Obligations of the data controller
- Fair and lawful processing, a specified purpose, adequate and proportionate data, limited retention period (Art. 3).
- Consent of the data subject or another legal basis (Art. 4).
- Prior declaration to, or authorisation from, the CNDP depending on the nature of the data (Art. 12); authorisation is required for transfers outside Morocco to countries that do not ensure an adequate level of protection (Arts. 43 and 44).
- Security and confidentiality of processing (Arts. 23 and 24).
Sanctions
- Fines of 10,000 to 300,000 dirhams and prison sentences for processing without the required formalities, use of data for unauthorised purposes and unlawful transfers (Art. 51 et seq.).
Key articles
Art. 1
« Information technology is at the service of the citizen and develops within the framework of international cooperation. It must not infringe human identity, rights or collective or individual freedoms. »
A lawyer's points to watch
- Any website, customer database or video surveillance system requires a formality with the CNDP.
- Businesses processing data of European residents must comply with both Law 09-08 and the GDPR.
The English text on this page, including the quoted articles, is an unofficial translation. Information sheet prepared by Maître Lahfaia Law Firm, Rabat. It does not constitute legal advice. Only the text published in the Official Bulletin of the Kingdom of Morocco is authoritative; the articles cited may have been amended since this sheet was written.