Serve your mission. Protect your people.

Your activity,
its real flows.

Permanent teams, volunteers, donors, partners, donation platforms, free tools and international service providers create a specific governance. A person can have several roles and a file created for one project should not be automatically reused for another campaign.

RGPD Conseil Maroc offers compliance proportionate to the organization's resources: prioritizing risky processing, clarifying responsibilities, limiting access, supervising partners and producing essential evidence. The mission does not cover the complete regulation of associations, financing or social programs.

Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.

Triggers
most common.

A mission may begin before a launch, during a negotiation or after a gap appears.

New program

Collection of beneficiaries, survey, help, support or field research.

International lessor

Questionnaire, sharing agreement, hosting or nominative reporting requested.

Public campaign

Donations, petition, newsletter, testimonials, photos or event.

A journey
in four stages.

Decisions and limits are made visible at each stage.

Census

Members, volunteers, donors, beneficiaries, employees, partners and public.

To prioritize

Sensitivity, vulnerability, volume, publication, countries and possible consequences.

Frame

Information, choice, access, sharing, conservation, contracts and security.

Make it sustainable

Simple, accountable templates, training, controls and project closure.

What the documents
Don't always show.

These situations are points of analysis, not automatic conclusions.

Vulnerable beneficiaries

Disclosure can result in stigma, discrimination or physical risk.

Reuse of files

Program contact information does not automatically become a campaign list.

Multiple partners

The roles and responsibilities for collecting, sharing, reporting and curation should be explicit.

Publication of testimonials

Text, photo, location or personal history can identify a person.

Free tools

The business model, countries, accounts and data reuse must be verified.

End of financing

Data should not remain in project accounts and devices indefinitely.

Measures that
teams can apply.

Each check must have a responsible person, frequency and proportionate proof.

Minimize collection

Request only information useful for the service, follow-up or proof required.

Separate programmes

Separate access, lists, purposes and durations for each activity when necessary.

Protect posts

Contextualized validation, anonymization, removal and re-identification risk verification.

Supervise partners

Agreement on roles, uses, security, incidents, rights and fate of data.

Close projects

Inventory, justified archive, deletion, review meeting and revocation of access.

Train volunteers

Simple rules on collection, messaging, devices, photos, sharing and reporting.

What RGPD Conseil Maroc
Leave it to your teams.

The final scope depends on maturity, risks and elements already available.

Associative mapping

Programs, people, data, tools, partners and countries.

Prioritized registry

Essential treatment and special risks for beneficiaries.

Collection pack

Notices, forms, contextualized consents and minimization rules.

Partner agreements

Clauses and matrix of responsibilities for sharing or subcontracting.

Testimonial guide

Decision, information, image, anonymization, publication and withdrawal.

Project kit

Checklist for launch and closure, access, retention and incident.

GDPR and law 09-08,
I didn't confuse them.

The same activity may fall within both frameworks for different reasons.

EU

GDPR

Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.

MA

Law 09-08

Treatment in Morocco, rights, security and formalities of declaration or authorization.

↔

International flows

Access, hosting, recipients, mechanism, context and additional measures.

✓

Evidence

Contracts, registers, decisions, controls, training, incidents and actions followed.

Start small.
Maintain if necessary.

The amounts are confirmed after scoping; no fictitious pricing is published.

DIAGNOSIS

Starting point

Targeted interviews, review of available elements, major risks and sectoral roadmap.

Fixed price · after scoping TARGETED MISSION

Priority base

Agreed deliverables, corrections, review meeting and operational transfer to internal managers.

From — on estimate ACCOMPANYING

Continuous management

Volume, deadlines, meetings, controls, new projects and contract overruns.

Subscription · on quote

Advise, structure
and advance.

RGPD Conseil Maroc provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.

• Penetration tests, forensic investigations and certifications are carried out by competent experts.
• Reserved legal consultations and litigation are directed to a lawyer.
• Sectoral regulations excluding data protection remain outside the scope unless expressly stated.

Privacy Risk & Training →CNDP formalitiesGDPR responsibilities

Specific responses.
Contextualized decisions.

These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.

Is an association exempt from the Data Act? −

No. The non-profit nature does not remove data protection obligations. The scope depends on the processing activities, people, places and means used. A proportionate approach allows efforts to be focused on the most significant risks without replicating the governance of a large group.

Can we publish the photo and story of a beneficiary with their consent? +

The agreement must be free, understandable and sufficiently precise, particularly in situations of vulnerability or dependence. The medium, audience, duration, possibility of removal and risk of re-identification must be considered. An anonymized alternative should be favored when exposure is not necessary.

Can a lessor require a nominative list of beneficiaries? +

The request must be linked to a purpose, a necessity and a sharing framework. It should be considered whether aggregated or pseudonymized data is sufficient, who will receive the information, in which country, how securely and for how long. The financing contract does not automatically settle all these points.

How to manage data on volunteers' phones? +

The organization should reduce local copying, offer approved channels, protect accounts, plan for reporting, and arrange for deletion at the end of the engagement. A short charter and practical training are often more effective than a general policy that is not applied.

Can donor lists be used for future campaigns? +

It is necessary to distinguish between the management of the donation, the obligations of proof and future communication. The information, the channel, the choices and the right to object must be organized. A list received from a partner or created for an event must not be reused without analysis.

Does RGPD Conseil Maroc cover the rules relating to financing and associations? +

No. RGPD Conseil Maroc intervenes on the protection of personal data. Obligations relating to status, financing, taxation, anti-money laundering or social programs are handled by competent specialists.

Your sector deserves A concrete scoping.

Present your tools, data, customers, suppliers, countries and deadlines. RGPD Conseil Maroc will indicate the first useful perimeter.

Keep reading

• Convert customers. Keep their trust.
• Health data. Essential trust.
• Welcome guests. Control their data.
• Protect the people behind every HR record.