RCM
New HR tool
ATS, HRIS, payroll, badge reader, access control or evaluation platform.
HR · RECRUITMENT · PAYROLL
Protect the people
Protect the people
behind every HR record.
Human resources processes information throughout a relationship that sometimes begins before application and continues after departure. CV, evaluations, identity, bank details, absences, health, discipline, access and pay have neither the same sensitivity nor the same useful life.
CANDIDATESCINPEACESENSITIVE DATA
Your activity,
its real flows.
Risks increase when several players are involved: recruitment firm, application platform, payroll software, occupational health, insurer, European headquarters or foreign host. The organization must know who uses what, for what purpose, with what authorizations and according to what deletion schedule.
RCM structures the HR register, information, retention rules, access, suppliers and rights procedures. The intervention concerns data protection; it does not replace advice on labor law or a complete analysis of social obligations.
Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.
WHEN TO COME
Triggers
Triggers
most common.
A mission may begin before a launch, during a negotiation or after a gap appears.
International group
Headquarters access, global reporting, foreign support or hosting outside Morocco.
Social or customer audit
Need to demonstrate rules, authorizations, contracts and deletions.
FROM THE FIELD TO EVIDENCE
A journey
A journey
in four stages.
Decisions and limits are made visible at each stage.
Census
Application, hiring, management, payroll, health, training, discipline and departure.
Qualify
Purposes, bases, sensitive data, CIN, recipients, durations and formalities.
Organize
Mentions, authorizations, conservation, rights, suppliers and transfers.
Maintain
Periodic reviews, new tools, departures, incidents and evidence.
SECTORAL RISKS
What the documents
What the documents
Don't always show.
These situations are points of analysis, not automatic conclusions.
CVs kept without rules
Unsuccessful and pooled applications must follow an explicit purpose and duration.
Access too wide
Managers, HR, payroll, IT and service providers do not need the same information.
Sensitive data
Health, disability, trade union membership or biometrics require increased vigilance.
CIN and documents
The copying, use and transmission of identity documents must be justified and protected.
Monitoring
Badge machine, geolocation, video surveillance or tool control require specific analysis.
Departure of the employee
Accounts, files, access, archives and disputes do not follow a single deletion date.
OPERATIONAL CONTROLS
Measures that
Measures that
teams can apply.
Each check must have a responsible person, frequency and proportionate proof.
Separate folders
Logical organization between application, administrative file, health, discipline and pay.
Limit authorizations
Profiles by role, approval, confidentiality, review and removal at job change.
Set durations
Table by category and trigger event, with intermediate archiving if necessary.
Inform clearly
Mentions adapted to candidates, employees, visitors and users of the tools.
Control providers
Contracts, location, support access, security and review meeting at the end of service.
Prepare the rights
Coordinated research, third party protection, documented decision and secure response.
DELIVERY
What RCM
What RCM
Leave it to your teams.
The final scope depends on maturity, risks and elements already available.
HR register
Processing, purposes, databases, data, recipients, durations and security.
Empowerment Matrix
Access by role and system, validation, review and revocation.
Conservation policy
Candidates, employees, pay, training, access, discipline and departure.
HR mentions
Application, onboarding, internal tools and specific systems.
Supplier review
ATS, payroll, HRIS, insurance, training and support.
Compliance plan
Actions, responsible, HR/IT/legal dependencies and calendar.
TWO FRAMES
GDPR and law 09-08,
GDPR and law 09-08,
I didn't confuse them.
The same activity may fall within both frameworks for different reasons.
GDPR
Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.
Law 09-08
Treatment in Morocco, rights, security and formalities of declaration or authorization.
International flows
Access, hosting, recipients, mechanism, context and additional measures.
Evidence
Contracts, registers, decisions, controls, training, incidents and actions followed.
INTERVENTION FORMATS
Start small.
Start small.
Maintain if necessary.
The amounts are confirmed after scoping; no fictitious pricing is published.
Starting point
Targeted interviews, review of available elements, major risks and sectoral roadmap.
Fixed price · after scopingPriority base
Agreed deliverables, corrections, review meeting and operational transfer to internal managers.
From — on estimateContinuous management
Volume, deadlines, meetings, controls, new projects and contract overruns.
Subscription · on quote
RESPONSIBILITIES AND LIMITS
Advise, structure
Advise, structure
and advance.
RCM provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.
- Penetration tests, forensic investigations and certifications are carried out by competent experts.
- Reserved legal consultations and litigation are directed to a lawyer.
- Sectoral regulations excluding data protection remain outside the scope unless expressly stated.
FREQUENTLY ASKED QUESTIONS
Specific responses.
Specific responses.
Contextualized decisions.
These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.
Can we keep all CVs received for future recruitment? −
A pool can meet a real need, but it must be distinguished from current recruitment. Candidates must receive appropriate information, have a means of exercising their rights and a duration must be defined. Keeping all CVs indefinitely without use or updating is difficult to justify.
Who can access an employee’s health data? +
Access must be strictly limited to the necessary people and information. A manager generally does not need medical details to organize an absence. RCM helps to separate circuits, roles, documents and authorizations, without replacing professionals or obligations relating to occupational medicine.
Is a badger or biometric device still allowed? +
No. Necessity, proportionality, the nature of the data and alternatives must be examined. Certain systems may be subject to reinforced formalities or requirements. RCM carries out the privacy framework and guides specialized technical or legal questions when the system requires it.
Can the European headquarters consult the Moroccan HRIS? +
This access must be mapped and qualified with regard to the two applicable frameworks. It is necessary to specify the role of the headquarters, the purposes, the categories consulted, the countries, security and transfer guarantees. Mere membership in the same group does not exempt you from this analysis.
How long should a former employee's file be kept? +
There is no single duration for the entire file. Payroll, social obligations, contractual proofs, litigation, access and operational documents may follow separate rules. The retention table identifies the purpose, starting point, access during archiving, and final deletion.
Does RCM provide employment law advice? +
No. The mission concerns data protection and the organization of evidence. Any question relating specifically to labor law, disciplinary proceedings or litigation is handled by the client's competent legal advisors.
Your sector deserves A concrete scoping.
Present your tools, data, customers, suppliers, countries and deadlines. RCM will indicate the first useful perimeter.
Scoping the mission →