Sends automated outreach, in Morocco

Loi n° 09-08, arts. 27-42, 51-66 (Commission nationale, sanctions) · Read the law's page

• Cooperate with the CNDP's investigations, give its commissioned agents access to your processing facilities, data, and documents, and comply with any order it issues to correct, block, erase, or destroy data, or to suspend or halt a processing operation.
• Comply at once with a CNDP decision withdrawing your declaration receipt or authorization because your processing threatens public security or order or offends morality.
• Expect a fine of 10,000 to 100,000 dirhams for processing personal data without the required declaration or authorization, or for continuing after your receipt or authorization is withdrawn.
• Expect a fine of 20,000 to 200,000 dirhams per infraction, and for several of these the same fine plus imprisonment of three months to one year, for refusing an access, rectification, or objection request, collecting data unlawfully, processing beyond the declared purpose, keeping data past its retention period, processing without the required consent, running inadequate security measures, disregarding a legitimate objection, or transferring data abroad unlawfully.
• Expect imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the highest tier the law sets, for processing sensitive data or offense and conviction data without the required consent or authorization, doubled if you are a legal person and doubled again if you offend again within a year.

Loi n° 09-08, arts. 5-10 (droits de la personne concernée) · Read the law's page

• Before or when you collect personal data directly from the data subject, tell them, expressly, precisely, and unambiguously, your identity, the purposes of the processing, and, where fair processing requires it, the recipients, whether their response is mandatory, and their access and rectification rights.
• Where you did not collect the data from the data subject, give them that same information no later than the first disclosure to a third party, unless they already have it.
• On request, confirm to a data subject, at reasonable intervals, without delay and free of charge, whether you are processing their personal data, and tell them the purposes, the categories of data, the recipients, and, where available, the data's origin.
• On a data subject's request, update, rectify, erase, or block personal data whose processing does not comply with the law, free of charge, within ten clear days, and notify anyone the data was disclosed to of the correction.
• Honor a data subject's objection to processing on legitimate grounds, and their objection, free of charge, to having their data used for marketing by you or by any later processor.
• Do not send direct marketing by automated call, fax, or electronic mail to anyone who has not given prior consent, and, for the narrow email exception the law allows to existing customers, always let the recipient opt out, free of charge, of further messages.