Morocco data protection law. Law 09-08 and CNDP compliance.

Initial diagnosis · tailor-made proposal Frame Law No. 09-08 Authority CNDP Perimeter Processing & sites International Transfers to qualify Delivery Documented file

How does a company comply with Morocco’s Law 09-08?

Compliance with Morocco’s Law 09-08 starts by mapping processing activities, purposes and data categories, then identifying the CNDP filings or prior authorisations that may apply. The programme should also address privacy notices, security, contracts, retention, individual rights and international transfers. The required formality depends on the actual processing operation.

Skip scattered files
a coherent file.

The mission begins with the facts: purposes, people concerned, categories of data, recipients, durations, security, suppliers and transfers. This diagnosis then makes it possible to identify the documentary actions and formalities to prepare.

CARTOGRAPHIER

Actual treatment

HR, customers, prospects, video, access control, applications and sites.

QUALIFICATION

Applicable scheme

Status to be documented prior to declaration, authorization or other process.

PROVIDE

Maintainable file

Policies, clauses, decisions, security, procedures and monitoring.

Compliance
in four projects.

Formalities do not replace implementation. The program links the CNDP file to internal practices and available evidence.

Inventory

Existing interviews, processing activities, databases, tools, service providers, flows and documents.

Formalities

Qualification of the regime and preparation of the elements required according to the situation.

Documentation

Information, consent where relevant, contracts, durations and procedures.

Implementation

Action plan, responsibilities, safety, awareness and review schedule.

What we
Can fit.

The proposal is adapted to the processing activities actually concerned. It distinguishes between support, internal actions and possible specialized legal needs.

Construction site Analysis Documents Implementation HR management Purposes and access Information and durations Authorizations Site and forms Tracers and collection Privacy and cookies Settings to coordinate Video surveillance/control Necessity and scope Information and register Access and conservation Transfers abroad Flows and recipients Guarantees file Actions to follow

An adapted folder
to your activity.

Does any company have to carry out the same formality? −

No. Qualification depends on the nature of the processing, data, purposes and flows. The diagnosis serves precisely to avoid a standard approach which does not correspond to the real situation.

Can RGPD Conseil Maroc prepare the CNDP file? +

RGPD Conseil Maroc can map the processing, organize the information, prepare the parts and support operational monitoring. The exact scope and person responsible for filing are confirmed in the proposal.

Does Law 09-08 replace the GDPR? +

No. An organization in Morocco may have to take into account Law 09-08 and, depending on its activities, the European GDPR. The fields of application and obligations must be analyzed separately and then coordinated.

What is the price? +

The budget depends on the number of processing activities, formalities, sites, flows and existing documentation. An initial framework makes it possible to propose a firm price per scope.

Start by qualifying your processing activities.

Describe your activities, your tools, the data collected and any transfers. We will build the perimeter before proposing the formalities and deliverables.