Law: Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (only available in French here) (the Law)

Regulator: Moroccan data protection authority (CNDP)

Summary: Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (only available in French here) (the Law) entered into force on February 18, 2009, and provides a general framework for personal data protection in Morocco.

The Law provides for data subject rights and data controller and processor obligations, but does not provide a legal requirement under applicable law to notify of a data breach. Additionally, the Law is particularly comprehensive with respect to the circumstance under which consultation with the Moroccan data protection authority (CNDP) is required before companies can engage in data processing activities.

In the international sphere, Morocco is a signatory to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) and the Protocol amending Convention 108 (Convention 108+).