Morocco Data Protection & Privacy Regulation

Set against this, Morocco's standing data protection architecture under Law n09-08 continues without amendment this period. Sensitive data processing, including health data, political and religious opinion, biometric data, geolocation, and specific video-surveillance activity, continues to require prior authorisation from the commission under the law's special-categories provision, a regime distinct from the ordinary prior-declaration process applicable to standard processing. Cross-border transfers remain subject to the law's adequacy requirement, under which a transfer is only authorised where the receiving country ensures an adequate level of protection, and no third country currently holds a formal adequacy recognition from the commission.

Other Developments

A future minors-access pledge without legislative detail. The programme of the incoming government for the 2026 to 2031 term includes a pledge toward a future law that would bar persons under fifteen from social media and from dangerous online games. No bill text, no proposed age-verification mechanism, and no specified role for the data protection commission accompanies this pledge at this stage, so its eventual shape and data-protection implications cannot yet be assessed.

Secondary commentary on an enforcement posture shift. Commentary dated 6 October 2026 describes the commission as moving from an advisory role toward active compliance control and audit procedures, with sanctions under Law n09-08 described as reaching up to three hundred thousand Moroccan dirhams. This description has not been corroborated against a primary publication from the commission itself within the period reviewed, and is accordingly treated with caution rather than as an established development.

Cross-Monitor Connections

The pledged future law on minors' access to social media touches the same under-fifteen population addressed by children's-safety and online-platform regulation more broadly, and readers tracking platform-access and online-safety regulation in Morocco should watch for how any eventual bill allocates oversight responsibility, since the data protection commission's role, if any, is not yet specified. No other cross-monitor linkage arises from this period's findings.

Outlook

The Data-Tika partnership is a time-limited, six-month outreach pilot rather than a regulatory change, and its practical significance will depend on whether it is renewed, expanded beyond Casablanca-Settat, or followed by any substantive policy output. The more consequential item to watch is whether the incoming government's minors-access pledge progresses to an actual bill text, at which point its data-protection dimensions, particularly any age-verification mechanism and the commission's prospective role, would become assessable. The reported shift toward active enforcement remains unconfirmed by the commission's own publications and should be treated as provisional pending corroboration.

2 earlier updates not shown here.

Standing brief · as of 25 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Reports indicate that Morocco's data protection authority, the CNDP, intensified its enforcement of Law 09-08 during 2025, though the extent of that intensification rests on a single secondary source. A separate claim circulating in the same reporting wave asserts that a new statute, referred to as "Law 07-26," has been fully implemented and introduces tiered dissuasive fines for data protection breaches. That claim is contested: a more heavily sourced review states that no formal amending legislation has been enacted as of 2026, and the "Law 07-26" claim rests on a single T4 blog source not corroborated elsewhere. Given the conflict between sources, this development is best treated as unverified rather than as a confirmed change to Morocco's penalty regime.

Other Developments

Morocco's core data protection architecture remains structurally stable. The CNDP is the only personal data protection regulator in Morocco, with jurisdiction over all data controllers and processors subject to Law 09-08. Law 09-08 also applies to a foreign-established data controller using automated or non-automated means to process personal data in Moroccan territory, except transit-only processing or processing destined for a country with equivalent data protection legislation. Processing activities must generally be declared in advance to the CNDP unless exempt, dispensed from declaration, or subject to prior authorization.

Law 09-08 places greater emphasis on consent and regulatory filings than the EU GDPR's accountability-based model. Enhanced safeguards apply to sensitive personal data including ethnic or racial origin, political or religious beliefs, trade union membership, health status, and genetic characteristics.

Draft GDPR-alignment amendments would introduce data portability among other GDPR-aligned enhancements to Law 09-08, but as of 2026 no formal amending legislation has been enacted. Separately, draft amendments would also introduce mandatory breach notification, with the same enactment status as of 2026. Law 09-08 does not impose a mandatory Data Protection Officer appointment requirement, unlike the GDPR. Controllers must implement technical and organisational measures to secure personal data against unauthorised access, alteration, and disclosure.

Morocco's international-transfer regime is stricter and more authorization-centric than the GDPR's SCC/BCR framework. The European Commission has not issued an adequacy decision in respect of Morocco, although the CNDP has pursued efforts to demonstrate the adequacy of Morocco's data protection standards.

A single lower-tier source describes a financial-sector overlay in which credit bureaus must respect rules issued by the Governor of Bank Al-Maghrib; breaches or retention beyond a five-year maximum are said to trigger sector-specific sanctions in addition to CNDP fines. This claim rests on a single T4 source and has not been corroborated by higher-tier sources.

The CNDP has not issued specific detailed guidance on cookies or adtech as of 2026, though any future reform of Law 09-08 may address this area.

The CNDP's March 2025 communique on AI and personal data protection states that AI-driven processing of personal data must ensure citizens have effective means of redress. The CNDP is currently preparing a decision on AI and personal data, following a September 2025 partnership agreement with the Ministry of Digital Transition to develop a national platform for responsible AI.

A single lower-tier source describes the CNDP as able to withdraw a company's processing authorization and publish sanctions in the Official Gazette or national newspapers as a name-and-shame measure, in addition to fines; this characterization has not been corroborated elsewhere.

Cross-Monitor Connections

The credit-bureau sectoral overlay under Bank Al-Maghrib rules intersects with financial-sector data governance tracked on the financial-integrity monitor. Readers following related financial-sector developments in Morocco may wish to consult that monitor for further context. No material connection to the crypto monitor was identified this cycle.

Outlook

Morocco's GDPR-alignment reform track, encompassing data portability and mandatory breach notification, has appeared as proposed-only across multiple reporting cycles. This pattern suggests a stalled rather than advancing amendment process. The CNDP's AI-governance activity, by contrast, appears to be building toward a dedicated deliberation on AI and personal data. The contested Law 07-26 claim will require primary-source verification before it can be treated as a confirmed change to Morocco's enforcement and penalty regime.

Outlook

Morocco's regulatory direction is tightening, concentrated in enforcement posture and in a narrow but concrete AI-content-disclosure duty tied to the election period, rather than in any amendment to Law 09-08's underlying structure.

Standing brief · as of 25 August 2026

Regulatory Status

Morocco operates a comprehensive, in-force data protection statute in Law 09-08, administered by the CNDP as the country's sole personal data protection regulator, with jurisdiction over all data controllers and processors subject to the law. The law extends to foreign-established controllers processing personal data within Moroccan territory, subject to limited exceptions, and processing activities must generally be declared to the CNDP in advance unless exempt, dispensed from declaration, or subject to prior authorization. Consent and regulatory filings carry greater weight than the accountability-based model used under the EU GDPR, and enhanced safeguards apply to sensitive personal data such as ethnic or racial origin, political or religious beliefs, trade union membership, health status, and genetic characteristics. A cluster of GDPR-alignment amendments — covering data portability and mandatory breach notification — remains proposed only, with no formal amending legislation enacted as of 2026. Law 09-08 does not impose a mandatory Data Protection Officer requirement, though it does require controllers to implement technical and organisational security measures. Morocco's cross-border transfer regime is authorization-centric and stricter than the GDPR's standard-contractual-clause and binding-corporate-rules framework, and the European Commission has not issued an adequacy decision in respect of Morocco. A single lower-tier source describes a financial-sector overlay in which credit bureaus must respect rules issued by the Governor of Bank Al-Maghrib, with a five-year retention cap; this claim awaits corroboration. The CNDP has not issued specific guidance on cookies or adtech as of 2026. The most active development this cycle concerns algorithmic governance: the CNDP's March 2025 communique on AI and personal data protection calls for effective means of redress for citizens subject to AI-driven processing, and the authority is reported to be preparing a dedicated decision on AI and personal data following a September 2025 partnership with the Ministry of Digital Transition. On enforcement, the CNDP is understood to have stepped up enforcement activity in 2025; a separate claim describing expanded name-and-shame powers and a new 'Law 07-26' penalty statute rests on a single lower-tier source and is contradicted by a more heavily sourced review stating no formal amendment has been enacted, and should be treated as unverified.

Outlook

Morocco's data protection framework remains structurally settled around its 2009 statute, with GDPR-alignment reforms stalled at the proposal stage across multiple cycles. Algorithmic governance is the area showing the clearest forward motion, with a dedicated CNDP AI decision in preparation. The contested enforcement-statute claim requires primary-source verification before it should be treated as a confirmed development.