We use analytics cookies (Google Analytics) to improve your expérience. No tracking cookie without your consent. Learn more.
Law 09-08 protects personal data in Morocco. As soon as your site collects a name, phone number or email, through a contact form or an order, you must tell visitors what you collect and why, respect their rights of access, correction and objection, and declare the processing to the CNDP, or ask for its authorisation depending on the case.
A readable privacy policy: who is responsible, what data, for what purpose, how long it is kept, who it is shared with. A short notice under every form with a link to that policy, and an address people can write to in order to access or correct their data.
Most processing requires a prior declaration to the CNDP, Morocco’s data protection commission. Some requires authorisation, for example sensitive data or transfers outside Morocco, which matters if your hosting or CRM sits abroad. The forms are on the CNDP website, and failing to declare is an offence under the law.
Law 09-08 is often compared with the GDPR, and the principles overlap. But if your company is established in Morocco, or processes data with means located in Morocco, GDPR compliance alone does not replace the CNDP formalities. For health or financial data, get legal advice.
Is there a privacy policy, linked at the bottom of every page? Is there a short notice under every form? Do you only ask for what you need? Does the site run on HTTPS? Do you know where form messages are stored and who reads them? Has the CNDP declaration been filed, or at least started? Any “no” is where to begin.