MoroccoLaw No. 09-08, the CNDP and sanctions
Loi n° 09-08, arts. 27-42, 51-66 (Commission nationale, sanctions)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdfIn force.
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Cooperate with the CNDP's investigations, give its commissioned agents access to your processing facilities, data, and documents, and comply with any order it issues to correct, block, erase, or destroy data, or to suspend or halt a processing operation.
- Comply at once with a CNDP decision withdrawing your declaration receipt or authorization because your processing threatens public security or order or offends morality.
- Expect a fine of 10,000 to 100,000 dirhams for processing personal data without the required declaration or authorization, or for continuing after your receipt or authorization is withdrawn.
- Expect a fine of 20,000 to 200,000 dirhams per infraction, and for several of these the same fine plus imprisonment of three months to one year, for refusing an access, rectification, or objection request, collecting data unlawfully, processing beyond the declared purpose, keeping data past its retention period, processing without the required consent, running inadequate security measures, disregarding a legitimate objection, or transferring data abroad unlawfully.
- Expect imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the highest tier the law sets, for processing sensitive data or offense and conviction data without the required consent or authorization, doubled if you are a legal person and doubled again if you offend again within a year.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Processing sensitive data without the data subject's express consent draws imprisonment of three months to one year, a fine of 50,000 to 300,000 dirhams, or both (Article 57), the statute's highest tier; fraudulent or unlawful collection and an unlawful cross-border transfer each draw imprisonment of three months to one year, a fine of 20,000 to 200,000 dirhams, or both (Articles 54 and 60); an undeclared or unauthorized processing draws a fine only, of 10,000 to 100,000 dirhams, with no imprisonment (Article 52).
Penalty structure
Graduated by offence: an undeclared or unauthorized processing (Art. 52) draws a fine of 10,000 to 100,000 dirhams only; refusing an access, rectification, or objection request (Art. 53) draws a fine of 20,000 to 200,000 dirhams per infraction; fraudulent or unlawful collection (Art. 54), retention beyond the declared duration (Art. 55), and an unlawful cross-border transfer (Art. 60) each draw imprisonment of three months to one year, a fine of 20,000 to 200,000 dirhams, or both; processing sensitive data without express consent (Art. 57) draws imprisonment of three months to one year, a fine of 50,000 to 300,000 dirhams, or both, the highest tier; obstructing CNDP control (Art. 62) draws imprisonment of three to six months, a fine of 10,000 to 50,000 dirhams, or both; and refusing to comply with a CNDP decision (Art. 63) draws imprisonment of three months to one year, a fine of 10,000 to 100,000 dirhams, or both. Article 64 doubles the fine for a legal person, and Article 65 doubles all sanctions on recidivism.
- Rule
- Fixed only
- As of
- Minimum
- 10,000
- Currency
- MAD
- Fixed cap
- 300,000
Who enforces it
Enforcement body
Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)
Settledness
- As of
- Open questions
- Does the reservation in Article 52 of Law No. 09-08 of civil liability toward persons who suffered damage from the offense give a data subject a damages claim of its own against a controller, or does it leave that claim to the general Moroccan law of civil liability?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 27 to 42 set up the Commission nationale (CNDP), its powers and its organization, and Articles 51 to 66 set withdrawal of receipts and authorizations and the penalties. They impose no duty on a controller to make, keep or produce a log or record. Article 30(1) gives the Commission's commissioned agents access to the data being processed, direct access to the premises, and the power to collect and seize the information and documents needed for supervision, and Article 30(2) lets it order documents of any kind to be produced to examine complaints; that is a power to demand production and not a record duty, so it is coded as an on-request check by the regulator. The national register of Articles 45 to 48 is the Commission's own, and no scope clause is cited.
- Kind
- None
- As of
What this law does
Article 27 establishes the CNDP under the Prime Minister to implement and enforce the law, advise the government and parliament on processing-related bills and regulations, and receive declarations, representative notifications and complaints.
Article 28 gives it power to authorize extended retention and response delays, order corrections, issue the Article 12 and Article 21 authorizations, set the adequate-states list, authorize transfers, run the national register, grant security-measure exemptions, escalate a declared processing to authorization, and withdraw a receipt or authorization.
Articles 30-31 give the CNDP's commissioned agents investigative and enforcement powers, including access to processing sites and data and the power to order blocking, erasure, destruction or a halt to processing, exercised under a disciplinary procedure that guarantees the rights of the defense.
Articles 32-42 set the CNDP's composition (a president and six members, all royally appointed, serving five-year terms renewable once), its meeting and voting rules, member incompatibilities and recusal duties, professional secrecy for its members and staff, and its secretariat and committee structure. Article 51 lets the CNDP withdraw a declaration receipt or an authorization, without delay, where the processing it covers threatens public security or order or offends morality.
Articles 52-63 set a graduated penalty ladder: undeclared or unauthorized processing draws a fine of 10,000 to 100,000 dirhams only (Article 52); refusing an access, rectification or objection request draws a fine of 20,000 to 200,000 dirhams per infraction (Article 53); unlawful collection, off-purpose processing, over-retention, processing without the required consent, inadequate security measures, disregarding a legitimate or marketing objection, and an unlawful cross-border transfer each draw imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams (Articles 54-56, 58-60); processing sensitive data or offense and conviction data without the required consent or authorization draws imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the statute's highest tier (Article 57); obstructing CNDP control draws imprisonment of three to six months and a fine of 10,000 to 50,000 dirhams (Article 62); and refusing to comply with a CNDP decision draws imprisonment of three months to one year and a fine of 10,000 to 100,000 dirhams (Article 63).
Article 52 states these criminal sanctions without prejudice to the civil liability of anyone whose fault causes damage, preserving a data subject's ordinary civil claim for compensation. Article 64 doubles fines for a legal person and adds asset confiscation or closure of the establishment as available sanctions, and Article 65 doubles all sanctions on recidivism within a year of a final conviction.
Article 66 lets specially commissioned and sworn CNDP agents, alongside judicial police officers, investigate and record offenses by official report, forwarded to the public prosecutor within five days. The law's final and transitional articles state no day of its own for its entry into force.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .