Gazettes and laws
Morocco's law 09-08 on personal data and the CNDP
Short answer
- Law
- Loi n° 09-08, promulgated by dahir n° 1-09-15 of 18 February 2009 1
- Authority
- Commission nationale de contrôle de la protection des données à caractère personnel (CNDP) 2
- CNDP membership
- Seven members, five-year term renewable once 1
- Rectification deadline
- Ten clear days 1
- Convention 108
- Morocco joined on 28 May 2019, per the CNDP 5
The law and its authority
Law 09-08 defines personal data as any information, of any kind and on any medium, about an identified or identifiable natural person 1. Article 27 sets up a Commission nationale (national commission) placed with the Prime Minister to oversee data protection 1. The commission has seven members, a president and six others appointed by the King, and they serve five years, renewable once 1. The CNDP cites article 24 of the Constitution, under which everyone has the right to protection of private life 3.
The CNDP's internal rules were approved by decision n° 3-33-11 of the Prime Minister of 28 March 2011, published in Bulletin Officiel n° 5932 of 7 April 2011 5. The CNDP lists law 09-08 and decree n° 2-09-165 as its legal texts 2.
Declaration or authorisation
Article 12 requires an authorisation from the CNDP for listed cases, including sensitive data, and a déclaration préalable (prior declaration) in all other cases 1. The CNDP site offers three filings for controllers: a declaration, a request for prior authorisation and a request to transfer data abroad 2.
In a press release of 13 November 2025, the CNDP said its partnership with the Confédération Générale des Entreprises du Maroc (CGEM, employers' confederation) gives member companies training and access to the online application for filing notifications to the CNDP 4. In a press release of 7 November 2025, the CNDP said it was strengthening its tracking of personal data published improperly on the dark web. It said it would alert the controllers concerned and apply the law, in particular where processing had not been notified in advance 3.
Rights of the person concerned
- Access (article 7): confirmation that data is processed and a copy of it, free of charge and without delay 1
- Rectification (article 8): updating, correction, erasure or blocking of data, within ten clear days 1
- Opposition (article 9): objection on legitimate grounds, and objection free of charge to use for marketing 1
- Complaint: the CNDP site has an online complaint form 2
Transfers abroad
Under article 43, a controller may transfer data only to a state that provides sufficient protection, and the CNDP draws up the list of such states 1. Article 44 allows exceptions where the person has expressly consented, for listed cases of necessity, or with an express and reasoned CNDP authorisation 1.
Penalties
| Offence | Article | Penalty |
|---|---|---|
| File processed without declaration or authorisation 1 | 52 1 | DH 10,000 to 100,000 1 |
| Refusing access, rectification or opposition 1 | 53 1 | DH 20,000 to 200,000 for each breach 1 |
| Unlawful collection or incompatible use 1 | 54 1 | Three months to one year and/or DH 20,000 to 200,000 1 |
| Sensitive or offence data without express consent 1 | 57 1 | Six months to two years and/or DH 50,000 to 300,000 1 |
| Unlawful transfer abroad 1 | 60 1 | Three months to one year and/or DH 20,000 to 200,000 1 |
| Obstructing CNDP checks 1 | 62 1 | Three to six months and/or DH 10,000 to 50,000 1 |
| Legal persons 1 | 64 1 | Fines doubled 1 |
| Repeat offence 1 | 65 1 | Penalties doubled 1 |
Registers and data protection
The CNDP gives opinions on draft texts that create registers. On 30 August 2021 the Secrétaire Général du Gouvernement asked it for an opinion on the draft decree on the public register of beneficial owners of companies formed in Morocco and legal arrangements 5. In deliberation D-181-2021 the CNDP found the register exempt from declaration under articles 18 and 50 of law 09-08 5. It said the register must still name a controller in charge of data subject rights and give any requester the name and purpose of the processing, the controller's identity, the data, recipients and planned transfers abroad 5.
Common questions
Do I need to declare personal data processing in Morocco?
Yes. Law 09-08 requires a prior declaration, or an authorisation for listed cases such as sensitive data 1.
How long does a Moroccan controller have to correct data?
Ten clear days under article 8 1.
What is the fine for an undeclared file in Morocco?
DH 10,000 to 100,000 under article 52, doubled for legal persons 1.
Has Morocco joined Convention 108?
Yes, on 28 May 2019, per a CNDP deliberation 5.
Where do I complain about data misuse in Morocco?
Through the CNDP's online complaint form 2.
Rules and fees change. Check the official source linked on this page before you act on it. Spotted an error? Email hello@maghrebregisters.com.
Sources
- Ministère de la Justice, Maroc (portail Adala): Dahir n° 1-09-15 du 18 février 2009 portant promulgation de la loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel (Law 09-08 on the protection of individuals in the processing of personal data)
- CNDP: Commission nationale de contrôle de la protection des données à caractère personnel, accueil (Home page)
- CNDP: Communiqué de presse, La CNDP consolide sa capacité à suivre les publications inadéquates de données à caractère personnel sur le darkweb (Press release, the CNDP strengthens its capacity to track improper publication of personal data on the dark web) (7 November 2025)
- CNDP: Communiqué de presse, La CNDP et la CGEM signent une convention de partenariat autour de la protection des données à caractère personnel (Press release, the CNDP and the CGEM sign a partnership agreement on personal data protection) (13 November 2025)
- CNDP: Délibération n° D-181-2021 portant avis sur le projet de décret relatif au registre public des bénéficiaires effectifs (Deliberation D-181-2021, opinion on the draft decree on the public register of beneficial owners) (2021)
Related
- Access-to-information laws and data protection authorities in North Africa
Morocco law 31-13 and Tunisia law 2016-22 on access to information, deadlines and appeals, and data protection laws in Morocco, Algeria and Egypt.
- Company registers in Morocco: local registers, the OMPIC central register and the ICE
How Morocco's trade register works: local court registers, the OMPIC central register, certificats négatifs, the ICE number, extracts and deadlines.
- Personal data rights in Algeria under law 18-07
Algeria's law 18-07 of 2018: consent, access, rectification within ten days, objection, the national authority, its fines and the criminal penalties.
- Glossary of French official register terms used in Morocco, Algeria and Mauritania
English meanings of French terms used in trade registers, gazettes, criminal records, data protection and land law in Morocco, Algeria and Mauritania.