Handles health records, in Morocco

Loi n° 09-08, arts. 12(1), 21-22, 24, 49-50 (données sensibles et catégories protégées) · Read the law's page

• Do not process sensitive data, meaning data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data including genetic data, without a specific legal authorization, the CNDP's prior authorization, or the data subject's express consent.
• Where you process health data solely for preventive medicine, medical diagnosis, care, or health service management under a practitioner's or an equally bound person's professional secrecy, file a declaration with the CNDP rather than seeking its prior authorization.
• Where you process sensitive or health data, put in place the heightened technical measures Article 24 lists: control who can enter the processing facility, who can read, copy, modify, or remove the data media, and who can access, transmit, or input the data, and keep a record of what sensitive data was input, when, and by whom.
• Do not process personal data about offenses, criminal convictions, or security measures unless you are a court, a public authority, a public service body, or an auxiliary of justice acting within your legal duties.