Law 09-08: Who It Covers and Why Foreign Companies Cannot Opt Out
For much of the past decade, Law 09-08 sat on the books without much enforcement. Foreign companies operating in Morocco generally knew it existed. Few had properly complied with it. That changed in 2026. The CNDP has issued formal warnings to major data controllers, investigations are open, and Law 07-26 has materially raised the cost of non-compliance.
Law 09-08, enacted in February 2009, governs the processing of personal data by any organization operating within Moroccan territory. It also applies to foreign entities that use processing means located in Morocco — even when those entities have no physical establishment in the country.
The scope is broad. A European company running a CRM system hosted on Moroccan servers processes Moroccan customer data under Law 09-08. A multinational group whose Moroccan subsidiary feeds employee data into a centralized HR platform abroad operates under the same framework. A foreign e-commerce business delivering goods in Morocco and storing customer records triggers the law.
The CNDP — the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel — was established as Morocco’s independent supervisory authority. It receives declarations and authorization requests, conducts audits, issues decisions, and — increasingly — refers violations to the public prosecutor for criminal proceedings.
The Prior Declaration: The Most Commonly Missed Obligation
Under the GDPR, most processing operations require internal documentation and a privacy notice. Under Law 09-08, the default is a mandatory prior declaration to the CNDP before any processing begins.
Every data controller must file a declaration describing the purposes of the processing, the categories of data and data subjects, the intended recipients, any planned cross-border transfers, and the security measures in place. Processing may only begin once a CNDP receipt is obtained.
Standard processing activities — employee payroll records, customer databases, website analytics — require a declaration. More sensitive operations require a prior authorization rather than a simple declaration. Authorization is required for:
- Processing involving sensitive data: health records, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data
- The interconnection of databases with different purposes or managed by different controllers
- Cross-border transfers to countries without adequate protection
Many foreign companies establishing Moroccan subsidiaries deploy payroll software, HR management platforms, and monitoring tools without filing a declaration. This constitutes a violation from the first day of operations.
Cross-Border Data Transfers: Where Law 09-08 Is Stricter Than GDPR
The GDPR allows controllers to transfer data internationally using Standard Contractual Clauses or Binding Corporate Rules, without prior involvement of the supervisory authority. Law 09-08 has no equivalent mechanism.
Under Moroccan law, personal data may be transferred abroad only if the destination country ensures an adequate level of data protection recognized under Moroccan law — or if prior CNDP authorization has been obtained. There is no self-administered transfer instrument.
This creates a concrete compliance gap for multinational groups. Routine data flows that groups consider settled — Moroccan employee records sent to a regional HR system in France or Germany, customer data stored in a US-based cloud, operational data processed by an ERP hosted in Singapore — each require CNDP authorization absent an adequacy determination.
Morocco has ratified Convention 108 and Convention 108+ of the Council of Europe. Being GDPR-compliant does not mean being CNDP-compliant. The two frameworks overlap but are not equivalent, and the differences are precisely where enforcement exposure lies.
The 2026 Enforcement Shift
In November 2025, the CNDP issued five substantive decisions covering cookies, newsletter management, patient data processing, video surveillance in healthcare facilities, and access control to professional premises. These decisions moved the CNDP from guidance to prescription.
In 2026, enforcement followed. The CNDP has issued formal warnings to data controllers processing significant volumes of personal data without proper filings, and has opened investigations into entities suspected of systematic violations.
Under the existing Law 09-08 framework, non-compliance already carries fines ranging from MAD 10,000 to MAD 600,000, with imprisonment of between three months and four years for natural persons responsible for violations. Law 07-26, which entered into force this year, strengthened the sanction regime further.
For foreign investors conducting due diligence on Moroccan targets, unresolved CNDP exposure is now a material finding — not a footnote.
What Foreign Companies Need to Do
Map all personal data flows involving Morocco. This includes employee data, customer data, supplier data, operational data, and data transferred to group entities or third-party processors abroad.
File declarations with the CNDP for all standard processing activities before those activities begin. Where the processing involves sensitive categories or cross-border transfers, obtain prior authorization rather than simply filing a declaration.
Review contracts with data processors — cloud providers, HR software vendors, payroll bureaus, IT subcontractors — to ensure they contain data protection clauses consistent with Moroccan requirements.
Audit international data transfers and identify which flows currently lack CNDP authorization. Prioritize flows involving large volumes of personal data or sensitive categories.
Designate a point of contact for CNDP correspondence. Designating a responsible person materially reduces response time when the CNDP sends inquiries or initiates a review.
How Lafrouji Avocats Can Help
Lafrouji Avocats advises foreign companies entering or operating in Morocco on their data protection obligations under Law 09-08. Our work covers the preparation and filing of declarations and authorization requests with the CNDP, the drafting of data processing agreements adapted to Moroccan requirements, the legal analysis of cross-border transfer mechanisms, and representation before the CNDP in the event of investigations or sanctions proceedings.
