--- title: "Morocco Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/morocco/ source_html: /jurisdictions/morocco/index.html description: "Morocco data protection and privacy regulation: 10 categories, 63 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 1b0cb3d7dfc3110579ed9b25628eb5effde1c1e4ecbb675da0351d9bebc6852b generator: "fe-fleet/md-twin@1.0" --- # Morocco Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 63 claims · 31 sources in the cumulative register Download report (PDF) Expand all Reports indicate that Morocco's data protection authority, the CNDP, intensified its enforcement of Law 09-08 during 2025, though the extent of that intensification rests on a single secondary source. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy. Not fully checked this cycle: Regulator & Framework, Cross-Border & Adequacy (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=MOROCCO)[Build Report](/reports/?j=MOROCCO)[Compare](/compare/?j=MOROCCO) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Commission Nationale de contrôle de la protection des Données à caractère Personnel ( Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 4 Red categories 57 Sub-modules 63 Claims 0 Tier-1 sources Traffic-light mix 6 amber 4 red (sums to 10 rendered categories; click to filter) 4 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,180 Full executive summary 603 ###### Latest update · 25 October 2026 #### Lead Signal Morocco's data protection authority, the Commission Nationale de controle de la protection des Donnees a caractere Personnel, signed a partnership with NIIAT on 21 October 2026 launching a six-month youth data-protection-awareness pilot, Data-Tika, covering the Casablanca-Settat region. The agreement is a cooperation arrangement for public outreach and training rather than a regulatory instrument, and it does not amend any provision of Morocco's data protection law. No binding change to the regulatory framework accompanies it. Set against this, Morocco's standing data protection architecture under Law n09-08 continues without amendment this period. Sensitive data processing, including health data, political and religious opinion, biometric data, geolocation, and specific video-surveillance activity, continues to require prior authorisation from the commission under the law's special-categories provision, a regime distinct from the ordinary prior-declaration process applicable to standard processing. Cross-border transfers remain subject to the law's adequacy requirement, under which a transfer is only authorised where the receiving country ensures an adequate level of protection, and no third country currently holds a formal adequacy recognition from the commission. #### Other Developments A future minors-access pledge without legislative detail. The programme of the incoming government for the 2026 to 2031 term includes a pledge toward a future law that would bar persons under fifteen from social media and from dangerous online games. No bill text, no proposed age-verification mechanism, and no specified role for the data protection commission accompanies this pledge at this stage, so its eventual shape and data-protection implications cannot yet be assessed. Secondary commentary on an enforcement posture shift. Commentary dated 6 October 2026 describes the commission as moving from an advisory role toward active compliance control and audit procedures, with sanctions under Law n09-08 described as reaching up to three hundred thousand Moroccan dirhams. This description has not been corroborated against a primary publication from the commission itself within the period reviewed, and is accordingly treated with caution rather than as an established development. #### Cross-Monitor Connections The pledged future law on minors' access to social media touches the same under-fifteen population addressed by children's-safety and online-platform regulation more broadly, and readers tracking platform-access and online-safety regulation in Morocco should watch for how any eventual bill allocates oversight responsibility, since the data protection commission's role, if any, is not yet specified. No other cross-monitor linkage arises from this period's findings. #### Outlook The Data-Tika partnership is a time-limited, six-month outreach pilot rather than a regulatory change, and its practical significance will depend on whether it is renewed, expanded beyond Casablanca-Settat, or followed by any substantive policy output. The more consequential item to watch is whether the incoming government's minors-access pledge progresses to an actual bill text, at which point its data-protection dimensions, particularly any age-verification mechanism and the commission's prospective role, would become assessable. The reported shift toward active enforcement remains unconfirmed by the commission's own publications and should be treated as provisional pending corroboration. 2 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Reports indicate that Morocco's data protection authority, the CNDP, intensified its enforcement of Law 09-08 during 2025, though the extent of that intensification rests on a single secondary source. A separate claim circulating in the same reporting wave asserts that a new statute, referred to as "Law 07-26," has been fully implemented and introduces tiered dissuasive fines for data protection breaches. That claim is contested: a more heavily sourced review states that no formal amending legislation has been enacted as of 2026, and the "Law 07-26" claim rests on a single T4 blog source not corroborated elsewhere. Given the conflict between sources, this development is best treated as unverified rather than as a confirmed change to Morocco's penalty regime. #### Other Developments Morocco's core data protection architecture remains structurally stable. The CNDP is the only personal data protection regulator in Morocco, with jurisdiction over all data controllers and processors subject to Law 09-08. Law 09-08 also applies to a foreign-established data controller using automated or non-automated means to process personal data in Moroccan territory, except transit-only processing or processing destined for a country with equivalent data protection legislation. Processing activities must generally be declared in advance to the CNDP unless exempt, dispensed from declaration, or subject to prior authorization. Law 09-08 places greater emphasis on consent and regulatory filings than the EU GDPR's accountability-based model. Enhanced safeguards apply to sensitive personal data including ethnic or racial origin, political or religious beliefs, trade union membership, health status, and genetic characteristics. Draft GDPR-alignment amendments would introduce data portability among other GDPR-aligned enhancements to Law 09-08, but as of 2026 no formal amending legislation has been enacted. Separately, draft amendments would also introduce mandatory breach notification, with the same enactment status as of 2026. Law 09-08 does not impose a mandatory Data Protection Officer appointment requirement, unlike the GDPR. Controllers must implement technical and organisational measures to secure personal data against unauthorised access, alteration, and disclosure. Morocco's international-transfer regime is stricter and more authorization-centric than the GDPR's SCC/BCR framework. The European Commission has not issued an adequacy decision in respect of Morocco, although the CNDP has pursued efforts to demonstrate the adequacy of Morocco's data protection standards. A single lower-tier source describes a financial-sector overlay in which credit bureaus must respect rules issued by the Governor of Bank Al-Maghrib; breaches or retention beyond a five-year maximum are said to trigger sector-specific sanctions in addition to CNDP fines. This claim rests on a single T4 source and has not been corroborated by higher-tier sources. The CNDP has not issued specific detailed guidance on cookies or adtech as of 2026, though any future reform of Law 09-08 may address this area. The CNDP's March 2025 communique on AI and personal data protection states that AI-driven processing of personal data must ensure citizens have effective means of redress. The CNDP is currently preparing a decision on AI and personal data, following a September 2025 partnership agreement with the Ministry of Digital Transition to develop a national platform for responsible AI. A single lower-tier source describes the CNDP as able to withdraw a company's processing authorization and publish sanctions in the Official Gazette or national newspapers as a name-and-shame measure, in addition to fines; this characterization has not been corroborated elsewhere. #### Cross-Monitor Connections The credit-bureau sectoral overlay under Bank Al-Maghrib rules intersects with financial-sector data governance tracked on the financial-integrity monitor. Readers following related financial-sector developments in Morocco may wish to consult that monitor for further context. No material connection to the crypto monitor was identified this cycle. #### Outlook Morocco's GDPR-alignment reform track, encompassing data portability and mandatory breach notification, has appeared as proposed-only across multiple reporting cycles. This pattern suggests a stalled rather than advancing amendment process. The CNDP's AI-governance activity, by contrast, appears to be building toward a dedicated deliberation on AI and personal data. The contested Law 07-26 claim will require primary-source verification before it can be treated as a confirmed change to Morocco's enforcement and penalty regime. Read full brief · 1180 words ###### Latest update · 11 October 2026 #### Regulatory Status Morocco's data-protection regime continues to run on Law No. 09-08, administered by the CNDP, without GDPR-equivalent accountability mechanisms built into the statute itself. Against that standing baseline, the CNDP is understood to have published guidance on 31 August 2026 imposing ten data-handling obligations on political parties ahead of the 23 September 2026 legislative elections, backed by criminal penalties of six months to two years' imprisonment and fines of MAD 50,000 to 300,000, and requiring clear flagging of AI-generated electoral content under the Penal Code and Organic Law 53-25. Legal commentary is understood to describe a parallel rise in CNDP enforcement activity, including warnings to major controllers and investigations into high-volume processors, though without named outcomes confirmed. No binding AI-specific data-protection regulation exists outside this election-specific flagging duty. #### Outlook Morocco's regulatory direction is tightening, concentrated in enforcement posture and in a narrow but concrete AI-content-disclosure duty tied to the election period, rather than in any amendment to Law 09-08's underlying structure. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Morocco operates a comprehensive, in-force data protection statute in Law 09-08, administered by the CNDP as the country's sole personal data protection regulator, with jurisdiction over all data controllers and processors subject to the law. The law extends to foreign-established controllers processing personal data within Moroccan territory, subject to limited exceptions, and processing activities must generally be declared to the CNDP in advance unless exempt, dispensed from declaration, or subject to prior authorization. Consent and regulatory filings carry greater weight than the accountability-based model used under the EU GDPR, and enhanced safeguards apply to sensitive personal data such as ethnic or racial origin, political or religious beliefs, trade union membership, health status, and genetic characteristics. A cluster of GDPR-alignment amendments — covering data portability and mandatory breach notification — remains proposed only, with no formal amending legislation enacted as of 2026. Law 09-08 does not impose a mandatory Data Protection Officer requirement, though it does require controllers to implement technical and organisational security measures. Morocco's cross-border transfer regime is authorization-centric and stricter than the GDPR's standard-contractual-clause and binding-corporate-rules framework, and the European Commission has not issued an adequacy decision in respect of Morocco. A single lower-tier source describes a financial-sector overlay in which credit bureaus must respect rules issued by the Governor of Bank Al-Maghrib, with a five-year retention cap; this claim awaits corroboration. The CNDP has not issued specific guidance on cookies or adtech as of 2026. The most active development this cycle concerns algorithmic governance: the CNDP's March 2025 communique on AI and personal data protection calls for effective means of redress for citizens subject to AI-driven processing, and the authority is reported to be preparing a dedicated decision on AI and personal data following a September 2025 partnership with the Ministry of Digital Transition. On enforcement, the CNDP is understood to have stepped up enforcement activity in 2025; a separate claim describing expanded name-and-shame powers and a new 'Law 07-26' penalty statute rests on a single lower-tier source and is contradicted by a more heavily sourced review stating no formal amendment has been enacted, and should be treated as unverified. #### Outlook Morocco's data protection framework remains structurally settled around its 2009 statute, with GDPR-alignment reforms stalled at the proposal stage across multiple cycles. Algorithmic governance is the area showing the clearest forward motion, with a dedicated CNDP AI decision in preparation. The contested enforcement-statute claim requires primary-source verification before it should be treated as a confirmed development. Read full brief · 603 words Key regulatory facts for Morocco Regulatory Dimension Morocco Standing Position Jurisdiction Morocco (MA) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 63 sourced findings) Regulator & Framework Comprehensive omnibus law and operational regulator exist, but gap-analysis-identified limits on CNDP powers and unconfirmed territorial scope pull the rating down from green. Lawful Processing & Special Data Core principles exist but consent standards and special-category coverage materially diverge from GDPR-equivalent baselines. Data Subject Rights Core rights (access, rectification, objection) exist; erasure and portability are absent, and statutory deadlines are unconfirmed. Controller/Processor Duties Some accountability practice (DPIA guidance, breach-handling reminders) exists but core GDPR-equivalent duties (DPO, ROPA, retention) are unconfirmed or absent. Primary Instruments Cited DataGuidance, IAPP, DataGuidance, IAPP, Chambers and Partners Last Confirmed / Updated 2026-11-04 (31 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Morocco: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Comprehensive omnibus law and operational regulator exist, but gap-analysis-identified limits on CNDP powers and unconfirmed territorial scope pull the rating down from green. Primary framework Law No. 09-08 of 18 February 2009 on the Protection of Individuals with regard to the Processing of Personal Data, and Implementing Decree No. 2-09-165 of 21 May 2009 Supervisory authority [Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)](https://www.cndp.ma) Traffic-light rationale — Amber Comprehensive omnibus law and operational regulator exist, but gap-analysis-identified limits on CNDP powers and unconfirmed territorial scope pull the rating down from green. #### Sub-modules (5) #### Regulator And AuthorityGreen CNDP is the designated national supervisory authority under Law 09-08. Claims (3): - The Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) is Morocco's national data protection supervisory authority responsible for overseeing compliance with Law No. 09-08. - The CNDP is the only personal data protection regulator in Morocco, with jurisdiction over all data controllers and processors subject to Law 09-08. - CNDP and NIIAT signed a Data-Tika partnership on 21 October 2026 for a six-month youth data-protection-awareness pilot in Casablanca-Settat; non-binding cooperation agreement, not a regulatory instrument. #### Act And InstrumentsAmber Primary instrument is Law 09-08 plus its 2009 implementing decree; CNDP has periodically announced reform/modernisation plans. Claims (3): - Personal data protection in Morocco is governed by Law n° 09-08 of 18 February 2009 relating to the protection of individuals with respect to the processing of personal data, and its Implementation Decree n° 2-09-165 of 21 May 2009. - In March 2020, CNDP announced measures including plans to revise national data protection laws and promote privacy-by-design, alongside internal reorganisation to speed up processing of notifications. - A secondary source reports an amending instrument 'Law 07-26' raising Morocco's data-breach penalty ceiling to 600,000 MAD, unconfirmed against a primary text. #### Material ScopeGreen Gap analysis found material scope broadly convergent with GDPR definitions and principles. Claims (1): - A Morocco-EU gap-analysis study found convergence between Law 09-08 and the GDPR on definitions, material scope of the law, and the principles of data processing. #### Territorial ScopeAmber No sourced evidence located on extraterritorial application to non-established controllers; searched 'Law 09-08 territorial scope non-established controllers' without a confirmed dedicated provision. Claims (4): - Law 09-08 — Applies to a foreign-established data controller using automated or non-automated means to process personal data in Moroccan territory, except transit-only processing or processing destined for a country with equivalent DP legislation. #### Regulator Registration And FilingAmber CNDP opened a national data-protection register/filing platform for controllers. Claims (2): - CNDP opened a national data protection register for controller filings/notifications. - All personal-data processing must be declared in advance to the CNDP unless exempt, dispensed from declaration, or subject to prior authorization. Morocco's data protection regime rests on Law n° 09-08 of 18 February 2009 and its Implementing Decree n° 2-09-165 of 21 May 2009, supervised by the CNDP. A 2018 Morocco-EU gap-analysis study found convergence with the GDPR on definitions, material scope and processing principles, but flagged limits on CNDP's powers. No sourced evidence was found on express extraterritorial/non-established-controller scope; searched 'CNDP territorial scope non-established controllers' yielded no dedicated provision. Periodic update · new data 2026-10-25 #### Regulator & Framework The Commission Nationale de controle de la protection des Donnees a caractere Personnel, Morocco's data protection authority, signed a cooperation agreement with NIIAT on 21 October 2026 establishing Data-Tika, a six-month youth data-protection-awareness pilot covering the Casablanca-Settat region. The commission has confirmed this agreement is a cooperation and outreach instrument aimed at training and public awareness, not a regulatory or legislative instrument, and it carries no amendment to Law n09-08 or to any implementing text. Its significance lies in signalling the commission's continued investment in public-facing capacity-building activity, a function distinct from its core regulatory and enforcement mandate, rather than in any change to the substantive rules governing data processing in Morocco. The partnership's geographic and temporal scope is narrow: a single region, Casablanca-Settat, and a defined six-month pilot period, with youth as the target population. This positions Data-Tika as an experimental outreach exercise whose longer-term significance will depend on factors not yet determined, including whether it is renewed, extended to other regions, or scaled nationally, and whether it produces any policy recommendation feeding back into the commission's regulatory or guidance work. None of that is yet established, and the agreement should be read strictly as what it is: a non-binding cooperation arrangement for public education, running alongside, but not altering, Morocco's existing data protection framework. Separately, and outside the scope of this partnership, secondary commentary dated 6 October 2026 describes a broader shift in the commission's posture, from an advisory orientation toward more active compliance control and audit activity, with penalties under Law n09-08 described as reaching up to three hundred thousand Moroccan dirhams. This description originates from commentary rather than from a primary publication of the commission itself within the period reviewed, and has not been corroborated against any such primary source in the material available. It is noted here as a signal worth monitoring, since a genuine shift toward more active audit and control activity by the commission would be a materially significant development for the regulatory framework as a whole, but it is not treated as an established fact of the framework at this stage pending corroboration from the commission's own publications. Taken together, the confirmed development this period, the Data-Tika partnership, is modest in its direct regulatory effect, while the unconfirmed development, the reported posture shift toward active enforcement, would be considerably more consequential if corroborated. Readers should distinguish clearly between the two: one is a confirmed but narrow outreach initiative, the other is an uncorroborated but potentially significant claim about the commission's operational direction. #### Outlook The Data-Tika pilot's practical significance will become clearer toward the end of its six-month run, when its reach, outcomes, and any decision on renewal or expansion should become apparent. Of greater structural importance is whether the reported shift toward active compliance control and audit activity is confirmed by a primary publication from the commission; until such confirmation surfaces, this remains a watch item rather than an established feature of Morocco's regulatory framework. No amendment to Law n09-08 itself, or to its implementing texts, has been identified in the period reviewed. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (10) - [DataGuidance](https://www.dataguidance.com/news/morocco-cndp-and-public-ministry-agree-data-protection) — The Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) is Morocco's national data protection supervisory authority responsible for overseeing compliance with Law No. 09-08. - [IAPP](https://iapp.org/news/a/moroccan-data-protection-law-moving-to-align-with-eu-data-protection) — Personal data protection in Morocco is governed by Law n° 09-08 of 18 February 2009 relating to the protection of individuals with respect to the processing of personal data, and its Implementation Decree n° 2-09-165 of 21 May 2009. - [DataGuidance](https://www.dataguidance.com/news/morocco-cndp-announces-new-measures-compliance-and) — In March 2020, CNDP announced measures including plans to revise national data protection laws and promote privacy-by-design, alongside internal reorganisation to speed up processing of notifications. - [IAPP](https://iapp.org/news/a/moroccan-data-protection-law-moving-to-align-with-eu-data-protection) — A Morocco-EU gap-analysis study found convergence between Law 09-08 and the GDPR on definitions, material scope of the law, and the principles of data processing. - [IAPP](https://iapp.org/news/a/moroccos-cndp-opens-national-data-protection-register/) — CNDP opened a national data protection register for controller filings/notifications. - [Chambers and Partners](https://practiceguides.chambers.com/practice-guides/comparison/1129/18514/29027-29028-29029-29030-29031) — The CNDP is the only personal data protection regulator in Morocco, with jurisdiction over all data controllers and processors subject to Law 09-08. - [Chambers and Partners](https://practiceguides.chambers.com/practice-guides/comparison/1129/18514/29027-29028-29029-29030-29031) — Law 09-08 — Applies to a foreign-established data controller using automated or non-automated means to process personal data in Moroccan territory, except transit-only processing or processing destined for a country with equivalent DP legislation. - [African Legal Factory](https://africanlegalfactory.com/2024/02/20/who-will-protect-your-personal-data-in-morocco-in-2024-the-competent-authorities/?lang=en) — All personal-data processing must be declared in advance to the CNDP unless exempt, dispensed from declaration, or subject to prior authorization. - [CMS Law](https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/morocco) — A secondary source reports an amending instrument 'Law 07-26' raising Morocco's data-breach penalty ceiling to 600,000 MAD, unconfirmed against a primary text. - [Aujourd'hui Le Maroc](https://aujourdhui.ma/societe/protection-de-la-vie-privee-lancement-dune-initiative-pour-former-20-000-jeunes) — CNDP and NIIAT signed a Data-Tika partnership on 21 October 2026 for a six-month youth data-protection-awareness pilot in Casablanca-Settat; non-binding cooperation agreement, not a regulatory instrument. ### Morocco: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core principles exist but consent standards and special-category coverage materially diverge from GDPR-equivalent baselines. Primary framework Law No. 09-08 of 18 February 2009 Supervisory authority [CNDP](https://www.cndp.ma) Traffic-light rationale — Amber Core principles exist but consent standards and special-category coverage materially diverge from GDPR-equivalent baselines. D2 · Lawful Processing — Full Module Record 4 sub-modules · 50 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Morocco: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core rights (access, rectification, objection) exist; erasure and portability are absent, and statutory deadlines are unconfirmed. Primary framework Law No. 09-08 of 18 February 2009 Supervisory authority [CNDP](https://www.cndp.ma) Traffic-light rationale — Amber Core rights (access, rectification, objection) exist; erasure and portability are absent, and statutory deadlines are unconfirmed. #### Sub-modules (5) #### Access RightAmber Inferred as convergent with GDPR baseline since the gap analysis did not flag access rights as a divergence. Claims (2): - Because the Morocco-EU gap analysis identified only the absence of a right to be forgotten and a right to data portability as divergences in data subject rights, rights of access, rectification and objection under Law 09-08 are inferred to be broadly convergent with the GDPR baseline. - Law 09-08 — Rights of access, rectification, completion, update, blocking/erasure, and objection on legitimate grounds, including a free right to object to processing for commercial-prospecting purposes. #### Rectification And ErasureAmber Rectification inferred as convergent; erasure/right-to-be-forgotten confirmed absent. Claims (2): - Because the Morocco-EU gap analysis identified only the absence of a right to be forgotten and a right to data portability as divergences in data subject rights, rights of access, rectification and objection under Law 09-08 are inferred to be broadly convergent with the GDPR baseline. - Law 09-08 does not include a right to be forgotten/erasure right equivalent to GDPR Article 17. #### Restriction And ObjectionAmber Objection right inferred as convergent since not flagged as a divergence area. Claims (1): - Because the Morocco-EU gap analysis identified only the absence of a right to be forgotten and a right to data portability as divergences in data subject rights, rights of access, rectification and objection under Law 09-08 are inferred to be broadly convergent with the GDPR baseline. #### Data PortabilityRed Data portability confirmed absent under Law 09-08. Claims (2): - Law 09-08 does not provide data subjects a right to data portability, a gap identified relative to the GDPR. - Draft GDPR-alignment amendments — Would introduce data portability among other GDPR-aligned enhancements to Law 09-08, but as of 2026 no formal amending legislation has been enacted. #### Deadlines And Response WindowsRed No sourced statutory response-window data found; searched 'CNDP data subject request deadline days' without result. Because the Morocco-EU gap analysis singled out only the absence of a right to be forgotten and a right to data portability as divergences in data subject rights, this indicates that access, rectification and objection rights under Law 09-08 are broadly convergent with the GDPR baseline; erasure and portability are confirmed gaps. No sourced information was found on statutory response-window deadlines; searched 'Law 09-08 CNDP subject access request deadline' without result. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (5) - [IAPP](https://iapp.org/news/a/moroccan-data-protection-law-moving-to-align-with-eu-data-protection) — Because the Morocco-EU gap analysis identified only the absence of a right to be forgotten and a right to data portability as divergences in data subject rights, rights of access, rectification and objection under Law 09-08 are inferred to be broadly convergent with the GDPR baseline. - [IAPP](https://iapp.org/news/a/moroccan-data-protection-law-moving-to-align-with-eu-data-protection) — Law 09-08 does not provide data subjects a right to data portability, a gap identified relative to the GDPR. - [IAPP](https://iapp.org/news/a/moroccan-data-protection-law-moving-to-align-with-eu-data-protection) — Law 09-08 does not include a right to be forgotten/erasure right equivalent to GDPR Article 17. - [CMS Law](https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/morocco) — Draft GDPR-alignment amendments — Would introduce data portability among other GDPR-aligned enhancements to Law 09-08, but as of 2026 no formal amending legislation has been enacted. - [9anon AI](https://9anonai.com/en/blog/data-breach-fines-morocco-2026) — Law 09-08 — Rights of access, rectification, completion, update, blocking/erasure, and objection on legitimate grounds, including a free right to object to processing for commercial-prospecting purposes. ### Morocco: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Some accountability practice (DPIA guidance, breach-handling reminders) exists but core GDPR-equivalent duties (DPO, ROPA, retention) are unconfirmed or absent. Primary framework Law No. 09-08 of 18 February 2009 Supervisory authority [CNDP](https://www.cndp.ma) Traffic-light rationale — Amber Some accountability practice (DPIA guidance, breach-handling reminders) exists but core GDPR-equivalent duties (DPO, ROPA, retention) are unconfirmed or absent. D4 · Controller & Processor — Full Module Record 7 sub-modules · 75 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Morocco: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A transfer mechanism and authorisation process exist, but EU adequacy remains unresolved and SCC/BCR/localisation instruments are unconfirmed. Primary framework Law No. 09-08 of 18 February 2009 Supervisory authority [CNDP](https://www.cndp.ma) Traffic-light rationale — Amber A transfer mechanism and authorisation process exist, but EU adequacy remains unresolved and SCC/BCR/localisation instruments are unconfirmed. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 79 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Morocco: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only one sub-module (health, via genomic-data recommendations) has sourced evidence; the remaining six sub-modules carry no confirmed sectoral overlay. Supervisory authority [CNDP](https://www.cndp.ma) Traffic-light rationale — Red Only one sub-module (health, via genomic-data recommendations) has sourced evidence; the remaining six sub-modules carry no confirmed sectoral overlay. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 62 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Morocco: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive or sector-specific adtech/commercial-privacy regime was identified for this JID beyond the general data protection law. Traffic-light rationale — Red No comprehensive or sector-specific adtech/commercial-privacy regime was identified for this JID beyond the general data protection law. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 58 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Morocco: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Biometric data is confirmed excluded from special-category protection and most sub-modules (profiling, ADM transparency, AI risk assessment, surveillance carve-outs) carry no sourced findings. Primary framework Law No. 09-08 of 18 February 2009 Supervisory authority [CNDP](https://www.cndp.ma) Traffic-light rationale — Red Biometric data is confirmed excluded from special-category protection and most sub-modules (profiling, ADM transparency, AI risk assessment, surveillance carve-outs) carry no sourced findings. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance Morocco has no binding AI-specific data-protection regulation in force. Reports suggest the CNDP may be preparing a decision addressing AI and personal data, though no decision text or expected date has been confirmed beyond a general sense that it remains at an early, unconfirmed stage. The clearest concrete step in this area to date is narrower and time-bound: the CNDP's 31 August 2026 guidance ahead of the 23 September 2026 legislative elections is understood to require clear flagging of AI-generated electoral content, with that requirement anchored in the Penal Code and Organic Law 53-25 rather than in a freestanding AI-governance instrument. This gives Morocco, for the election period at least, a disclosure obligation specific to AI-generated content, layered onto criminal-law provisions rather than built into Law 09-08 itself. #### Outlook The election-period AI-content-flagging duty is the first concrete marker in this area, but it is scoped to the electoral context; whether the CNDP's reportedly pending AI and personal-data decision generalises a comparable disclosure logic beyond elections remains unconfirmed. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 72 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Morocco: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only an awareness/education initiative is sourced; no statutory age-verification, parental-consent, minor-profiling-ban, or dependent-adult provisions were confirmed. Primary framework Law No. 09-08 of 18 February 2009 Supervisory authority [CNDP](https://www.cndp.ma) Traffic-light rationale — Red Only an awareness/education initiative is sourced; no statutory age-verification, parental-consent, minor-profiling-ban, or dependent-adult provisions were confirmed. D9 · Children's Privacy — Full Module Record 5 sub-modules · 62 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Morocco: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Institutional enforcement cooperation and international engagement exist, but CNDP's statutory powers are reportedly limited and collective-redress/private-right-of-action mechanisms are unconfirmed. Primary framework Law No. 09-08 of 18 February 2009 Supervisory authority [CNDP](https://www.cndp.ma) Traffic-light rationale — Amber Institutional enforcement cooperation and international engagement exist, but CNDP's statutory powers are reportedly limited and collective-redress/private-right-of-action mechanisms are unconfirmed. Periodic update · new data 2026-10-11 #### Enforcement & Redress The CNDP is understood to have published guidance on 31 August 2026 setting ten data-handling obligations for political parties ahead of the 23 September 2026 legislative elections. The guidance is reported to carry criminal penalties for non-compliance, running from six months' to two years' imprisonment and fines of MAD 50,000 to 300,000, which puts it on a materially harder enforcement footing than the administrative posture typically associated with Law 09-08. The same guidance requires clear flagging of AI-generated electoral content, drawing on the Penal Code and Organic Law 53-25 for that requirement. Separately, legal commentary is understood to describe the CNDP issuing warnings to major data controllers and opening investigations into high-volume processors in the months preceding this review, though no named controller, investigation outcome, or published sanction has been confirmed. Read together, these two threads point to a CNDP exercising its supervisory role more visibly than its historically declarative posture under Law 09-08 would suggest, albeit still without a confirmed public enforcement decision to anchor that shift. #### Outlook The criminal-penalty structure attached to the election-period guidance is a sharper enforcement tool than anything previously associated with Law 09-08, and whether the CNDP uses it, or converts its reported warnings and investigations into named decisions, will be the test of whether this is a durable shift in enforcement posture rather than an election-specific measure. Periodic update · new data 2026-09-28 #### Enforcement & Redress Morocco's data-protection enforcement posture is reported to be tightening this cycle. Per Chambers and Partners' practice-guide commentary, over the last several months the CNDP has started issuing warnings to major data controllers and has initiated investigations into potential violations by controllers processing significant volumes of personal data. This is understood to represent a shift from what has historically been a largely dormant sanctioning environment under Law 09-08 toward a more active enforcement posture, though the underlying statute itself has not been amended and the shift is one of enforcement practice rather than legal change. The statutory sanctions ceiling behind this activity has not changed: non-compliance with Law 09-08 remains subject to a fine ranging from MAD 10,000 to MAD 600,000 and, or imprisonment of between three months and four years. The same source reports that the CNDP typically sends a warning before pursuing such sanctions, which is consistent with the warnings-first pattern described for the current wave of major-controller investigations; whether any of the current investigations will progress to a formal fine or referral is not yet established in the evidence available this cycle. Running alongside this enforcement tightening, discussion continues over GDPR-alignment reforms to Law 09-08, which would introduce a statutory breach-notification deadline, formal data protection impact assessments, enhanced subject rights and an accountability-based compliance model closer to the EU framework. As of this cycle, no formal amending legislation has been enacted, and the existing statute's structural gaps, most notably the absence of any fixed breach-notification deadline, persist. Industry practice recommends notifying the CNDP within less than 72 hours of a breach and informing affected individuals where risk is high, but this is a non-binding recommendation rather than a statutory requirement, and controllers should not treat it as equivalent to a legal deadline. The combination of an intensifying enforcement posture and an unreformed, GDPR-gap-carrying statute is the defining tension in Morocco's data-protection environment this cycle: enforcement risk is rising in practice even though the legal framework generating the exposure has not itself been modernised to match. #### Outlook The principal item to watch is whether the CNDP's current wave of warnings against major and high-volume data controllers converts into formal sanctions, which would be the first visible test of the statutory fine and imprisonment ceiling under this more active enforcement posture. A secondary item is whether the discussed GDPR-alignment reforms, covering breach notification, DPIAs and accountability obligations, progress from discussion to a formal legislative proposal; no confirmed timeline exists for either development in the evidence available this cycle. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 104 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (15 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 33-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties