Morocco

Article 2 applies the law to automated and manual processing of personal data by a physical or legal person, public or private, whose controller is established in Morocco or who uses processing means located there, and Article 2(3) requires a controller established abroad who uses Moroccan processing means to notify the CNDP of a Morocco-based representative who takes on the controller's rights and obligations under the law.

Article 3 requires personal data to be processed fairly and lawfully, collected for determined, explicit and legitimate purposes, kept adequate, relevant and not excessive, accurate and up to date, and retained in identifiable form no longer than those purposes require.

Article 4 requires the data subject's unambiguous consent before processing, unless the processing falls under Article 4's enumerated exceptions (a legal obligation, contract performance, vital interest, a public-interest mission, or the controller's legitimate interest).

Articles 12(2) and 13-20 require processing that is not subject to prior authorization to be the subject of a prior declaration to the CNDP, which issues a receipt within 24 hours, and require the controller to notify the CNDP of any change to the declared particulars.

Article 23 requires the controller to implement technical and organizational measures appropriate to the risk, to bind any processor to equivalent security guarantees, and to record the terms of that arrangement in writing, and Articles 25-26 hold anyone with authorized access to personal data, including a processor, to professional secrecy even after they stop performing that role.

Articles 45-48 establish a national register of declared and authorized processing, maintained by the CNDP and open to the public, and require a controller exempted from declaration because its file is a public register to still make its identity and the processing's particulars known on request. The law's final and transitional articles state no day of its own for its entry into force.

Dahir n° 1-09-15 of 22 safar 1430 (18 February 2009) promulgated the law, and its Arabic text appeared in Bulletin officiel n° 5711 of 27 safar 1430 (23 February 2009).

Article 43 bars a controller from transferring personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms with regard to the processing, judged by the state's rules, its security measures, and the processing's purpose, duration, origin and destination, and the CNDP maintains the list of states meeting that standard.

Article 44 lets a controller transfer to a state that does not meet it where the data subject has expressly consented, or without that consent where the transfer is necessary to save the person's life, to preserve the public interest, to establish, exercise or defend a legal claim, to perform a contract with the data subject or precontractual measures at their request, to perform a contract concluded in the data subject's interest between the controller and a third party, to carry out international judicial assistance, or to prevent, diagnose or treat a medical condition; it also permits a transfer under a bilateral or multilateral agreement Morocco is party to, or on the CNDP's own express and reasoned authorization where contractual clauses or internal rules ensure a sufficient level of protection.

The law's final and transitional articles state no day of its own for its entry into force.

Article 11 bars a decision producing legal effects for a person from resting solely on automated processing meant to define their profile or evaluate an aspect of their personality. A parallel first sentence restricts a judicial decision the same way, but that clause binds only courts and carries no 'solely' qualifier.

The prohibition does not apply to a decision made in concluding or performing a contract on which the person had a chance to comment, or to a decision that grants the person's own request. The law's final and transitional articles state no day of its own for its entry into force.

Article 5 requires a controller collecting data directly from a data subject to tell them, expressly, precisely and unambiguously, the controller's identity, the purposes of the processing and, where fair processing requires it, the recipients, whether a response is mandatory and the consequences of not responding, the existence of access and rectification rights, and the receipt or authorization the processing rests on; where the data were not collected from the data subject, Article 5(3) requires that information no later than the first disclosure to a third party.

Article 6 exempts national-defense and internal or external state-security processing, cases where informing the data subject proves impossible for statistical, historical or scientific processing, processing a law expressly directs to be recorded or disclosed, and processing for exclusively journalistic, artistic or literary purposes.

Article 7 gives the data subject the right to obtain, at reasonable intervals, without delay and free of charge, confirmation of processing, the data in intelligible form, and the logic underlying an automated treatment of them, letting the controller ask the CNDP for more time or oppose manifestly abusive requests.

Article 8 gives a right to correct, update, erase or block noncompliant data within ten clear days, free of charge, and to have the correction passed on to any third party the data were disclosed to, escalating to the CNDP on refusal or non-response. Article 9 gives a right to object on legitimate grounds, and an unconditional and free right to object to use of the data for prospecting, including commercial prospecting.

Article 10 bars direct marketing by automated call, fax or electronic mail to a person who has not given prior consent, with a narrow exception for email marketing of similar products to a controller's own existing customers, conditioned on an easy, free opt-out being offered at collection and with every message. The law's final and transitional articles state no day of its own for its entry into force.

Article 27 establishes the CNDP under the Prime Minister to implement and enforce the law, advise the government and parliament on processing-related bills and regulations, and receive declarations, representative notifications and complaints.

Article 28 gives it power to authorize extended retention and response delays, order corrections, issue the Article 12 and Article 21 authorizations, set the adequate-states list, authorize transfers, run the national register, grant security-measure exemptions, escalate a declared processing to authorization, and withdraw a receipt or authorization.

Articles 30-31 give the CNDP's commissioned agents investigative and enforcement powers, including access to processing sites and data and the power to order blocking, erasure, destruction or a halt to processing, exercised under a disciplinary procedure that guarantees the rights of the defense.

Articles 32-42 set the CNDP's composition (a president and six members, all royally appointed, serving five-year terms renewable once), its meeting and voting rules, member incompatibilities and recusal duties, professional secrecy for its members and staff, and its secretariat and committee structure. Article 51 lets the CNDP withdraw a declaration receipt or an authorization, without delay, where the processing it covers threatens public security or order or offends morality.

Articles 52-63 set a graduated penalty ladder: undeclared or unauthorized processing draws a fine of 10,000 to 100,000 dirhams only (Article 52); refusing an access, rectification or objection request draws a fine of 20,000 to 200,000 dirhams per infraction (Article 53); unlawful collection, off-purpose processing, over-retention, processing without the required consent, inadequate security measures, disregarding a legitimate or marketing objection, and an unlawful cross-border transfer each draw imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams (Articles 54-56, 58-60); processing sensitive data or offense and conviction data without the required consent or authorization draws imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the statute's highest tier (Article 57); obstructing CNDP control draws imprisonment of three to six months and a fine of 10,000 to 50,000 dirhams (Article 62); and refusing to comply with a CNDP decision draws imprisonment of three months to one year and a fine of 10,000 to 100,000 dirhams (Article 63).

Article 52 states these criminal sanctions without prejudice to the civil liability of anyone whose fault causes damage, preserving a data subject's ordinary civil claim for compensation. Article 64 doubles fines for a legal person and adds asset confiscation or closure of the establishment as available sanctions, and Article 65 doubles all sanctions on recidivism within a year of a final conviction.

Article 66 lets specially commissioned and sworn CNDP agents, alongside judicial police officers, investigate and record offenses by official report, forwarded to the public prosecutor within five days. The law's final and transitional articles state no day of its own for its entry into force.

Article 12(1) makes prior CNDP authorization, rather than a mere declaration, the default for processing sensitive data, for using data outside the purpose it was collected for, for genetic data outside medical care, for data on offenses, convictions or security measures, for a national identity card number, and for interconnecting files serving different public or private purposes.

Article 21 conditions that authorization on the data subject's express consent, a legal or statutory duty of the controller, or the Commission's own finding that the processing protects a vital interest, concerns data the data subject has manifestly made public, or is necessary to a legal claim.

Article 22 lets a controller declare rather than seek authorization for health data processed solely for preventive medicine, diagnosis, care or health-service management by a practitioner or another person equally bound by professional secrecy, or to select beneficiaries of a right, benefit or contract they are not otherwise excluded from.

Article 24 requires a controller of sensitive or health data to additionally control entry to the processing facility, control who can read, copy, modify or remove the data media, control unauthorized input, use, access and transmission, and be able to show after the fact what data was input, when and by whom.

Articles 49-50 restrict processing personal data on offenses, convictions or security measures to courts, public authorities and legally competent public bodies, and to auxiliaries of justice acting within the strict needs of their legal mission. The law's sensitive-data definition (Article 1(3)) does not include a biometric, voiceprint or faceprint identifier. The law's final and transitional articles state no day of its own for its entry into force.

Article 5(b) protects a compilation, encyclopedia, anthology or database as a copyrightable work where the selection, coordination or arrangement of its contents constitutes an original intellectual creation, whether recorded on a machine-readable medium or otherwise, rather than through a separate sui generis database right.

Article 12 permits free reproduction of a lawfully published work for the user's exclusively private use, but its second paragraph, at 12(c), expressly withholds that exception from the reproduction of the whole or part of a database in digital form, so a digital-form database stays within the author's exclusive right regardless of the reproducer's private purpose.

A wilful, commercially-motivated infringement of these rights is punished under Article 64 (as amended) by imprisonment and a fine, doubled for a repeated infringement and further increased for a new infringement within five years of a final judgment, and Article 62 lets the rights holder choose between actual damages plus the infringer's profits or pre-established damages of 5,000 to 25,000 dirhams. Law 66-19, promulgated by Dahir 1-22-35 of 24 May 2022, amends and supplements Law 2-00.

It was published on 20 June 2022. Article 70 states that the Law's provisions enter into force six months after publication in the Bulletin Officiel, whose authoritative Arabic edition (n° 4796) the same source dates to 18 May 2000, placing the commencement date on 18 November 2000.

Directive 3/W/16 of Bank Al-Maghrib sets the minimum rules that credit institutions must observe in carrying out intrusion tests on their information systems. Article 1 requires a credit institution to assess the security of its information system and to include the regular conduct of tests in an overall framework for evaluating the effectiveness of its security arrangements, based on a risk-based approach.

Article 3 requires a credit institution to adopt each year a programme of tests to be carried out, taking account of all legal, regulatory and contractual requirements. Article 6 requires information systems that are open to the outside to be tested more than once a year. Article 7 lets Bank Al-Maghrib require a credit institution to carry out targeted tests at the frequency and in the manner it determines.

Article 19 requires a credit institution to draw up an action plan to correct the vulnerabilities and weaknesses found through the tests. Article 20 requires a credit institution to send Bank Al-Maghrib, by 31 March at the latest, an annual report on the tests. Article 21 provides that the Directive takes effect from the date of its signature.

Article 172 of Law 103-12 makes credit institutions that contravene the Law and the texts taken for its application liable to the disciplinary sanctions provided in the following articles. Article 178 of Law 103-12 lets the wali of Bank Al-Maghrib, where a caution or warning has had no effect, suspend managers, prohibit or restrict operations, appoint a provisional administrator or withdraw the licence.

Chapter II, Section 3 of Loi n° 05-20 relative à la cybersécurité binds a 'prestataire de services numériques' (digital service provider), defined in Article 2 to include an operator of an online sale or service-contract platform, an online search engine, or a datacenter or cloud-computing host, and an 'éditeur de plateformes Internet' (Internet platform publisher), together with a public telecommunications network operator, an Internet access provider and a cybersecurity service provider, all five grouped by Article 1 as an 'opérateur'.

Article 26 requires an opérateur to comply with the national cybersecurity authority's directives on retaining, for one year from generation, the technical data needed to identify a cybersecurity incident, including connection data, system logs, and the security-event traces generated by its operating systems, applications and security products.

Article 29 requires an opérateur to take the protective measures the national authority directs to prevent and neutralize the effects of a threat or breach affecting its clients' information systems.

Article 32 requires a digital service provider specifically to identify the risks threatening the security of its own networks and information systems, and to take the technical and organizational measures needed to manage those risks, avoid incidents, and minimize their impact, so as to guarantee the continuity of its services.

Article 34 lets the national authority, on being informed that a digital service provider does not meet an obligation the law imposes, subject that provider to a compliance audit at its own cost, and order its directors to come into compliance within a deadline the authority sets.

A violation of Article 26 or of Article 32 or 34 draws a fine of 100,000 to 200,000 dirhams under Article 50, doubled on recidivism within four years under Article 52; Article 29's protective-measures duty is not among the provisions Article 50 lists.

The Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) describes its own regulatory role as drafting the legislative and regulatory texts relating to cybersecurity and issuing the authorizations and approvals the law contemplates, and operates as the national cybersecurity authority (autorité nationale) Article 1 says is designated by regulation.

Article 53 defers the law's own entry into force to the date the Official Gazette publishes the texts taken for its application; Décret n° 2-21-406 of 4 hija 1442 (15 July 2021), the decree taken for the Law's application, was published in Bulletin Officiel n° 7011 of 29 hija 1442 (9 August 2021), the day the Law came into force.

Article 2 of Loi n° 05-20 defines vital infrastructures as the installations, structures and systems indispensable to the maintenance of the vital functions of society, health, safety, security and economic or social well-being. Article 14 applies the provisions of Section 1 of Chapter II to vital infrastructures.

Article 16 provides that the government authority, public establishment or other public-law legal person that coordinates a vital sector designates the vital infrastructures of that sector after the opinion of the national authority, and that the list of designated infrastructures is kept secret.

Article 17 requires the person in charge of a vital infrastructure to draw up, on the basis of a risk analysis, the list of its sensitive information systems and to send it, with its updates, to the national authority. Article 19 requires every sensitive information system to undergo a security approval (homologation) before it is put into operation.

Article 20 requires the persons in charge of vital infrastructures, at the national authority's request, to submit their sensitive information systems to an audit carried out by the authority or by an auditor it has qualified. Article 24 requires each audited vital infrastructure to put in place an action plan to implement the recommendations of the audit reports and to send it to the national authority.

Article 25 requires the persons in charge of vital infrastructures to use the services, products or solutions the national authority defines to strengthen security functions, and to use providers the authority has qualified when they outsource cybersecurity services. Article 49 punishes with a fine of 200,000 to 400,000 dirhams the person in charge of a vital infrastructure who puts a sensitive information system into operation without the approval Article 19 requires.

Article 50 punishes with a fine of 100,000 to 200,000 dirhams anyone who obstructs or prevents the security audits of the sensitive information systems of vital infrastructures that Article 20 provides for. Article 52 doubles the sanctions the Law provides in case of recidivism. Article 53 provides that the Law enters into force on the date the Bulletin officiel publishes the texts taken for its application.

Bulletin Officiel n° 7011 publishes Décret n° 2.21.406 of 4 hija 1442 (15 July 2021), taken for the application of Loi n° 05-20 relative à la cybersécurité. Dahir n° 1-20-69 of 25 July 2020 promulgated Loi n° 05-20 relative à la cybersécurité.

Chapter II, Section 3 of Loi n° 05-20 relative à la cybersécurité also binds the same opérateur class, a public telecommunications network operator, an Internet access provider, a cybersecurity service provider, a digital service provider, and an Internet platform publisher, to three notification duties with their own clocks. Article 27 requires an opérateur to inform its clients of a vulnerability in its information systems, or of a breach that could affect them.

Article 30 requires an opérateur, on detecting an event that could affect the security of a client's information systems, to inform the national cybersecurity authority of it without delay.

Article 33 requires a digital service provider specifically, as soon as it becomes aware of an incident affecting the networks or information systems its service needs, to declare the incident to the national authority where the information available to it shows the incident has a significant impact on providing that service.

A violation of Article 30 or 33 draws the same fine of 100,000 to 200,000 dirhams under Article 50 that Article 8's parallel duty on an entité draws, doubled on recidivism within four years under Article 52; Article 27's client-notification duty is not among the provisions Article 50 lists.

Article 53 defers the law's own entry into force to the date the Official Gazette publishes the texts taken for its application; Décret n° 2-21-406 of 4 hija 1442 (15 July 2021), the decree taken for the Law's application, was published in Bulletin Officiel n° 7011 of 29 hija 1442 (9 August 2021), the day the Law came into force.

Article 2 of Loi n° 05-20 defines vital infrastructures as the installations, structures and systems indispensable to the maintenance of the vital functions of society, health, safety, security and economic or social well-being. Article 14 applies the provisions of Section 1 of Chapter II to vital infrastructures.

Article 16 provides that the government authority, public establishment or other public-law legal person that coordinates a vital sector designates the vital infrastructures of that sector after the opinion of the national authority, and that the list of designated infrastructures is kept secret. Article 8 requires an entity, as soon as it becomes aware of an incident affecting the security or operation of its information systems, to declare it to the national authority.

Article 8 also requires the entity, at the national authority's request, to give it without delay further information on incidents affecting the security or operation of its information systems. Article 50 punishes with a fine of 100,000 to 200,000 dirhams anyone who fails the incident declaration obligations of Articles 8, 30 and 33. Article 52 doubles the sanctions the Law provides in case of recidivism.

Article 53 provides that the Law enters into force on the date the Bulletin officiel publishes the texts taken for its application. Bulletin Officiel n° 7011 publishes Décret n° 2.21.406 of 4 hija 1442 (15 July 2021), taken for the application of Loi n° 05-20 relative à la cybersécurité. Dahir n° 1-20-69 of 25 July 2020 promulgated Loi n° 05-20 relative à la cybersécurité.

Article 14 lets any person quote a lawfully published work in another work without the author's authorization, on condition of citing the source and the author's name where it appears in the source, and provided the quotation conforms to fair practice and its extent does not exceed what its purpose justifies.

Article 19(a) separately lets the press reproduce, broadcast, or communicate to the public an economic, political, or religious article published in a newspaper or periodical, or a broadcast work of the same character, on the same source-and-author-name condition, unless the right to reproduce, broadcast, or communicate it has been expressly reserved. Law 66-19, promulgated by Dahir 1-22-35 of 24 May 2022, amends and supplements Law 2-00. It was published on 20 June 2022.

Article 70 states that the Law's provisions enter into force six months after publication in the Bulletin Officiel, whose authoritative Arabic edition (n° 4796) the same source dates to 18 May 2000, placing the commencement date on 18 November 2000.