RCM
New program
Collection of beneficiaries, survey, help, support or field research.
ASSOCIATIONS · NGO · SOLIDARITY
Serve your mission.
Serve your mission.
Protect your people.
An association can handle few cases but a lot of sensitive information: vulnerability, health, family status, opinions, convictions, assistance received or location. The confidence of beneficiaries, members and donors depends on measured use and communication that does not expose them.
BENEFICIARIESDONATORSPARTNERSSENSITIVE DATA
Your activity,
its real flows.
Permanent teams, volunteers, donors, partners, donation platforms, free tools and international service providers create a specific governance. A person can have several roles and a file created for one project should not be automatically reused for another campaign.
RCM offers compliance proportionate to the organization's resources: prioritizing risky processing, clarifying responsibilities, limiting access, supervising partners and producing essential evidence. The mission does not cover the complete regulation of associations, financing or social programs.
Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.
WHEN TO COME
Triggers
Triggers
most common.
A mission may begin before a launch, during a negotiation or after a gap appears.
International lessor
Questionnaire, sharing agreement, hosting or nominative reporting requested.
Public campaign
Donations, petition, newsletter, testimonials, photos or event.
FROM THE FIELD TO EVIDENCE
A journey
A journey
in four stages.
Decisions and limits are made visible at each stage.
Census
Members, volunteers, donors, beneficiaries, employees, partners and public.
To prioritize
Sensitivity, vulnerability, volume, publication, countries and possible consequences.
Frame
Information, choice, access, sharing, conservation, contracts and security.
Make it sustainable
Simple, accountable templates, training, controls and project closure.
SECTORAL RISKS
What the documents
What the documents
Don't always show.
These situations are points of analysis, not automatic conclusions.
Vulnerable beneficiaries
Disclosure can result in stigma, discrimination or physical risk.
Reuse of files
Program contact information does not automatically become a campaign list.
Multiple partners
The roles and responsibilities for collecting, sharing, reporting and curation should be explicit.
Publication of testimonials
Text, photo, location or personal history can identify a person.
Free tools
The business model, countries, accounts and data reuse must be verified.
End of financing
Data should not remain in project accounts and devices indefinitely.
OPERATIONAL CONTROLS
Measures that
Measures that
teams can apply.
Each check must have a responsible person, frequency and proportionate proof.
Minimize collection
Request only information useful for the service, follow-up or proof required.
Separate programmes
Separate access, lists, purposes and durations for each activity when necessary.
Protect posts
Contextualized validation, anonymization, removal and re-identification risk verification.
Supervise partners
Agreement on roles, uses, security, incidents, rights and fate of data.
Close projects
Inventory, justified archive, deletion, review meeting and revocation of access.
Train volunteers
Simple rules on collection, messaging, devices, photos, sharing and reporting.
DELIVERY
What RCM
What RCM
Leave it to your teams.
The final scope depends on maturity, risks and elements already available.
Associative mapping
Programs, people, data, tools, partners and countries.
Prioritized registry
Essential treatment and special risks for beneficiaries.
Collection pack
Notices, forms, contextualized consents and minimization rules.
Partner agreements
Clauses and matrix of responsibilities for sharing or subcontracting.
Testimonial guide
Decision, information, image, anonymization, publication and withdrawal.
Project kit
Checklist for launch and closure, access, retention and incident.
TWO FRAMES
GDPR and law 09-08,
GDPR and law 09-08,
I didn't confuse them.
The same activity may fall within both frameworks for different reasons.
GDPR
Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.
Law 09-08
Treatment in Morocco, rights, security and formalities of declaration or authorization.
International flows
Access, hosting, recipients, mechanism, context and additional measures.
Evidence
Contracts, registers, decisions, controls, training, incidents and actions followed.
INTERVENTION FORMATS
Start small.
Start small.
Maintain if necessary.
The amounts are confirmed after scoping; no fictitious pricing is published.
Starting point
Targeted interviews, review of available elements, major risks and sectoral roadmap.
Fixed price · after scopingPriority base
Agreed deliverables, corrections, review meeting and operational transfer to internal managers.
From — on estimateContinuous management
Volume, deadlines, meetings, controls, new projects and contract overruns.
Subscription · on quote
RESPONSIBILITIES AND LIMITS
Advise, structure
Advise, structure
and advance.
RCM provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.
- Penetration tests, forensic investigations and certifications are carried out by competent experts.
- Reserved legal consultations and litigation are directed to a lawyer.
- Sectoral regulations excluding data protection remain outside the scope unless expressly stated.
FREQUENTLY ASKED QUESTIONS
Specific responses.
Specific responses.
Contextualized decisions.
These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.
Is an association exempt from the Data Act? −
No. The non-profit nature does not remove data protection obligations. The scope depends on the processing activities, people, places and means used. A proportionate approach allows efforts to be focused on the most significant risks without replicating the governance of a large group.
Can we publish the photo and story of a beneficiary with their consent? +
The agreement must be free, understandable and sufficiently precise, particularly in situations of vulnerability or dependence. The medium, audience, duration, possibility of removal and risk of re-identification must be considered. An anonymized alternative should be favored when exposure is not necessary.
Can a lessor require a nominative list of beneficiaries? +
The request must be linked to a purpose, a necessity and a sharing framework. It should be considered whether aggregated or pseudonymized data is sufficient, who will receive the information, in which country, how securely and for how long. The financing contract does not automatically settle all these points.
How to manage data on volunteers' phones? +
The organization should reduce local copying, offer approved channels, protect accounts, plan for reporting, and arrange for deletion at the end of the engagement. A short charter and practical training are often more effective than a general policy that is not applied.
Can donor lists be used for future campaigns? +
It is necessary to distinguish between the management of the donation, the obligations of proof and future communication. The information, the channel, the choices and the right to object must be organized. A list received from a partner or created for an event must not be reused without analysis.
Does RCM cover the rules relating to financing and associations? +
No. RCM intervenes on the protection of personal data. Obligations relating to status, financing, taxation, anti-money laundering or social programs are handled by competent specialists.
Your sector deserves A concrete scoping.
Present your tools, data, customers, suppliers, countries and deadlines. RCM will indicate the first useful perimeter.
Scoping the mission →