Law 09-08 is the compliance text most widely ignored by Moroccan businesses, even though it is also the one that concerns them most directly. Unlike the cybersecurity law, which is reserved for critical infrastructure, this one applies as soon as you handle the slightest piece of personal data.
What counts as personal data
Any information that makes it possible to identify a natural person, directly or indirectly. In practice, within an SME:
- the customer and prospect file, with names, phone numbers and addresses
- personnel records, including payroll data
- job applications received and CVs kept on file
- video surveillance recordings of the premises
- time-clock and access control data
- IT connection logs
The legal framework rests on the dahir of February 2009 and its implementing decree of May 2009. The supervisory authority is the Commission nationale de contrôle de la protection des données à caractère personnel.
The concrete obligations
Declare processing operations
Each processing operation must be declared to the commission. The procedure is done online and it is free. This deserves emphasis, because many company directors assume a cost or an administrative burden that does not exist.
Inform the people concerned
Your customers, employees and applicants must know what data is collected, for what purpose, how long it is kept and how to exercise their rights. In practice that means a notice on forms, an accessible privacy policy and a visible sign for video surveillance.
Secure
Measures must be proportionate to the sensitivity of the data: access control, encryption where relevant, traceability of consultations, and contractual terms with suppliers who access the data.
Limit
Collect only what serves the declared purpose, and do not keep data indefinitely. A six-year-old database of job applications is a risk with no upside.
The authority’s powers and the penalties
The commission can carry out on-site investigations, audit systems and require documents to be produced. It issues warnings, formal notices and suspensions of processing, and can refer matters to the public prosecutor.
On the criminal side, the company director can be prosecuted personally, with prison terms ranging from three months to two years and fines from ten thousand to three hundred thousand dirhams depending on the offence.
One factor changes the picture: after a long period devoted to education, the authority now runs sector inspection campaigns with firm deadlines. The de facto tolerance of past years can no longer serve as a strategy.
Where to start
- List existing processing operations, department by department. This inventory almost always turns up forgotten files.
- Declare the processing operations to the commission.
- Write and publish an honest privacy policy describing your actual practices.
- Add information notices on forms and video surveillance signs.
- Set retention periods and apply them.
- Put contractual terms in place with suppliers who access the data.
Frequently asked questions
Is the declaration chargeable?
No, the online declaration to the commission is free of charge.
Does a three-person business fall within scope?
Yes. The law sets no headcount or turnover threshold.
Our data is hosted abroad, is that a problem?
Transfer outside Morocco is regulated and requires safeguards. It is a point to check with your hosting provider before committing.
Do we have to appoint a data protection officer?
It is not systematically required, but designating an internal point of contact makes compliance and handling requests considerably easier.
How we help
Systomap supports the inventory of processing operations, technical security work and the drafting of information documents. See also our article on cybersecurity obligations for SMEs. Write to us.
