Financial data. Zero shortcuts.

Your activity,
its real flows.

Onboarding alone moves identity documents, proof of income, bank statements and sometimes health declarations. Scoring and underwriting turn that data into a decision that must stay explainable. Claims, recovery and files shared with brokers, reinsurers or external agencies extend the chain further, and branch recordings and video surveillance add another stream most teams don't map.

RGPD Conseil Maroc works on data protection governance, formalities, contracts, procedures and evidence. The mission does not constitute a prudential or anti-money-laundering audit, nor a credit-risk certification, nor an exhaustive analysis of all the financial regulations applicable to the institution.

Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.

Triggers
most common.

A mission may begin before a launch, during a negotiation or after a gap appears.

New product or channel

Mobile onboarding, a new credit line, a bancassurance product or a fintech partnership.

External sharing

Broker, reinsurer, recovery agency, auditor or a cloud tool hosted outside Morocco.

Incident or control

A data breach, a misdirected file, a regulator's request or the need to demonstrate your measures.

A journey
in four stages.

Decisions and limits are made visible at each stage.

Map

Onboarding, scoring, claims, recovery, archiving and any data shared with a group or foreign tool.

To prioritize

ID numbers, health data, credit decisions, call recordings and cross-border transfers.

Secure

Roles, contracts, procedures, authorizations, traceability and continuity.

Control

Access reviews, incidents, new products, providers and documentation.

What the documents
Don't always show.

These situations are points of analysis, not automatic conclusions.

Identity copy

A scanned ID card is collected for KYC, then kept, shared or re-used well past what onboarding required.

A scoring decision

An automated score denies or prices a product with no documented, explainable basis.

Health data at the wrong desk

Medical information for a life or health policy reaches staff who have no reason to see it.

An unannounced recording

Call recording or branch video surveillance runs without the notice the people concerned are entitled to.

A recovery file in the wrong hands

A collection agency or external provider receives a file with no contract framing what it can do with it.

A transfer no one tracked

A group tool, reinsurer or cloud platform hosted abroad receives data with no transfer mechanism in place.

Measures that
teams can apply.

Each check must have a responsible person, frequency and proportionate proof.

KYC minimisation

Collect only what onboarding needs, and retire copies once their purpose is served.

Explainable scoring

Document the logic behind automated decisions and keep a path to human review.

Restricted health access

Limit life and health files to the staff whose role requires them.

Disclosed recording

Clear notice at the branch and on calls, with a defined retention period.

Framed providers

Contracts with brokers, reinsurers and recovery agencies that state purpose, access and retention.

Mapped transfers

Every foreign tool or group flow identified, with the right transfer mechanism attached.

What RGPD Conseil Maroc
Leave it to your teams.

The final scope depends on maturity, risks and elements already available.

Flow mapping

Onboarding, scoring, claims, recovery, archiving, partners and countries involved.

Priority register

Sensitive processing, purposes, legal bases, retention and existing measures.

Access matrix

Front office, underwriting, claims, recovery and external profiles.

Incident procedure

Qualification, roles, escalation, evidence and communications.

Provider review

Brokers, reinsurers, recovery agencies, hosting and group tools.

Control plan

Access, recordings, sharing, archiving and periodic testing.

GDPR and law 09-08,
I didn't confuse them.

The same activity may fall within both frameworks for different reasons.

EU

GDPR

Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.

MA

Law 09-08

Treatment in Morocco, rights, security and formalities of declaration or authorization.

↔

International flows

Access, hosting, recipients, mechanism, context and additional measures.

✓

Evidence

Contracts, registers, decisions, controls, training, incidents and actions followed.

Start small

Start small.
Maintain if necessary.

The amounts are confirmed after scoping; no fictitious pricing is published.

DIAGNOSIS

Starting point

Targeted interviews, review of available elements, major risks and sectoral roadmap.

Fixed price · after scoping TARGETED MISSION

Priority base

Agreed deliverables, corrections, review meeting and operational transfer to internal managers.

From — on estimate ACCOMPANYING

Continuous management

Volume, deadlines, meetings, controls, new projects and contract overruns.

Subscription · on quote

Advise

Advise, structure
and advance.

RGPD Conseil Maroc provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.

• Penetration tests, forensic investigations and certifications are carried out by competent experts.
• Reserved legal consultations and litigation are directed to a lawyer.
• Sectoral regulations excluding data protection remain outside the scope unless expressly stated.

Incidents and rights →CNDP formalitiesGDPR responsibilities

Specific responses

Specific responses.
Contextualized decisions.

These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.

Does KYC data always require CNDP authorization? −

Identity-document processing for KYC falls within a sensitive category in Morocco and often requires prior authorization rather than a simple declaration. The exact regime depends on the processing, its purpose and who is responsible. RGPD Conseil Maroc prepares the analysis and the file without promising the CNDP's decision.

Can a scoring model refuse a client with no explanation? +

An automated decision that produces legal or similarly significant effects generally needs a documented basis and a path to human review. The exact obligation depends on the process and applicable rules, and should be confirmed case by case.

Does RGPD Conseil Maroc audit anti-money-laundering compliance? +

No. RGPD Conseil Maroc examines data protection governance, available evidence, contracts, access and procedures. AML obligations, prudential rules and credit-risk certification are reviewed by the competent specialists.

Who can see health data collected for a life or health policy? +

Access should be limited to the staff whose role requires it, with authorizations defined by function and traceability to verify how the data is actually used.

What happens when a file is shared with a recovery agency? +

The agency should be bound by a contract that states purpose, access, retention and security, and the transfer should be checked against the rules that apply when the provider or its tools sit outside Morocco.

Your sector deserves A concrete scoping.

Present your tools, data, customers, suppliers, countries and deadlines. RGPD Conseil Maroc will indicate the first useful perimeter.

Keep reading

• Serve your mission. Protect your people.
• Convert customers. Keep their trust.
• Health data. Essential trust.
• Welcome guests. Control their data.