Morocco. Comprehensive data protection. Law
Law 09-08Law No. 09-08 on the Protection of Individuals with regard to the Processing of Personal Data
In force
§1Summary
- Synopsis
Morocco's data protection law, modelled on the 1995 EU Directive, requiring prior declaration to or authorisation from the CNDP for processing and CNDP authorisation for transfers abroad.
- Key themes
- Unique features
Prior CNDP authorisation for any international transfer and for processing sensitive data or national ID numbers; no breach notification or DPO duty.
- SaaS relevance
Moroccan customers of offshore SaaS must obtain CNDP transfer authorisation, often relying on consent or adequacy lists.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- CNDP prior authorisation; adequacy or derogations
- Maximum penalty
- MAD 600,000 (doubled for legal persons) and up to 4 years' imprisonment
§3Dates
- Key dates
- Adopted
- In force
- Implementing Decree 2-09-165 of 21 May 2009; Morocco joined Convention 108 (2019) and signed 108+
§4Text and authority
- Text
- Authoritative text cndp.ma
- Authority
- Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)
§5Where it applies
- Domestic law of
- Morocco
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Reform bill for a new law not confirmed in sources consulted; Convention 108 accession date from prior knowledge.