Teach with confidence. Protect every learner.

Your activity,
its real flows.

Digital tools are multiplying the players: educational platform, videoconferencing, messaging, parent application, payment, transport, canteen, video surveillance and content providers. A simple list of apps is not enough; you need to understand the accounts, data, roles, countries and parameters used.

RGPD Conseil Maroc organizes processing compliance and evidence, with an approach understandable by management, teachers, administration, families and IT. The mission does not replace the analysis of all educational regulations or the educational decisions of the establishment.

Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.

Triggers
most common.

A mission may begin before a launch, during a negotiation or after a gap appears.

New educational tool

ENT, LMS, videoconferencing, AI, parent application or assessment solution.

Registration and communication

Forms, documents, health, image rights, campaigns and events.

Incident or request

Account compromised, distribution of a list, photo published or request from a family.

A journey
in four stages.

Decisions and limits are made visible at each stage.

Map

Application, registration, education, services, communication, archive and alumni.

Distinguish

Student, parent, manager, staff, provider and recipient.

Frame

Information, authorizations, conservation, tools, images, rights and incidents.

Forward

Train teams, explain to families and maintain controls.

What the documents
Don't always show.

These situations are points of analysis, not automatic conclusions.

Data of minors

Information, proportionality and protection must be adapted to the public.

Images and publications

A vague authorisation does not necessarily cover all media and uses.

Free platforms

Conditions, secondary uses, advertising, countries and settings should be checked.

Shared lists

Notes, absences, health or contacts may be broadcast to too large a group.

Old accounts

Access from former students, teachers or service providers must be deactivated.

Educational AI

Data sent to an AI service and assisted decisions require specific privacy framework.

Measures that
teams can apply.

Each check must have a responsible person, frequency and proportionate proof.

Tools catalog

Internal owner, supplier, data, accounts, country and purpose.

Access profiles

Separate direction, administration, teacher, health, parent, student and provider.

Image rules

Purpose, medium, duration, withdrawal and archiving clearly organized.

Duration per route

Candidates, students, evaluations, health, billing, alumni and communication.

Incident procedure

Simple reporting, immediate protection, analysis and proportionate communication.

Contextualized training

Concrete cases for teachers, administration, communication, IT and management.

What RGPD Conseil Maroc
Leave it to your teams.

The final scope depends on maturity, risks and elements already available.

Education register

Teaching, administrative, security, communication and services.

Tool matrix

Platforms, contracts, data, countries, accounts and settings to correct.

Information pack

Registration, students, parents, staff, images and digital tools.

Access Matrix

Roles, permissions, approvals and review schedule.

Procedures

Rights, incidents, publications, accounts and new tools.

Training program

Sessions and materials adapted to the functions of the institution.

GDPR and law 09-08,
I didn't confuse them.

The same activity may fall within both frameworks for different reasons.

EU

GDPR

Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.

MA

Law 09-08

Treatment in Morocco, rights, security and formalities of declaration or authorization.

↔

International flows

Access, hosting, recipients, mechanism, context and additional measures.

✓

Evidence

Contracts, registers, decisions, controls, training, incidents and actions followed.

Start small.
Maintain if necessary.

The amounts are confirmed after scoping; no fictitious pricing is published.

DIAGNOSIS

Starting point

Targeted interviews, review of available elements, major risks and sectoral roadmap.

Fixed price · after scoping TARGETED MISSION

Priority base

Agreed deliverables, corrections, review meeting and operational transfer to internal managers.

From — on estimate ACCOMPANYING

Continuous management

Volume, deadlines, meetings, controls, new projects and contract overruns.

Subscription · on quote

Advise, structure
and advance.

RGPD Conseil Maroc provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.

• Penetration tests, forensic investigations and certifications are carried out by competent experts.
• Reserved legal consultations and litigation are directed to a lawyer.
• Sectoral regulations excluding data protection remain outside the scope unless expressly stated.

CNDP filings →CNDP formalitiesGDPR responsibilities

Specific responses.
Contextualized decisions.

These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.

Is a general permission of right to image sufficient for all education? −

An authorization must be understandable and linked to sufficiently precise uses. Public website, social network, private space, brochure and archive do not present the same issues. The institution must also organise the withdrawal and avoid an unjustly penalising the pupil.

Can you use any app recommended by a teacher? +

Before use, the establishment must verify the purpose, the accounts created, the data sent, the supplier, the countries, the parameters and the contract. Being easy or free does not exempt you from this qualification, particularly when minors are involved.

Who can access a student’s health information? +

Only persons with a real need for care or organization must receive the necessary information. Medical detail should not circulate widely. Circuits, emergencies, documents and authorizations are separated from regular educational records.

How to respond to a parent asking for all their child's data? +

The establishment must verify the identity and status of the applicant, locate the data, protect the rights of other people and take into account the age and situation. The response is prepared in a secure and documented manner, with legal advice if a complex family situation requires it.

Can an AI platform receive students' work? +

This transfer must be evaluated before use: content, identifiers, conservation, reuse, model training, countries, rights and alternatives. RGPD Conseil Maroc covers data protection analysis, not general AI Act compliance or educational evaluation of the tool.

Does RGPD Conseil Maroc audit all regulatory compliance of the school? +

No. The intervention is limited to data protection and associated processes. Educational, accreditation, physical security or school organization obligations remain handled by the competent specialists and authorities.

Your sector deserves A concrete scoping.

Present your tools, data, customers, suppliers, countries and deadlines. RGPD Conseil Maroc will indicate the first useful perimeter.

Keep reading

• Serve your mission. Protect your people.
• Convert customers. Keep their trust.
• Health data. Essential trust.
• Welcome guests. Control their data.