MoroccoLaw No. 09-08, transfer of data to a foreign country
Loi n° 09-08, arts. 43-44 (transfert de données vers un pays étranger)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdfIn force.
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Do not transfer personal data to a foreign country unless that country appears on the CNDP's list of states that ensure a sufficient level of protection.
- Where the destination country is not on that list, transfer personal data only with the data subject's express consent, under one of the Article 44 necessity grounds, under a bilateral or multilateral agreement Morocco is party to, or with the CNDP's own express and reasoned authorization.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 43 bars transferring personal data to a foreign state unless it ensures a sufficient level of protection, judged on the state's rules, security measures and the processing's purpose and duration, and has the Commission keep the list of such states; Article 44 lists the derogations. They are conditions on a transfer and require no log or record to be made, kept or produced. The list is the Commission's own and is not a record the controller keeps. No scope clause is cited.
- Kind
- None
- As of
What this law does
Article 43 bars a controller from transferring personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms with regard to the processing, judged by the state's rules, its security measures, and the processing's purpose, duration, origin and destination, and the CNDP maintains the list of states meeting that standard.
Article 44 lets a controller transfer to a state that does not meet it where the data subject has expressly consented, or without that consent where the transfer is necessary to save the person's life, to preserve the public interest, to establish, exercise or defend a legal claim, to perform a contract with the data subject or precontractual measures at their request, to perform a contract concluded in the data subject's interest between the controller and a third party, to carry out international judicial assistance, or to prevent, diagnose or treat a medical condition; it also permits a transfer under a bilateral or multilateral agreement Morocco is party to, or on the CNDP's own express and reasoned authorization where contractual clauses or internal rules ensure a sufficient level of protection.
The law's final and transitional articles state no day of its own for its entry into force.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .