Morocco Law 09-08: CNDP Declarations, Security Duties, Transfers and Penalties

Morocco's Law 09-08 requires most processing of personal data to be declared to, or authorised by, the CNDP before it starts, and it backs that with criminal penalties, yet it contains no general duty to notify personal data breaches. The law was promulgated by Dahir No. 1-09-15 of 18 February 2009 and is supervised by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). It predates the GDPR, so organisations used to EU rules find familiar principles but a different machinery: prior formalities, a CNDP country list for transfers, fixed fine bands in dirhams and prison terms. Reform has been discussed for years and the CNDP itself says the law should be amended, but no amending law had been enacted when this guide was checked. This guide covers scope, obligations article by article, current status, enforcement, what the law means for AI agents and machine credentials, and a compliance plan, for security, privacy and engineering leads at organisations established in Morocco, running offshoring or shared service centres there, or processing data using means located in Morocco.

Key takeaways

• Declare before you process: article 12 requires a prior declaration to the CNDP for most processing and prior authorisation for sensitive data, genetic data, offence data, national ID numbers, purpose changes and some interconnections.
• Security is a criminal matter: failing to apply the article 23 and 24 security measures can lead to three months to one year in prison and a fine of MAD 20,000 to 200,000, doubled for legal persons.
• Transfers follow a country list: transfers go freely only to countries on the CNDP list set by deliberation 236-2015; otherwise you need an article 44 ground, often CNDP authorisation based on contractual clauses or internal rules.
• No general breach notification duty: Law 09-08 does not require breach notice to the CNDP or individuals, though vital infrastructure operators have separate incident reporting duties under the cybersecurity Law 05-20.
• Reform is signalled, not enacted: the CNDP wants clearer rules and stronger sanctions, but as checked on 8 November 2026 Law 09-08 remains the law in force.

Scope: who and what is covered

Article 2 applies the law to wholly or partly automated processing and to non-automated processing of data held or intended to be held in manual files. It covers a controller established in Morocco, and a controller not established in Morocco that uses automated or other means located in Moroccan territory, except for processing used only for transit. A controller in the second case must notify the CNDP of the identity of a representative installed in Morocco. Strictly personal or household processing is excluded, as is processing for national defence and state security, and some processing for the prevention and prosecution of offences.

The "means located in Morocco" test catches foreign groups that run data centres, call centres or development teams in Morocco even where the controller sits abroad. Biometric data is not listed as a separate sensitive category in the text, so check CNDP deliberations before deploying biometrics.

Key obligations

Principles and lawful bases

Article 3 requires fair and lawful processing for specified, explicit and legitimate purposes, data that is adequate, relevant and not excessive, accurate, and kept no longer than needed. Article 4 makes consent the default basis, with exceptions for legal obligation, contract performance, vital interests, public interest tasks and the legitimate interests of the controller or recipient. Article 5 requires prior information to the data subject about the controller, purposes, recipients, rights and transfers.

Prior formalities with the CNDP

A declaration under article 15 must describe the controller, purposes, categories of data and data subjects, recipients, planned transfers, retention, security measures and the service for exercising rights. The security description is not a formality: it is the baseline the CNDP and a court will compare with what you actually run.

Security and confidentiality (articles 23 to 26)

Article 23 requires appropriate technical and organisational measures to protect personal data. Where a processor is used, the controller must choose one offering sufficient guarantees, and the relationship must be governed by a written contract binding the processor to act only on the controller's instructions. Article 24 adds reinforced measures for sensitive and health data, including control of access, of data media and of transmission. Article 25 limits processors and staff to acting on instructions, and article 26 imposes professional secrecy that continues after the role ends.

Data subject rights

• Access (art. 7): confirmation of processing, the data, and the logic of any automated processing, without excessive delay or cost.
• Rectification (art. 8): updating, correction or erasure free of charge within ten clear days; a refusal can be referred to the CNDP.
• Objection (art. 9): on legitimate grounds, and free of charge for direct marketing.
• Direct marketing (art. 10): automated calling machines, fax and email marketing need prior consent, with a limited email exception for existing customers.
• Automated decisions (art. 11): no decision producing legal effects may be based solely on automated processing such as profiling, subject to exceptions.

Transfers abroad (articles 43 and 44)

Article 43 permits transfers only to states ensuring a sufficient level of protection, and the CNDP publishes the list of such states (deliberation No. 236-2015 of 18 December 2015). Article 44 allows transfers to other countries with the data subject's express consent, where necessary for listed purposes such as protecting life, public interest, legal claims or a contract, under an international agreement, or with express and reasoned CNDP authorisation where the processing offers sufficient protection, notably through contractual clauses or internal corporate rules. The CNDP transfer procedure requires the underlying processing to be already declared or authorised, so declaration comes first. See the International Data Transfers Map.

Breach handling without a statutory clock

Law 09-08 has no equivalent of GDPR Article 33. That does not make breaches low risk: a breach caused by missing security measures is the article 58 offence, and unauthorised communication of data to third parties, even through negligence, is the article 61 offence. Law firm guidance notes that many organisations follow GDPR-style notification voluntarily, and that operators of vital infrastructure must report significant cybersecurity incidents to the DGSSI under Law 05-20 and Decree 2-21-406. Groups with EU customers will usually be bound by GDPR notification for the same incident anyway. See the Breach Notification Laws by Country Guide.

Timeline and current status

Plan for reform without designing around a draft. The direction signalled by the CNDP, stronger sanctions and clearer cross-border rules, suggests that controls built to GDPR level now (breach procedures, DPIA-style risk reviews, a named privacy lead) will carry over. Law 09-08 does not require a DPO, but appointing one simplifies CNDP filings and any future regime.

Enforcement and penalties

The CNDP receives declarations, grants authorisations, handles complaints and carries out inspections. Under article 51 it can withdraw a receipt or authorisation without delay where processing threatens security or public order. Its agents can record offences and send reports to the public prosecutor within five days (art. 66). The CNDP has grown from 14 staff in 2018 to nearly 70, with a target of at least 200 by 2027, and has said it intends to strengthen sanctions and refer more cases to prosecutors.

Imprisonment and fines can apply together or separately. Fines are doubled for legal persons, which can also face partial confiscation of assets and closure of establishments (art. 64), and penalties are doubled for a repeat offence within a year of a final conviction (art. 65).

What it means for AI agents and non-human identities

The CNDP has stated that Law 09-08 applies to AI processing that uses personal data, and that people affected must have human and regulatory recourse. In practice:

• Declare AI use cases: a new AI agent or model pipeline that processes personal data is a new purpose or processing and needs its own declaration, or authorisation where sensitive data or a changed purpose is involved.
• Machine credentials are article 23 controls: service accounts, API keys and agent tokens that can read personal data must be inventoried, scoped and rotated; a leaked token that exposes records can support an article 58 or 61 charge. See the Service Account Security Guide.
• Prompts to foreign models are transfers: sending personal data to a model hosted outside Morocco is an article 43 transfer; check the CNDP list or obtain an article 44 ground before go-live.
• Automated evaluation limits: article 11 restricts decisions with legal effects based solely on automated processing, so keep a human decision point for agentic approvals and denials.
• Per-agent identity supports the declaration: distinct identities and logs per agent let you prove that only declared purposes were served. See the Agent Identity and Access Guide.

Compliance steps

1. Map scope: identify Moroccan entities and foreign controllers using means in Morocco; appoint and notify a representative where needed.
2. Inventory processing: list every processing operation, including AI agents and automated pipelines, and classify each as declaration or authorisation.
3. File with the CNDP: submit declarations and authorisation requests before processing starts, and keep receipts with the system records.
4. Align security with the declaration: implement article 23 and 24 controls, covering human and machine identities, encryption and logging, and update the declaration when they change.
5. Contract processors: written terms binding processors to instructions, security and confidentiality.
6. Clear transfers: check each destination against the CNDP list; file form F118 where authorisation is needed and allow two months.
7. Adopt a breach procedure: even without a statutory clock, define triage, containment, evidence and communication steps, and check Law 05-20 duties if you are a vital infrastructure operator.
8. Track reform: review CNDP communications quarterly and plan for stronger sanctions and cross-border rules.

Common failure patterns

• Processing before the receipt: launching a system before declaring it is the article 52 offence, and AI pilots are the usual culprit.
• Stale declarations: security measures, recipients or transfers change but the filing does not.
• Assuming no breach law means no exposure: security failures and negligent disclosure are criminal offences in their own right.
• Offshoring without transfer analysis: centres in Morocco often send data back to group systems abroad, which needs its own article 43 or 44 basis.
• Ignoring machine identities: security descriptions that cover staff logins but not API keys and service accounts.

Practitioner checklist

• Confirm whether each entity is established in Morocco or uses means located there.
• Declare every processing operation, including AI agents, before it starts.
• Obtain prior authorisation for sensitive, genetic, offence, national ID and repurposed processing.
• Keep CNDP receipts and authorisations linked to the systems they cover.
• Implement article 24 reinforced controls for sensitive and health data.
• Inventory and scope service accounts, API keys and agent tokens with personal data access.
• Check transfer destinations against deliberation 236-2015 and file form F118 where needed.
• Answer rectification requests within ten clear days.
• Run a documented breach procedure and check Law 05-20 reporting duties.
• Review CNDP news for reform of Law 09-08 every quarter.

Standards and references

• Kingdom of Morocco: Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel
• Kingdom of Morocco: Décret n° 2-09-165 pris pour l'application de la loi n° 09-08
• CNDP: Loi 09-08
• CNDP: Notifier une demande de transfert à l'étranger
• CNDP: Notifier une demande d'autorisation préalable
• CNDP: Lettre Artemis No. 34, first quarter 2025
• CMS: Expert guide to data protection and cyber security laws, Morocco

Related NHI Mgmt Group resources: Mauritius Data Protection Act 2017 · South Africa POPIA Guide · Global Privacy Regulatory Map · GDPR Compliance Guide for Security Teams. This guide summarises Morocco's Law 09-08 and Decree 2-09-165 as published at the date above and is not legal advice.