Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
Morocco's personal data protection law, Law No. 09-08 of 18 February 2009 with implementing Decree No. 2-09-165 of 21 May 2009, supervised by the CNDP and unamended as of September 2026: data quality and consent, information including the CNDP receipt, access, ten-day rectification, objection, electronic marketing consent, automated decisions, prior declaration of processing and prior CNDP authorisation for sensitive, genetic, criminal and national ID card data and interconnections, security with eight controls for sensitive and health data, processor contracts, secrecy, transfers only to adequate states or on listed grounds or CNDP authorisation, and criminal fines and imprisonment. Built from the Law's own text.
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data is a compliance framework from Morocco with 6 domains and 28 controls. The largest domains are Chapter II: rights of the data subject (Articles 5 to 11) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (8 controls), Chapter III, section 3: confidentiality, security and professional secrecy (Articles 23 to 26) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (5 controls), Chapter III: prior declaration and prior authorisation (Articles 12 to 22) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Chapter I: definitions, scope, data quality and consent (Articles 1 to 4) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
| Code | Title |
|---|---|
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::2(3) | Article 2(3): a controller established abroad using means in Morocco notifies a representative installed in Morocco |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::3 | Article 3: data quality, purpose limitation and retention |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::4 | Article 4: consent unless a listed ground applies, including for communication to third parties |
Chapter II: rights of the data subject (Articles 5 to 11) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
| Code | Title |
|---|---|
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::10 | Article 10: electronic direct marketing only with prior consent |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::11 | Article 11: no decisions based solely on automated profiling |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::5(1) | Article 5(1), (2) and (4): information when collecting from the data subject, including the CNDP receipt or authorisation reference |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::5(3) | Article 5(3) and Article 6: information when data is not collected from the data subject, and the limits |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::7 | Article 7: right of access, free and without delay |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::8(a) | Article 8(a): update, rectify, erase or block non-compliant data within ten days |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::8(b) | Article 8(b): notify third parties of updates, rectifications, erasures and blocking |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::9 | Article 9: right to object, and free objection to prospecting |
Chapter III, section 3: confidentiality, security and professional secrecy (Articles 23 to 26) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
| Code | Title |
|---|---|
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::23(1) | Article 23(1): appropriate technical and organisational security measures |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::23(2) | Article 23(2) to (4): choosing and binding processors |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::24 | Article 24: the eight security controls for sensitive and health data |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::25 | Article 25: processing only on the controller's instructions |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::26 | Article 26: professional secrecy, continuing after the function ends |
Chapter III: prior declaration and prior authorisation (Articles 12 to 22) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
| Code | Title |
|---|---|
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::12(1) | Article 12(1): prior CNDP authorisation for listed processing |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::12(2) | Articles 12(2) and 13 to 15: prior declaration of all other processing and of every change |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::18 | Article 18: public registers exempt from declaration still need a named controller |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::19 | Article 19: begin processing only on the CNDP receipt and cite it in collection and transmission |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::21 | Articles 21 and 22: sensitive data only with a law, express consent or a listed ground, authorised by the CNDP; health data for care on declaration |
Chapters IV to VI: the CNDP, transfers abroad, the national register and criminal data (Articles 27 to 50) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
| Code | Title |
|---|---|
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::43 | Article 43: transfers abroad only to states ensuring a sufficient level of protection |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::44 | Article 44: transfers to other states only on express consent, a listed necessity, a treaty or CNDP authorisation |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::49 | Article 49: data on offences, convictions and security measures only by the listed bodies |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::62 | Articles 30, 62 and 63: allow CNDP controls and comply with its decisions |
Decree No. 2-09-165: procedures for requests, research data and transfers – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
| Code | Title |
|---|---|
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::D-31 to 33 | Decree Articles 31 to 33: anonymise or code data before communicating it for research, and publish results without identification |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::D-35 to 37 | Decree Articles 35 to 37 and 39: how rights requests are received and handled |
| law-no-09-08-on-the-protection-of-individuals-with-regard-to-the-processing-of-personal-data::D-43 to 45 | Decree Articles 43 to 45: ask about objection at collection, keep proof, and pass objections on |
What is Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data and who does it apply to?
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data is a compliance framework from Morocco with 6 domains and 28 controls. Morocco's personal data protection law, Law No. 09-08 of 18 February 2009 with implementing Decree No. 2-09-165 of 21 May 2009, supervised by the CNDP and unamended as of September 2026: data quality and consent, information including the CNDP receipt, access, ten-day rectification, objection, electronic marketing consent, automated decisions, prior declaration of processing and prior CNDP authorisation for sensitive, genetic, criminal and national ID card data and interconnections, security with eight controls for sensitive and health data, processor contracts, secrecy, transfers only to adequate states or on listed grounds or CNDP authorisation, and criminal fines and imprisonment. Built from the Law's own text. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data actually require?
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data has 28 controls organised across 6 domains. The largest domains are Chapter II: rights of the data subject (Articles 5 to 11) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (8 controls), Chapter III, section 3: confidentiality, security and professional secrecy (Articles 23 to 26) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (5 controls), Chapter III: prior declaration and prior authorisation (Articles 12 to 22) – Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data do I already cover?
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data?
Start your Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required