Build from Morocco. Keep client data under control.

Your activity,
its real flows.

The risk often appears in the details: production copy used in acceptance, shared administrator account, undeclared freelance processor, repository containing data, support from Morocco or retention of a backup after the mission. RGPD Conseil Maroc links these situations to the roles of the parties, the client's instructions, the applicable clauses and the actually demonstrable measures.

Our intervention does not transform a privacy review into a cybersecurity audit. It organizes the facts, evidence and corrections necessary to respond to a customer questionnaire, prepare a call for tenders or make an offshore development system sustainably verifiable.

Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.

Triggers
most common.

A mission may begin before a launch, during a negotiation or after a gap appears.

Customer environment

Access to production, support or copies of data from a team established in Morocco.

New European contract

Security questionnaire, DPA, transfer clauses and proof requested before signing.

Subcontracting chain

Freelancers, hosts, ticketing tools, code repositories and subsequent providers to be identified.

A journey
in four stages.

Decisions and limits are made visible at each stage.

Frame

Applications, teams, environments, data, countries, customers and processors.

Trace

Access, copies, logs, tools, transfers and deletion rules.

Frame

DPA, Article 28, standard contractual clauses, instructions and additional measures.

Prove

Supplier register, access matrix, incident procedure and customer file.

What the documents
Don't always show.

These situations are points of analysis, not automatic conclusions.

Production data under test

A realistic copy accelerates development but increases exposure and control obligations.

Technical privileges

Administration accounts, remote access and secrets must be nominative, limited and traced.

Invisible processors

A SaaS freelance or tool can change the contractual chain and the access locations.

End of mission

The review meeting, deletion, revocation of accounts and preservation of evidence must be organized.

Incidents and delays

The service provider must detect, document and quickly report events to the principal.

EU–Morocco transfer

The mechanism, context and measurements of the transfer must correspond to actual accesses.

Measures that
teams can apply.

Each check must have a responsible person, frequency and proportionate proof.

Separate environments

Fictitious or pseudonymized data by default, exceptional procedure for any production copy.

Manage authorizations

Nominative accounts, least privilege, periodic reviews and revocation upon exit.

Master the tools

Inventory of deposits, tickets, communications, hosts and processors.

Document the transfer

Clauses, context assessment, additional measures and customer information.

Prepare for the incident

Alert channel, minimum information, contractual deadlines and retention of facts.

Close properly

End of mission checklist, verifiable deletion, review meeting and closure of access.

What RGPD Conseil Maroc
Leave it to your teams.

The final scope depends on maturity, risks and elements already available.

Technical mapping

Applications, environments, teams, tools, access, data and countries.

DPA Review

Clauses article 28, instructions, assistance, audit, incident and fate of data.

Transfer file

CSC explained, transferred analysis and proposed additional measures.

Access Matrix

Profiles, justification, approval, review and revocation.

Customer questionnaire kit

Spoken responses, evidence available, discrepancies and responsible.

Remediation plan

Stocks categorized by risk, effort, ownership and maturity.

GDPR and law 09-08,
I didn't confuse them.

The same activity may fall within both frameworks for different reasons.

EU

GDPR

Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.

MA

Law 09-08

Treatment in Morocco, rights, security and formalities of declaration or authorization.

↔

International flows

Access, hosting, recipients, mechanism, context and additional measures.

✓

Evidence

Contracts, registers, decisions, controls, training, incidents and actions followed.

Start small.
Maintain if necessary.

The amounts are confirmed after scoping; no fictitious pricing is published.

DIAGNOSIS

Starting point

Targeted interviews, review of available elements, major risks and sectoral roadmap.

Fixed price · after scoping TARGETED MISSION

Priority base

Agreed deliverables, corrections, review meeting and operational transfer to internal managers.

From — on estimate ACCOMPANYING

Continuous management

Volume, deadlines, meetings, controls, new projects and contract overruns.

Subscription · on quote

Advise, structure
and advance.

RGPD Conseil Maroc provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.

• Penetration tests, forensic investigations and certifications are carried out by competent experts.
• Reserved legal consultations and litigation are directed to a lawyer.
• Sectoral regulations excluding data protection remain outside the scope unless expressly stated.

GDPR compliance →CNDP formalitiesGDPR responsibilities

Specific responses.
Contextualized decisions.

These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.

Does a team in Morocco connect to a European server make a transfer? −

Remote access from a third country may constitute a transfer even if the data remain hosted in the Union. It is necessary to examine who has access, under what authority, for what purposes and with what guarantees. RGPD Conseil Maroc documents the actual scenario before recommending the appropriate mechanism and measures.

Can we use production data for testing? +

This choice must remain exceptional, justified and surrounded by strict measures. The priority is to use fictitious, synthetic or properly pseudonymized data. When real data is essential, the perimeter, access, duration, security and deletion must be precisely validated and traced.

Does RGPD Conseil Maroc perform a penetration test? +

No. RGPD Conseil Maroc examines evidence, access governance and consistency of privacy responses. Penetration tests, code reviews, architectural audits and technical investigations are carried out by cybersecurity specialists. We can coordinate findings that influence data protection.

What should the contract with the European customer contain? +

The contract should reflect actual roles and, when it comes to outsourcing, cover the requirements of Article 28: instructions, confidentiality, security, sub-processors, support, incidents, audit and fate of data. Transfers require separate processing consistent with access from Morocco.

How to reassure a prospect without pretending to be certified? +

Present verifiable evidence: access matrix, applied policies, sample reviews, incident procedure, processor register, training and remediation plan. RGPD Conseil Maroc avoids absolute statements and clearly distinguishes between present controls, available evidence and planned improvements.

Does the offer cover Moroccan formalities? +

RGPD Conseil Maroc verifies the implications of Law 09-08, particularly for processing activities and transfers falling within Morocco. A possible CNDP formality is prepared in a separate scope, validated and signed by the organization concerned.

Your sector deserves A concrete scoping.

Present your tools, data, customers, suppliers, countries and deadlines. RGPD Conseil Maroc will indicate the first useful perimeter.

Keep reading

• Serve your mission. Protect your people.
• Convert customers. Keep their trust.
• Health data. Essential trust.
• Welcome guests. Control their data.