Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
Law No. 09-08 (2009) establishes Morocco's data protection framework, creating the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) as the supervisory authority. The law defines data subject rights (access, rectification, opposition, erasure), obligations for data controllers and processors, requirements for lawful processing, cross‑border data transfer restrictions, security measures, and administrative penalties. It was amended by Decree No. 2-20-03 in 2020, which updated provisions on data breach notification, electronic communications, and introduced additional safeguards for sensitive data. The law aligns with many principles of the EU GDPR but is not considered fully equivalent.
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data is a compliance framework from Morocco with 8 domains and 8 controls. The largest domains are Cross-Border Transfer + CNDP Authorisation + Adequacy (1 controls), DPO + Sanctions + Convention 108 + Modernisation (1 controls), Lawful Basis + Consent + Notice + Article 4-6 (1 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Cross-Border Transfer + CNDP Authorisation + Adequacy
| Code | Title |
|---|---|
| MA-0908-Cross-Border-Data-Transfer-Authorisation-Article-43-44-CNDP-Adequacy-SCC-BCR | Morocco Law 09-08 Cross-Border Transfer + CNDP Authorisation + Adequacy + SCC |
DPO + Sanctions + Convention 108 + Modernisation
| Code | Title |
|---|---|
| MA-0908-DPO-Correspondent-Sanctions-Convention-108-Modernisation-Articles-15-31-32-CNDP-Investigations | Morocco Law 09-08 DPO Correspondent + Sanctions + Convention 108 + Modernisation + Articles 15-32 |
Lawful Basis + Consent + Notice + Article 4-6
| Code | Title |
|---|---|
| MA-0908-Lawful-Basis-Consent-Notice-Information-Article-4-5-6-Specific-Informed-Unambiguous | Morocco Law 09-08 Lawful Basis + Consent + Notice + Article 4-5-6 + Specific Informed |
Prior Declaration + Authorisation + CNDP + Public Register
| Code | Title |
|---|---|
| MA-0908-Prior-Declaration-Authorisation-CNDP-Article-12-Notification-Registration-Public-Register | Morocco Law 09-08 Prior Declaration + Authorisation + CNDP + Article 12 + Public Register |
Scope + Law 09-08 + Dahir 1-09-15 + CNDP + Convention 108
| Code | Title |
|---|---|
| MA-0908-Scope-Application-Law-09-08-Dahir-1-09-15-18-February-2009-Effective-23-November-2009-CNDP-Convention-108 | Morocco Law 09-08 Scope and Application + Dahir 1-09-15 + 18 February 2009 + CNDP |
Security + Subcontractor + Retention + CCTV + Cookies
| Code | Title |
|---|---|
| MA-0908-Security-Subcontractor-Retention-Video-CCTV-Workplace-Cookies-Marketing-Articles-23-30 | Morocco Law 09-08 Security + Subcontractor + Retention + Video CCTV + Cookies + Marketing |
Sensitive Data + Biometric + Whistleblower + Article 12
| Code | Title |
|---|---|
| MA-0908-Sensitive-Data-Biometric-Access-Whistleblower-Articles-12-Authorisation-Special-Categories | Morocco Law 09-08 Sensitive Data + Biometric + Whistleblower + Authorisation |
Subject Rights + Access + Correction + Object + Article 7-11
| Code | Title |
|---|---|
| MA-0908-Data-Subject-Rights-Access-Correction-Erasure-Object-Article-7-8-9-10-11-30-Day-SLA | Morocco Law 09-08 Data Subject Rights + Access + Correction + Erasure + Object + Article 7-11 |
What is Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data and who does it apply to?
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data is a compliance framework from Morocco with 8 domains and 8 controls. Law No. 09-08 (2009) establishes Morocco's data protection framework, creating the Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) as the supervisory authority. The law defines data subject rights (access, rectification, opposition, erasure), obligations for data controllers and processors, requirements for lawful processing, cross‑border data transfer restrictions, security measures, and administrative penalties. It was amended by Decree No. 2-20-03 in 2020, which updated provisions on data breach notification, electronic communications, and introduced additional safeguards for sensitive data. The law aligns with many principles of the EU GDPR but is not considered fully equivalent. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data actually require?
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data has 8 controls organised across 8 domains. The largest domains are Cross-Border Transfer + CNDP Authorisation + Adequacy (1 controls), DPO + Sanctions + Convention 108 + Modernisation (1 controls), Lawful Basis + Consent + Notice + Article 4-6 (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data do I already cover?
Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data?
Start your Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 8 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required