CNDP Law 09-08
Data protection framework recognizing right to algorithmic explanation for automated decisions and implementing controls on biometric data processing.
| Jurisdiction | Morocco |
|---|---|
| Category | Privacy & Data Protection |
| Status | Active |
| Latest development |
Analysis
Key Requirements
CNDP Law 09-08 establishes several key requirements for data protection in Morocco:
- Prior notification or authorization: Data controllers must notify the CNDP before processing personal data, or obtain authorization for sensitive data processing. This applies to all processing operations within Morocco, including by foreign entities.
- Consent and transparency: Data controllers must obtain consent from data subjects before collecting and processing personal data, except in specific cases. They must also inform subjects about the purpose of data collection and processing.
- Data quality and retention: Personal data must be accurate, up-to-date, and relevant to the stated purpose. It should not be kept longer than necessary for that purpose.
- Security measures: Controllers must implement technical and organizational measures to protect personal data against unauthorized access, destruction, or alteration.
- Data subject rights: Individuals have the right to access, correct, and delete their personal data, as well as object to its processing.
Compliance Challenges
Organizations often face several challenges in complying with CNDP Law 09-08:
- Lack of awareness: Many companies, especially SMEs, are not fully aware of their obligations under the law.
- Cross-border data transfers: Ensuring compliance when transferring data outside Morocco can be complex, as it requires adequate protection measures.
- Consent management: Obtaining and managing valid consent, especially for digital services, can be challenging. This is particularly true when dealing with sensitive data or automated decision-making.
- Data inventory and mapping: Many organizations struggle to identify and categorize all personal data they process, which is crucial for compliance.
Implementation Best Practices
To effectively implement CNDP Law 09-08, organizations should:
- Conduct a data audit: Map all personal data processing activities to understand what data is collected, how it's used, and where it's stored.
- Implement a consent management system: Use tools to obtain and record valid consent from data subjects.
- Establish data protection policies: Develop and implement comprehensive policies covering data collection, processing, storage, and deletion.
- Train employees: Provide regular training on data protection principles and the organization's specific policies.
- Implement security measures: Use encryption, access controls, and regular security audits to protect personal data.
Recent Updates
As of 2024, there have been no major recent updates to CNDP Law 09-08. However:
- The CNDP has been increasing enforcement activities and issuing more guidance on compliance.
- There are ongoing discussions about potential convergence with GDPR standards, which may lead to future amendments.
Organizations should regularly check the CNDP website for the latest updates and guidance.
Related Regulations
CNDP Law 09-08 interacts with several other regulations:
- EU GDPR: While not directly applicable, the GDPR influences Moroccan data protection practices, especially for companies dealing with EU data subjects.
- Moroccan Consumer Protection Act (31-08): This law complements data protection regulations in areas like direct marketing and consumer rights.
- Moroccan Cybercrime Law: This law intersects with data protection in areas of data security and breach notification.
Industry Impact
CNDP Law 09-08 has significant impacts across various industries:
- Financial Services: Banks and financial institutions face stringent requirements for protecting customer data and obtaining consent for data processing.
- Healthcare: The law imposes additional safeguards for health-related data, affecting how medical providers handle patient information.
- E-commerce and Digital Services: Online businesses must adapt their data collection and processing practices to comply with consent and transparency requirements.
- Outsourcing and Call Centers: Morocco's outsourcing industry must ensure compliance when handling data from foreign clients, potentially affecting competitiveness.
Sources
- CNDP Official Website
- CMS Law: Scope of Data Protection Legislation in Morocco
- Attijari Entreprises: Personal Data Protection
- African Legal Factory: Who will protect your personal data in Morocco in 2024?
- Legal 500: Morocco Data Protection & Cyber Security Law
- DataGuidance: Morocco - Data Protection Overview
- TechGDPR: Artificial Intelligence and the right to explanation under the GDPR
- SAS Blogs: The Moroccan landscape for data protection
- African Legal Factory: Declaring personal data processing in Morocco
Recent developments
- — CNDP announced strengthened monitoring of personal data leaks on the dark web and the use of new automated tools to detect unauthorized dissemination of personal data, with enforcement actions under Law 09-08 where processing has not been declared to the Commission.[6] (source)
- — CNDP signaled a shift from awareness to enforcement of Law 09-08, sending formal notifications with multi‑month action plans to companies and warning that non‑compliance with data protection obligations could lead to sanctions.[5] (source)
- — The enforcement campaign under Law 09-08 began in the healthcare sector, with around 3,000 pharmacists aligning practices with CNDP requirements, and is expanding to legal professionals, media, banking, insurance, e‑commerce and digital services, indicating broad industry impact and increased compliance costs.[5] (source)
- — CNDP framed its cross‑sector notifications and enforcement drive as a “national roadmap for data protection,” combining awareness, regulation and sanctions, which is pushing organizations to formalize data governance and documentation under Law 09-08.[5] (source)
- — CNDP announced plans to hold hearings to issue regulations on video surveillance, aiming for a unified interpretation of Law 09-08 regarding privacy, with particular focus on the risks of facial recognition technologies in public spaces.[8] (source)
- — The contemplated CNDP rules on video surveillance and facial recognition under Law 09-08 are prompting debate about proportionality, lawful bases and transparency obligations for surveillance operators, with expected operational changes for municipalities, retailers and security providers.[8] (source)
- — Following cyberattacks and leaks, CNDP issued a press statement reiterating that any use of personal data obtained outside the legal framework of Law 09-08 is illegal, warning that such use constitutes an offense and may trigger investigations.[4] (source)
- — CNDP emphasized its investigative powers under Law 09-08 and invited victims of unauthorized disclosure to file complaints, signaling more active enforcement and incident‑response expectations for controllers handling leaked or widely circulated personal data.[4] (source)
- — New comprehensive data privacy laws take effect January 1, 2026, in Indiana, Kentucky, and Rhode Island, with amendments in California, Colorado, Connecticut, Oregon, and Utah emphasizing sensitive data protections, universal opt-outs, and compliance programs (source)
- — New 2026 US privacy, data protection, and AI laws outlined, including mandates for AI social interaction disclosure and suicide ideation protocols with private right of action from July 1, 2027 (source)
- — CNDP began formally notifying businesses in healthcare, law and other sectors that they must comply with Law 09-08 or face penalties, marking a clear transition toward stricter enforcement of Morocco’s data protection framework.[7] (source)
- — Industry commentary highlighted that CNDP’s compliance push under Law 09-08 would require organizations to review consent mechanisms, data processing registrations and security measures, with increased regulatory risk for non‑compliant entities.[7] (source)
Related regulations
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
- Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
- New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
- Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01
Put it into practice
- Generate the policy: GDPR policy generator (generatepolicy.com)
- Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
- Build it yourself: Privacy Dual Coverage Bundle (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates