MOROCCAN STARTUPS, LEARN HOW TO COMPLETE YOUR PERSONAL DATA PROCESSING DECLARATIONS!
Declaring your personal data processing operations to the CNDP is mandatory if your startup processes personal data. What is personal data processing? Which form to fill in? The aim of this article is to help you understand these regulations.
WHEN DOES MY STARTUP PROCESS PERSONAL DATA?
Startups may need to process personal data as part of their business activities, for example when running marketing campaigns, payroll, invoicing or developing an e-commerce website.
These processes often use personal data such as surname, first name, ID card number, email address, photo, telephone number, fingerprints, DNA and bank details. Such data, which identifies or renders identifiable the persons concerned (e.g. employees, customers or suppliers), must be protected, processed in proportion to the intended purpose and kept for a limited period, not exceeding the time required to achieve the purpose of the processing.
You will find below other examples of the purposes for which personal data is processed:
- personnel management and payroll administration ;
- access to / consultation of a contact database containing personal data (e.g. CRM software);
- promotional e-mails;
- shredding of documents containing personal data ;
- publication / display of a photo of a person on a website ;
- conservation of IP or MAC addresses ;
- video surveillance recording.
What geographical scope? All personal data processing whose data controllers (e.g. start-ups carrying out the processing) or means of processing are located on Moroccan territory must comply with law 09-08 of February 18, 2009 (BO n°5714 of 05-03-2009).
WHAT SHOULD I DO IF I PROCESS PERSONAL DATA IN MOROCCO WITH REGARD TO THE CNDP?
All processing of personal data must be declared to the CNDP prior to implementation (with the exception of those excluded from the scope of law no. 09-08, or exempt from declaration to the CNDP, or subject to prior authorization).
Warning 1: if you treat sensitive data, i.e. in particular data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data or data relating to health, genetic data or data containing the CIN, must be processed.
a request for authorization from the CNDP
. It is not a matter of declaring that personal data will be processed, but of requesting authorization from the CNDP to process sensitive data;
Warning 2: if you transfer data abroad (outside Morocco), or for example, if personal data is hosted or transmitted abroad, you must also complete
a request for the transfer of data abroad
to the CNDP.
WHAT IS THE PROCEDURE FOR DECLARING PERSONAL DATA PROCESSING?
Step 1:
Download the standard declaration form F211 or the simplified standard declaration form (in accordance with a decision) F214 prior to processing personal data and return it to the CNDP. This form must be accompanied by
- a document authorizing the signatory to bind the legal entity;
- a copy of the signatory’s national identity card ;
- any other relevant documents.
For information on what to include in the declaration :
https://www.cndp.ma/fr/service-en-ligne/responsables-de-traitement.html
Step 2:
- The CNDP issues a receipt for the declaration within 24 hours.
- Within 8 days, the CNDP notifies the startup declaring its decision to submit the processing to the prior authorization regime, if it considers that the envisaged processing presents manifest dangers for the respect and protection of the privacy and fundamental rights and freedoms of the persons concerned.
Please note that if the file is incomplete, these deadlines do not start to run until the information or documents requested by the CNDP have been provided.
WHY DO YOU HAVE TO COMPLY WITH REGULATIONS?
Why do you need to comply with Law 09-08?
To avoid the financial penalties provided for under law 09-08, as well as criminal convictions!
But that’s not all: complying with the requirements of Law 09-08 sets you apart from your competitors. This gives you an extremely positive competitive edge, in terms of your company’s reputation and brand image. This demonstrates exemplary management of the personal data processed on your customer’s behalf, as well as compliance with security and confidentiality measures.
