🇲🇦
Morocco
Law No. 09-08 on Personal Data Protection
Africa🔵 Substantial
Compliance Score
71%
10 Addressed
3 Partial
1 None
Authority
National Commission for Data Protection (CNDP)
Overview
Morocco's Law No. 09-08, effective 2009, provides a substantial framework for data protection. The CNDP is the regulatory authority responsible for enforcement and guidance.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
AddressedDPO Requirements
AddressedChildren's Data
AddressedPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
PartialAI & Automated Decisions
NoneData Localisation
PartialSignificant Data Fiduciary
AddressedGovernment Data
Addressed? Frequently Asked Questions
What is the primary data protection law in Morocco?+
Morocco is governed by the Law No. 09-08 on Personal Data Protection. The law is enforced by the National Commission for Data Protection (CNDP). According to our analysis, the country has a Substantial level of data protection framework.
Does Morocco require a Data Protection Officer (DPO)?+
Yes, under the Law No. 09-08 on Personal Data Protection, organizations are generally required to appoint a Data Protection Officer (DPO) or a similar privacy officer to ensure compliance.
What are the data localisation rules in Morocco?+
Partially. While Law No. 09-08 on Personal Data Protection may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Morocco?+
Under the Law No. 09-08 on Personal Data Protection, organizations must notify the National Commission for Data Protection (CNDP) and affected individuals without undue delay in the event of a personal data breach.