Suspect a breach? Report it immediately — response within 1 hour.Report an incident
Morocco's law on the protection of individuals with regard to the processing of personal data, overseen by CNDP.
Last updated — August 22, 2026
Any natural or legal person, public or private, that processes personal data within Moroccan territory or by means located in Morocco, with the exception of strictly personal or household processing.
Law 09-08 requires, among other things, a legal basis for each processing activity, information to data subjects, security measures proportionate to the risk, and, depending on the case, a prior declaration or authorization request filed with CNDP before the processing begins.
Deadlines
Applicable timelines — prior formalities with CNDP, responses to data subject rights requests — are set by implementing texts and vary depending on the nature of the processing; they must be verified on a case-by-case basis.
Sanctions
Law 09-08 provides for a regime of administrative and criminal sanctions in the event of non-compliance. Their nature and amount depend on the severity and type of breach identified by CNDP.
Map all personal data processing activities
Determine the legal basis for each processing activity
Complete the required prior formalities with CNDP (declaration or authorization)
Implement appropriate security and information measures
Keep the processing register up to date and track data subject rights requests
| Framework | Covered |
|---|---|
| rgpd | ✓ |
Get the checklist by email.
Any public or private entity that processes personal data in Morocco or by means located in Morocco, excluding strictly personal or household processing.
The National Commission for the Control of the Protection of Personal Data is the authority responsible for receiving prior formalities, controlling the application of Law 09-08, and handling complaints.
No. The applicable regime — simplified declaration, normal declaration, or prior authorization — depends on the nature and sensitivity of the processing concerned.
Both texts share similar principles (legal basis, information, security), but remain distinct legal frameworks with their own formalities and supervisory authority.
CNDP can initiate control measures, and depending on the severity of the breach, the administrative and criminal sanctions regime provided for by the law may apply.
