CNDP Compliance — Morocco

Sovereign communications built for Morocco's *data protection law.*

Law No. 09-08 sets comprehensive obligations on every organisation that processes personal data in Morocco — including cross-border transfer restrictions, prior authorisation for sensitive data, and mandatory CNDP notification. SCOVR keeps all communications data inside Morocco, satisfying the law's core residency and security requirements by architecture, not by policy.

Book a compliance briefing → Download the CNDP guide
In-country data residency CNDP notification-ready No cross-border transfer authorisation required
MAD 300K
Maximum criminal fine under Law 09-08 Art. 38 — applied by CNDP alongside imprisonment for intentional violations
2yr
Maximum prison sentence for intentional violations, including unlawful cross-border transfers and unauthorised processing of sensitive personal data
2009
Year Law 09-08 entered into force — one of the first comprehensive personal data protection frameworks in Africa and the Arab world
30d
Maximum response time for data subject access requests under Art. 12 — the controller must reply in writing with full details of processing
Morocco's data protection framework

Law No. 09-08 and the CNDP establish a prior-authorisation model with criminal teeth.

Unlike the post-GDPR accountability model, Moroccan law requires organisations to notify or obtain authorisation from CNDP before processing begins — making pre-deployment compliance assessment essential for every communications platform deployed in Morocco.

Morocco — Loi 09-08

Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel

Promulgated in February 2009 and implemented by Decree n° 2-09-165, Law 09-08 is Morocco's primary personal data protection statute. It is supervised and enforced by the CNDP — Commission Nationale de contrôle de la protection des Données à caractère Personnel — an independent administrative authority with powers to issue formal notices, conduct investigations, impose administrative sanctions, and refer cases for criminal prosecution. The law applies to any processing of personal data carried out in Morocco or by a controller established in Morocco, regardless of where the data is stored or processed.

Authority: CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel) — independent administrative authority with investigative and sanctioning powers.

Prior notification: Standard processing activities must be declared to CNDP before commencement (Art. 18). Certain categories require prior authorisation rather than simple notification.

Sensitive data: Health data, genetic data, biometric identifiers, racial or ethnic origin, political opinions, religious beliefs, criminal records — all require prior CNDP authorisation under Arts. 19–22.

Cross-border transfers: Transfers to countries without adequate protection require prior CNDP authorisation under Art. 23. Adequate countries include EU/EEA states and those on CNDP's approved list.

Fines: Criminal fines from MAD 10,000 to MAD 300,000 under Arts. 38–40. Administrative sanctions also available for procedural violations including failure to notify CNDP.

Imprisonment: One month to two years for intentional violations. Sentences are doubled for repeat offences or where the violation prejudices national security or public order.

Data subject rights: Right of access (Art. 12), rectification (Art. 13), opposition (Art. 14), and objection to automated decision-making (Art. 15) — all must be exercisable without charge.

Security obligation: Art. 29–30 require appropriate technical and organisational measures proportionate to the nature of the data and the risks of the processing.

Obligation mapping

The platform addresses every Law 09-08 obligation structurally.

Every key obligation that touches communications infrastructure is addressed at the platform level — architecture first, documentation second.

Article
Law 09-08 Requirement
Architectural Response
Status
Art. 3
Data minimisation & purpose limitation
No metadata analytics, behavioural profiling, or content scanning. Processing is limited to routing and delivery of encrypted messages — nothing is retained for product improvement or commercial use.
✓ Met
Art. 4–6
Lawfulness of processing
End-to-end encryption active on every channel by default. No server operator reads message content. Processing is limited to what is technically necessary — satisfying the proportionality standard of Art. 5.
✓ Met
Art. 18
Prior CNDP notification
A single CNDP notification covers the sovereign deployment. Because data never leaves Morocco, no ongoing per-transfer notifications are required. Deployment documentation provides the complete processing description CNDP requires.
✓ Met
Art. 19–22
Sensitive data prior authorisation
Zero-knowledge architecture means no server operator — including the platform itself — can access the content of communications. Sensitive data transmitted on the platform is never exposed to automated processing, profiling, or classification, satisfying the highest CNDP authorisation standard.
✓ Met
Art. 23–24
Cross-border transfer restriction
Sovereign hosting inside Morocco means no personal data of Moroccan residents is transferred abroad for internal communications. No CNDP authorisation required. For federated communications with external partners, each server processes only its own users — encrypted transit, no data transfer.
✓ Met
Art. 29–30
Technical & organisational security
Rust-based cryptographic implementation, ISO 27001:2022 certified operational security, open-source codebase independently auditable by CNDP or third-party assessors. Security measures are proportionate to the highest-risk data categories.
✓ Met
Art. 12–13
Access & rectification rights
Platform administration tools enable data export, correction, and deletion in response to data subject requests. Full audit trail available. Response within the 30-day statutory deadline is operationally straightforward.
✓ Met
Art. 15
Automated decision-making
The platform performs no automated profiling, sentiment analysis, or content-based classification. Processing is strictly delivery-only. No decision with legal effect on a data subject is made automatically — satisfying the Art. 15 human oversight requirement.
✓ Met
Art. 38–40
Criminal sanctions & CNDP enforcement
Architectural compliance eliminates the processing failures that trigger criminal liability — unauthorised transfers, inadequate security, unlawful sensitive data processing. Pre-built CNDP notification package provides complete documentation before processing begins.
↑ Supported
Data localisation

The law says data must not leave without authorisation. The architecture makes it impossible for it to.

Art. 23 of Law 09-08 prohibits the transfer of personal data to a country that does not provide an adequate level of protection, unless CNDP grants prior authorisation. Every foreign-headquartered cloud messaging service, video conferencing platform, or file sharing tool that routes Moroccan data through servers outside Morocco — or that is operated by a company subject to another jurisdiction's laws — constitutes a potential cross-border transfer requiring CNDP clearance.

The reason is not limited to where servers are physically located. A company headquartered in the United States remains subject to US law regardless of where it operates servers. US authorities can compel production of data held anywhere in the world. Using such a platform for Moroccan communications creates legal exposure regardless of contractual assurances.

SCOVR resolves this by design. The platform is deployed on servers physically inside Morocco, under Moroccan law, with no foreign parent company holding rights over the infrastructure. Internal communications between any Moroccan organisations on sovereign infrastructure never trigger Art. 23. For communications with external counterparties — international partners, foreign governments, overseas clients — the federated architecture ensures that each organisation's server processes only its own users' data, with message content encrypted end-to-end. No Moroccan personal data is transferred to or processed by the foreign server.

CNDP enforcement is active. The Commission has investigated and sanctioned organisations in the financial services, telecommunications, and public sector for inadequate security measures, unauthorised processing, and failure to complete prior notification. The prior-authorisation model means the obligation arises before processing begins — retroactive compliance is not available once CNDP opens an investigation.
Sovereign platform — CNDP data localisation

In-country hosting by default

All data — messages, files, voice recordings, call metadata, user profiles — is stored on servers physically inside Morocco. The cross-border transfer prohibition is satisfied architecturally, before any legal analysis is required.

No CNDP transfer authorisation required

Internal communications between Moroccan organisations never require Art. 23 authorisation. A single Art. 18 notification covers the deployment. Regulatory overhead is minimised without any legal risk-taking.

Foreign jurisdiction eliminated

No US-headquartered parent, no French cloud operator, no multinational platform processes Moroccan data. The platform is self-hosted — your jurisdiction's laws govern, and no foreign authority has a legal basis for access.

Internal communications stay domestic

Communications between government ministries, regulated financial institutions, healthcare providers, and their counterparts within Morocco — none of it ever leaves the country. Sovereignty is preserved by the architecture, not by a contractual clause.

CNDP notification documentation ready

Every deployment includes a pre-built CNDP notification package — processing description, data categories, retention schedule, security measures, and DPA-equivalent controller identification — submitted before the first message is sent.

Communications categories

Every communications category Law 09-08 touches — addressed.

Messaging, video conferencing, file sharing, and data hosting: four categories of personal data processing that trigger Law 09-08 obligations, all addressed by a single sovereign platform.

Secure messaging

Every message is encrypted end-to-end before leaving the sender's device. No server operator can read content. Personal data in messages — names, IDs, financial details, health information — is protected and processed only within Morocco.

Art. 29–30Art. 3Art. 23

Video conferencing

Encrypted voice and video calls hosted on sovereign infrastructure. Meeting content is never stored on foreign servers. Communications between government entities, regulated firms, and their advisors remain entirely within Morocco.

Art. 29–30Art. 23Art. 19–22

File sharing

Documents, contracts, reports, and sensitive records are shared within encrypted channels on sovereign servers. Role-based access controls ensure only authorised recipients retrieve files. No foreign platform operator processes the data.

Art. 29–30Art. 23Art. 4–6

Data hosting

All data — messages, files, call records, user profiles, audit logs — is hosted in Morocco on shared multi-tenant infrastructure restricted to authorised users within your organisation. No cross-border residency risk, no Art. 23 exposure.

Art. 23Art. 18Art. 29–30
Compliance documentation

Documentation, notification, and certification — bundled with every deployment.

CNDP compliance is not solely an architectural question. The prior-notification model requires complete processing documentation to be ready before the first message is sent.

Law 09-08

CNDP Notification Package

Pre-built Art. 18 notification documentation covering: controller identity, processing purposes, data categories, retention periods, security measures, and transfer assessment. Ready for submission to CNDP before deployment begins.

Art. 19–22

Sensitive Data Authorisation Support

For organisations processing sensitive personal data — health records, biometrics, criminal data — the platform provides the zero-knowledge architecture evidence required to support a prior authorisation request to CNDP, demonstrating no operator access to sensitive content.

ISO 27001

Certified Security Framework

Platform and operational processes certified to ISO/IEC 27001:2022 — providing internationally recognised evidence of technical and organisational security measures that satisfies the Art. 29–30 proportionality standard and supports CNDP's security assessment framework.

Frequently asked questions

CNDP questions compliance teams ask most often.

Specific answers to the Law 09-08 questions legal, compliance, and technology teams across Morocco ask most often.

Does using a foreign cloud platform for Moroccan communications require CNDP authorisation under Art. 23?+
Yes, in most cases. Art. 23 requires prior CNDP authorisation before transferring personal data to a country that does not provide adequate protection. The key issue is that a platform operated by a foreign company — even if it runs servers in Morocco — may constitute a transfer if the operator can access the data under foreign law. A US-headquartered platform, for example, is subject to US legal orders regardless of where its servers are located. Using SCOVR, a self-hosted sovereign deployment with no foreign parent, eliminates this exposure entirely. No Art. 23 authorisation is needed for internal Moroccan communications.
What is the difference between CNDP notification (Art. 18) and prior authorisation (Arts. 19–22)?+
Art. 18 notification is the standard requirement for most processing activities — the controller declares the processing to CNDP before starting, and may proceed unless CNDP objects. Prior authorisation under Arts. 19–22 applies to higher-risk processing — sensitive data categories, automated decisions with legal effects, large-scale monitoring — and requires CNDP's explicit approval before processing begins. A sovereign SCOVR deployment requires an Art. 18 notification for standard communications processing. If the organisation processes sensitive data through the platform, the zero-knowledge architecture (no operator access to content) supports the Art. 19 authorisation request by demonstrating that the sensitive data is never exposed to processing beyond delivery.
How does the platform satisfy Law 09-08 for Moroccan organisations that need to communicate with European partners?+
For communications with European counterparties, the federated architecture ensures that each organisation hosts its own server in its own jurisdiction. The Moroccan organisation's server processes only its own users' data. The European counterparty's server processes only its own users' data. Messages are encrypted end-to-end and transit between servers — but the message content is never accessible to either server operator. From a Law 09-08 perspective, no personal data of Moroccan residents is transferred to the European server — only encrypted transit occurs. This is structurally different from routing communications through a third-party cloud platform, where the operator's servers process the content.
How does Law 09-08 compare to the GDPR — and does GDPR compliance transfer to Morocco?+
Law 09-08 is modelled on the 1995 EU Data Protection Directive, which preceded the GDPR. The substantive principles — purpose limitation, data minimisation, proportionality, data subject rights, security obligations, cross-border transfer restrictions — are structurally identical to GDPR. The procedural model is different: GDPR uses an accountability-based approach with DPOs, RoPA, and DPIAs; Law 09-08 uses prior notification and authorisation to CNDP. An organisation already GDPR-compliant in substance will find Law 09-08 familiar — the key difference is demonstrating that compliance to CNDP through the notification and authorisation process rather than through internal accountability documentation alone.
Does Law 09-08 apply to international organisations with operations in Morocco?+
Yes. Law 09-08 applies to any controller established in Morocco or that uses means of processing located in Morocco — including equipment, servers, and networks. International companies with Moroccan offices, local subsidiaries, or infrastructure in Morocco are subject to the law for the processing they carry out in-country. This includes cross-border transfer restrictions: transferring Moroccan employee or customer data to headquarters abroad requires CNDP authorisation unless the destination country is on the adequate protection list. A SCOVR deployment in Morocco means that internal Moroccan communications never leave the country — eliminating transfer authorisation requirements for day-to-day operations.
What are the practical consequences of CNDP finding a violation?+
CNDP has a graduated enforcement toolkit. For procedural violations — failure to notify, incomplete notifications — CNDP issues a formal mise en demeure requiring remediation within a specified period. For substantive violations — unauthorised processing, inadequate security, unlawful cross-border transfers — CNDP can impose administrative sanctions and refer the matter for criminal prosecution. Criminal prosecution carries fines of MAD 10,000 to MAD 300,000 and up to two years' imprisonment for intentional violations. Penalties are doubled for repeat violations or where the violation prejudices national security. Unlike GDPR, there is no turnover-based fine cap — but the criminal element means individual liability (directors, compliance officers) is a realistic risk.

Sovereign communications for Morocco's data protection era.

Book a private briefing with our CNDP compliance team. We will design a deployment that satisfies Law 09-08 — notification-ready, transfer-compliant, and architecturally sovereign — before processing begins.

Book a compliance briefing → Download the CNDP guide