud in Morocco projects. Our Microsoft 365 vs Google Workspace comparison helps choose the platform itself.

The alternative: keeping some data in Morocco

For the most sensitive processing (health data, biometric data, detailed HR files), some companies prefer to avoid a transfer altogether: servers and backups hosted in a datacentre in Morocco, on-premises tools, remote access via VPN. We cover this option in our article on hosting servers and backups in a datacentre in Morocco.

This choice has its constraints: server maintenance, offsite backup to plan, high availability to build. A hybrid architecture is often the most realistic: collaboration and email in the cloud, sensitive data hosted locally. For backup, check where the offsite copy goes; our offsite backup guide details the options.

Technical measures that make a transfer defensible

Article 23 of the law requires technical and organisational measures suited to the risks, and a written contract with every processor. For a transfer, the CNDP looks at what actually protects the data. The measures we put in place:

• Minimise what leaves. Do not sync folders that do not need to be in the cloud, avoid copying ID documents or health data into general-purpose tools.
• Control access. Multi-factor authentication for every account, separate admin accounts, conditional access based on the device. Our MFA rollout guide details the order of deployment.
• Encrypt. Encryption of laptops, backups and exchanges; for the most sensitive data, encryption with keys controlled by the company where the offer allows it.
• Log. Enable and retain audit logs to know who viewed or exported what.
• Control support access. For a foreign vendor, on-request access, time-limited and logged.
• Put it in the contract. Processor clauses (Article 23) and data protection terms, data location, sub-processors, return and deletion at the end of the contract.

These measures are part of business cybersecurity in Morocco in the broad sense, and they also serve the obligations of Law 05-20 on cybersecurity for the organisations it covers.

What the law provides in case of breach

Article 60 of Law 09-08 punishes anyone who transfers personal data to a foreign State in breach of Articles 43 and 44 with three months to one year of imprisonment and a fine of 20,000 to 200,000 MAD, or only one of these penalties. Beyond the criminal penalty, an uncontrolled transfer raises a very practical problem: if a foreign provider suffers a leak, the company must be able to show that it knew where its data was and how it was protected.

The most common mistakes

Mistake	Consequence	Fix
Migrating to the cloud, then dealing with the CNDP	Transfer already made without a legal basis	Build the process into the migration plan
Declaring the processing without mentioning the transfer	Incomplete declaration under Article 15	Update the declaration
Relying on “hosted in Europe”	Actual country unknown, ancillary data elsewhere	Record the country for each data category
Relying on employee consent	Fragile consent, hard to prove	Listed country or CNDP authorisation
Forgetting backup and support	Undeclared transfer	Map every flow, including technical ones
No processor contract	Article 23 obligation not met	Signed data protection addendum

Checklist before a cloud project

• List the personal data that will go into the new tool, and the data that has no reason to.
• Record the hosting country for each data category, backups and logs included.
• Compare with the CNDP list in force, or identify the applicable Article 44 case.
• Check that the processing is declared or authorised, and that the transfer is mentioned.
• File the transfer request if needed, with contract and security measures.
• Enable MFA, encryption and audit logs before going live.
• Keep screenshots, contracts and receipts in a compliance file, and review it whenever a new tool is added.

How we help

ALLSAFE SOLUTIONS helps companies prepare the technical side of these files: inventory of tools and flows, hosting regions, Microsoft 365 and Google Workspace configuration, encryption, logs and backups, technical security annexes. For the legal qualification and filing, we work alongside the company’s counsel. We respond within 24 business hours and work on site from Casablanca.

Preparing a cloud migration, or want to know where your data is today? Request your free initial audit: we map your tools, your data flows outside Morocco and the measures to put in place.