Morocco

Article 2 applies the law to automated and manual processing of personal data by a physical or legal person, public or private, whose controller is established in Morocco or who uses processing means located there, and Article 2(3) requires a controller established abroad who uses Moroccan processing means to notify the CNDP of a Morocco-based representative who takes on the controller's rights and obligations under the law.

Article 3 requires personal data to be processed fairly and lawfully, collected for determined, explicit and legitimate purposes, kept adequate, relevant and not excessive, accurate and up to date, and retained in identifiable form no longer than those purposes require.

Article 4 requires the data subject's unambiguous consent before processing, unless the processing falls under Article 4's enumerated exceptions (a legal obligation, contract performance, vital interest, a public-interest mission, or the controller's legitimate interest).

Articles 12(2) and 13-20 require processing that is not subject to prior authorization to be the subject of a prior declaration to the CNDP, which issues a receipt within 24 hours, and require the controller to notify the CNDP of any change to the declared particulars.

Article 23 requires the controller to implement technical and organizational measures appropriate to the risk, to bind any processor to equivalent security guarantees, and to record the terms of that arrangement in writing, and Articles 25-26 hold anyone with authorized access to personal data, including a processor, to professional secrecy even after they stop performing that role.

Articles 45-48 establish a national register of declared and authorized processing, maintained by the CNDP and open to the public, and require a controller exempted from declaration because its file is a public register to still make its identity and the processing's particulars known on request.

Article 43 bars a controller from transferring personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms with regard to the processing, judged by the state's rules, its security measures, and the processing's purpose, duration, origin and destination, and the CNDP maintains the list of states meeting that standard.

Article 44 lets a controller transfer to a state that does not meet it where the data subject has expressly consented, or without that consent where the transfer is necessary to save the person's life, to preserve the public interest, to establish, exercise or defend a legal claim, to perform a contract with the data subject or precontractual measures at their request, to perform a contract concluded in the data subject's interest between the controller and a third party, to carry out international judicial assistance, or to prevent, diagnose or treat a medical condition; it also permits a transfer under a bilateral or multilateral agreement Morocco is party to, or on the CNDP's own express and reasoned authorization where contractual clauses or internal rules ensure a sufficient level of protection.

Article 5 requires a controller collecting data directly from a data subject to tell them, expressly, precisely and unambiguously, the controller's identity, the purposes of the processing and, where fair processing requires it, the recipients, whether a response is mandatory and the consequences of not responding, the existence of access and rectification rights, and the receipt or authorization the processing rests on; where the data were not collected from the data subject, Article 5(3) requires that information no later than the first disclosure to a third party.

Article 6 exempts national-defense and internal or external state-security processing, cases where informing the data subject proves impossible for statistical, historical or scientific processing, processing a law expressly directs to be recorded or disclosed, and processing for exclusively journalistic, artistic or literary purposes.

Article 7 gives the data subject the right to obtain, at reasonable intervals, without delay and free of charge, confirmation of processing, the data in intelligible form, and the logic underlying an automated treatment of them, letting the controller ask the CNDP for more time or oppose manifestly abusive requests.

Article 8 gives a right to correct, update, erase or block noncompliant data within ten clear days, free of charge, and to have the correction passed on to any third party the data were disclosed to, escalating to the CNDP on refusal or non-response. Article 9 gives a right to object on legitimate grounds, and an unconditional and free right to object to use of the data for prospecting, including commercial prospecting.

Article 10 bars direct marketing by automated call, fax or electronic mail to a person who has not given prior consent, with a narrow exception for email marketing of similar products to a controller's own existing customers, conditioned on an easy, free opt-out being offered at collection and with every message.

Article 11 bars a judicial decision, and any other decision producing legal effects on a person, from resting solely on automated processing meant to define their profile or evaluate an aspect of their personality, except a decision taken in forming or performing a contract where the person could comment, or one that grants the person's own request.

Article 27 establishes the CNDP under the Prime Minister to implement and enforce the law, advise the government and parliament on processing-related bills and regulations, and receive declarations, representative notifications and complaints.

Article 28 gives it power to authorize extended retention and response delays, order corrections, issue the Article 12 and Article 21 authorizations, set the adequate-states list, authorize transfers, run the national register, grant security-measure exemptions, escalate a declared processing to authorization, and withdraw a receipt or authorization.

Articles 30-31 give the CNDP's commissioned agents investigative and enforcement powers, including access to processing sites and data and the power to order blocking, erasure, destruction or a halt to processing, exercised under a disciplinary procedure that guarantees the rights of the defense.

Articles 32-42 set the CNDP's composition (a president and six members, all royally appointed, serving five-year terms renewable once), its meeting and voting rules, member incompatibilities and recusal duties, professional secrecy for its members and staff, and its secretariat and committee structure. Article 51 lets the CNDP withdraw a declaration receipt or an authorization, without delay, where the processing it covers threatens public security or order or offends morality.

Articles 52-63 set a graduated penalty ladder: undeclared or unauthorized processing draws a fine of 10,000 to 100,000 dirhams only (Article 52); refusing an access, rectification or objection request draws a fine of 20,000 to 200,000 dirhams per infraction (Article 53); unlawful collection, off-purpose processing, over-retention, processing without the required consent, inadequate security measures, disregarding a legitimate or marketing objection, and an unlawful cross-border transfer each draw imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams (Articles 54-56, 58-60); processing sensitive data or offense and conviction data without the required consent or authorization draws imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the statute's highest tier (Article 57); obstructing CNDP control draws imprisonment of three to six months and a fine of 10,000 to 50,000 dirhams (Article 62); and refusing to comply with a CNDP decision draws imprisonment of three months to one year and a fine of 10,000 to 100,000 dirhams (Article 63).

Article 52 states these criminal sanctions without prejudice to the civil liability of anyone whose fault causes damage, preserving a data subject's ordinary civil claim for compensation. Article 64 doubles fines for a legal person and adds asset confiscation or closure of the establishment as available sanctions, and Article 65 doubles all sanctions on recidivism within a year of a final conviction.

Article 66 lets specially commissioned and sworn CNDP agents, alongside judicial police officers, investigate and record offenses by official report, forwarded to the public prosecutor within five days.

Article 12(1) makes prior CNDP authorization, rather than a mere declaration, the default for processing sensitive data, for using data outside the purpose it was collected for, for genetic data outside medical care, for data on offenses, convictions or security measures, for a national identity card number, and for interconnecting files serving different public or private purposes.

Article 21 conditions that authorization on the data subject's express consent, a legal or statutory duty of the controller, or the Commission's own finding that the processing protects a vital interest, concerns data the data subject has manifestly made public, or is necessary to a legal claim.

Article 22 lets a controller declare rather than seek authorization for health data processed solely for preventive medicine, diagnosis, care or health-service management by a practitioner or another person equally bound by professional secrecy, or to select beneficiaries of a right, benefit or contract they are not otherwise excluded from.

Article 24 requires a controller of sensitive or health data to additionally control entry to the processing facility, control who can read, copy, modify or remove the data media, control unauthorized input, use, access and transmission, and be able to show after the fact what data was input, when and by whom.

Articles 49-50 restrict processing personal data on offenses, convictions or security measures to courts, public authorities and legally competent public bodies, and to auxiliaries of justice acting within the strict needs of their legal mission. The law's sensitive-data definition (Article 1(3)) does not include a biometric, voiceprint or faceprint identifier.

Article 5(b) protects a compilation, encyclopedia, anthology or database as a copyrightable work where the selection, coordination or arrangement of its contents constitutes an original intellectual creation, whether recorded on a machine-readable medium or otherwise, rather than through a separate sui generis database right.

Article 12 permits free reproduction of a lawfully published work for the user's exclusively private use, but its second paragraph, at 12(c), expressly withholds that exception from the reproduction of the whole or part of a database in digital form, so a digital-form database stays within the author's exclusive right regardless of the reproducer's private purpose.

A wilful, commercially-motivated infringement of these rights is punished under Article 64 (as amended) by imprisonment and a fine, doubled for a repeated infringement and further increased for a new infringement within five years of a final judgment, and Article 62 lets the rights holder choose between actual damages plus the infringer's profits or pre-established damages of 5,000 to 25,000 dirhams.

Article 70 states that the Law's provisions enter into force six months after publication in the Bulletin Officiel, which the same source dates to 6 July 2000, placing the commencement date six months later.

Chapter II, Section 3 of Loi n° 05-20 relative à la cybersécurité binds a 'prestataire de services numériques' (digital service provider), defined in Article 2 to include an operator of an online sale or service-contract platform, an online search engine, or a datacenter or cloud-computing host, and an 'éditeur de plateformes Internet' (Internet platform publisher), together with a public telecommunications network operator, an Internet access provider and a cybersecurity service provider, all five grouped by Article 1 as an 'opérateur'.

Article 26 requires an opérateur to comply with the national cybersecurity authority's directives on retaining, for one year from generation, the technical data needed to identify a cybersecurity incident, including connection data, system logs, and the security-event traces generated by its operating systems, applications and security products.

Article 29 requires an opérateur to take the protective measures the national authority directs to prevent and neutralize the effects of a threat or breach affecting its clients' information systems.

Article 32 requires a digital service provider specifically to identify the risks threatening the security of its own networks and information systems, and to take the technical and organizational measures needed to manage those risks, avoid incidents, and minimize their impact, so as to guarantee the continuity of its services.

Article 34 lets the national authority, on being informed that a digital service provider does not meet an obligation the law imposes, subject that provider to a compliance audit at its own cost, and order its directors to come into compliance within a deadline the authority sets.

A violation of Article 26 or of Article 32 or 34 draws a fine of 100,000 to 200,000 dirhams under Article 50, doubled on recidivism within four years under Article 52; Article 29's protective-measures duty is not among the provisions Article 50 lists.

The Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) describes its own regulatory role as drafting the legislative and regulatory texts relating to cybersecurity and issuing the authorizations and approvals the law contemplates, and operates as the national cybersecurity authority (autorité nationale) Article 1 says is designated by regulation.

Chapter II, Section 3 of Loi n° 05-20 relative à la cybersécurité also binds the same opérateur class, a public telecommunications network operator, an Internet access provider, a cybersecurity service provider, a digital service provider, and an Internet platform publisher, to three notification duties with their own clocks. Article 27 requires an opérateur to inform its clients of a vulnerability in its information systems, or of a breach that could affect them.

Article 30 requires an opérateur, on detecting an event that could affect the security of a client's information systems, to inform the national cybersecurity authority of it without delay.

Article 33 requires a digital service provider specifically, as soon as it becomes aware of an incident affecting the networks or information systems its service needs, to declare the incident to the national authority where the information available to it shows the incident has a significant impact on providing that service.

A violation of Article 30 or 33 draws the same fine of 100,000 to 200,000 dirhams under Article 50 that Article 8's parallel duty on an entité draws, doubled on recidivism within four years under Article 52; Article 27's client-notification duty is not among the provisions Article 50 lists.

Article 14 lets any person quote a lawfully published work in another work without the author's authorization, on condition of citing the source and the author's name where it appears in the source, and provided the quotation conforms to fair practice and its extent does not exceed what its purpose justifies.

Article 19(a) separately lets the press reproduce, broadcast, or communicate to the public an economic, political, or religious article published in a newspaper or periodical, or a broadcast work of the same character, on the same source-and-author-name condition, unless the right to reproduce, broadcast, or communicate it has been expressly reserved.

Article 70 states that the Law's provisions enter into force six months after publication in the Bulletin Officiel, which the same source dates to 6 July 2000, placing the commencement date six months later.