MoroccoLoi n° 05-20 relative à la cybersécurité, Digital Service Provider and Platform Operator Incident and Vulnerability Notification Duties
Loi n° 05-20 relative à la cybersécurité Chapitre II, Section 3, Arts. 27, 30 et 33, promulguée par le Dahir n° 1-20-69 du 4 hija 1441 (25 juillet 2020), Bulletin Officiel n° 6904 du 9 hija 1441 (30 juillet 2020), texte en langue arabe
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.dgssi.gov.ma/sites/default/files/legislative/brochure/2023-03/loi%2005-20.pdfIn force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting, Disclosure
What it requires
- This duty reaches you on the same terms as Loi n° 05-20's other opérateur security duties: you operate an online marketplace or service-contract platform, a search engine, a datacenter or cloud-computing hosting service, or you publish an Internet platform.
- Inform your clients of a vulnerability in your information systems, or of a breach that could affect them.
- When you detect an event that could affect the security of a client's information systems, inform the national cybersecurity authority of it without delay.
- If you are a digital service provider, as soon as you become aware of an incident affecting the networks or information systems your service needs, declare it to the national cybersecurity authority where the information available to you shows the incident has a significant impact on providing that service.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 50 fixes a fine of 100,000 to 200,000 dirhams for a breach of the Article 30 or Article 33 incident-notification duties, the same tier Article 8's parallel duty on an entité draws; Article 52 doubles the sanction on recidivism within four years. Article 27's client-notification duty is not among the provisions Chapter V lists as carrying a fine.
- Rule
- Fixed only
- As of
- Minimum
- 100,000
- Currency
- MAD
- Fixed cap
- 200,000
Who enforces it
Enforcement body
The national cybersecurity authority (autorité nationale) Loi n° 05-20 creates; DGSSI (Direction Générale de la Sécurité des Systèmes d'Information) operates in that role per its own published materials.
What this law does
Chapter II, Section 3 of Loi n° 05-20 relative à la cybersécurité also binds the same opérateur class, a public telecommunications network operator, an Internet access provider, a cybersecurity service provider, a digital service provider, and an Internet platform publisher, to three notification duties with their own clocks. Article 27 requires an opérateur to inform its clients of a vulnerability in its information systems, or of a breach that could affect them.
Article 30 requires an opérateur, on detecting an event that could affect the security of a client's information systems, to inform the national cybersecurity authority of it without delay.
Article 33 requires a digital service provider specifically, as soon as it becomes aware of an incident affecting the networks or information systems its service needs, to declare the incident to the national authority where the information available to it shows the incident has a significant impact on providing that service.
A violation of Article 30 or 33 draws the same fine of 100,000 to 200,000 dirhams under Article 50 that Article 8's parallel duty on an entité draws, doubled on recidivism within four years under Article 52; Article 27's client-notification duty is not among the provisions Article 50 lists.
Article 53 defers the law's own entry into force to the date the Official Gazette publishes the texts taken for its application; Décret n° 2-21-406 of 4 hija 1442 (), the decree taken for the Law's application, was published in Bulletin Officiel n° 7011 of 29 hija 1442 (), the day the Law came into force.
When LexLint raises it
When your app profile says your app operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .