Booking a plane ticket means handing over a great deal of information: identity, passport, payment method, seat, baggage. Since joint ministerial order no. 218.26 was published in the Bulletin officiel (Official Gazette) of 5 October 2026, these data are subject to a regulated transfer to a national centre in charge of processing them. Travellers, airlines and travel agencies alike should understand what this text provides and how it fits with personal data protection.
The text and its legal basis
Joint ministerial order no. 218.26 is dated 29 January 2026 and was published in the Official Gazette of 5 October 2026. It is part of a chain of texts: it was issued under Decree 2.21.624 of 21 July 2022, itself implementing article 212 of Law 40.13 on the civil aviation code. The scheme is also linked to Annex 9 of the Chicago Convention on International Civil Aviation.
Which data are sent?
The list is broad. It covers the traveller, the booking, the payment and the flight itself. Much of it is information that airlines already hold in order to sell tickets and manage boarding. According to Médias24, the categories include:
- identity: name, date and place of birth, nationality, address, passport;
- booking and ticketing data, fare, class and seat;
- payment and billing information;
- number and weight of bags;
- other travellers on the same booking;
- flight data, including delays and cancellations.
To whom, and why
The data go to the National Centre for the Processing of Passenger and Flight Information, placed under the authority of the Director General of National Security (DGSN). The stated purpose is the fight against terrorism and transnational crime. This is therefore a security-driven processing operation, separate from the commercial use the airline makes of the same information to sell and operate its flights.
What changes for travellers and businesses
For travellers, no additional step is required: the information given at booking and check-in is what gets transferred. It is in their interest that it be accurate, since an identity or passport error can complicate the trip. The general rules of Law 09-08 continue to apply to the data they give the airline or the agency.
For airlines, the issue is the quality and security of the data transferred and informing passengers in their privacy notices. Travel agencies, which often collect these data upstream, should review their own procedures, the security of their systems and the information given to customers, especially for bookings covering several travellers.
The general framework of Law 09-08
Law 09-08 on the protection of individuals with regard to the processing of personal data remains the general reference. It rests on familiar principles: a defined purpose, adequate and non-excessive data, limited retention, security, informing the people concerned, and rights of access and rectification. The CNDP (the national data protection commission) oversees its application. Security-related processing may follow specific rules, but businesses that collect the data upstream remain bound by their own obligations.
Sources
- Médias24, 15 October 2026: « Transport aérien : les données des passagers désormais davantage surveillées »
- Bulletin officiel, 5 October 2026: joint ministerial order no. 218.26 of 29 January 2026
Maître Mouad Lahfaia
Lawyer at the Rabat Bar
This article reflects the author's views as at the date of publication. It does not constitute legal advice and is no substitute for an analysis of your particular situation.