MoroccoLaw No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel promulguée par le Dahir n° 1-09-15 du 22 safar 1430 (18 février 2009), arts. 1-4, 12-20, 23, 25-26, 45-48 (dispositions générales, déclaration et sécurité)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdfIn force.
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Disclosure, Governance, Security, Retention, Licensing
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Process personal data only where it is collected fairly and lawfully for determined, explicit and legitimate purposes, and do not process it later in a way incompatible with those purposes.NIST Privacy FrameworkGV.PO-P1
- Keep personal data adequate, relevant, accurate, and not excessive for those purposes, and do not retain it in identifiable form longer than the purposes require.NIST Privacy FrameworkGV.PO-P1
- Obtain the data subject's unambiguous consent before processing their personal data, unless a legal obligation, contract performance, vital interest, public interest mission, or legitimate interest ground applies.NIST Privacy FrameworkCT.PO-P1
- File a prior declaration with the CNDP before implementing an automated processing operation, or a set of related automated operations, unless the processing instead requires the CNDP's prior authorization.NIST Privacy FrameworkGV.PO-P5
- If you are established outside Morocco but use processing means located there, notify the CNDP of the identity of a Morocco based representative who takes on your rights and obligations under the law.NIST Privacy FrameworkGV.PO-P5
- Implement technical and organizational measures appropriate to the risk and the state of the art, protecting personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, and unauthorized access, including where the processing involves network transmission.NIST Privacy FrameworkPR.DS-P5
- Bind any processor you use to security guarantees equivalent to your own by contract, and hold anyone with authorized access to personal data, including after they leave that role, to professional secrecy.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkPR.PO-P9
- Notify the CNDP without delay of any change to a declared processing's particulars or of ending the processing, so its national register of declared and authorized processing stays current.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- GV.RR-04Cybersecurity is included in human resources practices
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 23(4) requires the elements of the data-protection contract with a processor, and the requirements for the security measures of Article 23(1), to be recorded in writing or an equivalent form so that they can serve as evidence (in English: 'for the purpose of preserving evidence ... recorded in writing or in another equivalent form'). Article 12(1)(a) exempts a non-profit association from prior authorization only if it can supply proof of the data subject's express consent to the authority on its first request. Neither clause names a log, a retention period or a person who must be given the record, so the record is shown by its purpose rather than its contents. Article 2(2)(b) also applies the Law to a controller outside Morocco that uses processing means located there; a scope prong keyed to where the processing equipment sits has no hook value and is left out. The access-control log of Article 24(1)(g) sits on the sensitive-data row and is not borrowed; Article 3(1)(e) limits how long the personal data is kept and is not a retention rule for a record.
- Kind
- Implicit
- As of
- Provision
- Article 23(4); Article 12(1)(a)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Article 2 applies the law to automated and manual processing of personal data by a physical or legal person, public or private, whose controller is established in Morocco or who uses processing means located there, and Article 2(3) requires a controller established abroad who uses Moroccan processing means to notify the CNDP of a Morocco-based representative who takes on the controller's rights and obligations under the law.
Article 3 requires personal data to be processed fairly and lawfully, collected for determined, explicit and legitimate purposes, kept adequate, relevant and not excessive, accurate and up to date, and retained in identifiable form no longer than those purposes require.
Article 4 requires the data subject's unambiguous consent before processing, unless the processing falls under Article 4's enumerated exceptions (a legal obligation, contract performance, vital interest, a public-interest mission, or the controller's legitimate interest).
Articles 12(2) and 13-20 require processing that is not subject to prior authorization to be the subject of a prior declaration to the CNDP, which issues a receipt within 24 hours, and require the controller to notify the CNDP of any change to the declared particulars.
Article 23 requires the controller to implement technical and organizational measures appropriate to the risk, to bind any processor to equivalent security guarantees, and to record the terms of that arrangement in writing, and Articles 25-26 hold anyone with authorized access to personal data, including a processor, to professional secrecy even after they stop performing that role.
Articles 45-48 establish a national register of declared and authorized processing, maintained by the CNDP and open to the public, and require a controller exempted from declaration because its file is a public register to still make its identity and the processing's particulars known on request. The law's final and transitional articles state no day of its own for its entry into force.
Dahir n° 1-09-15 of 22 safar 1430 () promulgated the law, and its Arabic text appeared in Bulletin officiel n° 5711 of 27 safar 1430 ().
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .