Declaring personal data processing in Morocco
Moroccan startups — learn how to complete your prior declarations of personal data processing with the CNDP.
MOROCCAN STARTUPS — LEARN HOW TO COMPLETE YOUR PRIOR DECLARATIONS OF PERSONAL DATA PROCESSING!
Declaring your personal data processing activities to the CNDP is mandatory if your startup processes personal data. What is personal data processing? Which form should you complete? This article aims to help you understand this regulatory framework clearly and simply.
WHEN DOES MY STARTUP CARRY OUT PERSONAL DATA PROCESSING?
Startups regularly carry out personal data processing in the course of their activities, in particular when running marketing campaigns, processing payroll, managing invoicing, or developing an e-commerce website.
These processing activities often involve personal data such as: first and last name, national identity card number (CIN), email, photo, phone number, fingerprints, DNA, bank details.
This data — which makes it possible to identify or render identifiable the persons concerned (e.g., employees, customers or suppliers) — must be protected, processed proportionately to the intended purpose, and retained for a limited period not exceeding the time necessary to fulfil the purpose of the processing.
Further examples of personal data processing purposes:
- personnel management and payroll administration;
- accessing / consulting a contact database containing personal data (e.g., CRM software);
- sending promotional emails;
- shredding documents containing personal data;
- publishing / displaying a person's photo on a website;
- storing IP addresses or MAC addresses;
- video surveillance recording.
Geographical scope: all personal data processing for which the data controllers (e.g., the startup carrying out the processing) or the processing means are located on Moroccan territory must comply with Law 09-08 of February 18, 2009 (Official Bulletin No. 5714 of 05-03-2009).
Need help with your CNDP compliance in Morocco?
CNDP declaration, prior authorization, data transfer, processing register, privacy policy: get support from African Legal Factory.
WHAT MUST I DO WITH RESPECT TO THE CNDP IF I CARRY OUT PERSONAL DATA PROCESSING IN MOROCCO?
All personal data processing must be declared in advance to the CNDP before implementation (excluding processing that falls outside the scope of Law No. 09-08, is exempt from the declaration requirement, or is subject to the prior authorization regime).
Warning 1: if you process sensitive data — meaning data relating in particular to racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or health-related data, genetic data, or data including the national identity card number (CIN) — you must submit an authorization request to the CNDP.
In this case, you are not simply declaring that you intend to process personal data — you must request authorization from the CNDP to carry out that sensitive data processing.
Warning 2: if you transfer data abroad (outside Morocco) — for example, if personal data is hosted or transmitted abroad — you must also submit an international data transfer request to the CNDP.
WHAT IS THE PROCEDURE FOR DECLARING PERSONAL DATA PROCESSING?
Step 1:
You must download the standard declaration form F211 or the simplified standard declaration form (in accordance with a decision) F214 for prior declaration of personal data processing, and return it to the CNDP. The following documents must be attached to this form:
- a document authorizing the signatory to bind the legal entity;
- a copy of the signatory's national identity card;
- any other relevant document, where applicable.
For information on what the declaration must contain: https://www.cndp.ma/fr/service-en-ligne/responsables-de-traitement.html
Step 2:
- The CNDP issues an acknowledgment of the declaration within 24 hours.
- The CNDP notifies the declaring startup within 8 days of its decision to subject the processing to the prior authorization regime, if it considers that the intended processing poses manifest risks to the protection of privacy and the fundamental rights and freedoms of the data subjects concerned.
Please note: where the file is incomplete, these time limits only begin to run from the moment the information or documents requested by the CNDP have been provided.
WHY IS IT ESSENTIAL TO COMPLY WITH THE REGULATIONS?
Why must you absolutely comply with Law 09-08?
To avoid the financial penalties provided for under Law 09-08 and criminal sanctions!
But that is not all: complying with the requirements of Law 09-08 allows you to stand out from your competitors. In doing so, you gain an extremely positive competitive advantage in terms of reputation and brand image for your company. This demonstrates, in particular, exemplary management of personal data processed on behalf of your clients, as well as adherence to security and confidentiality measures.
References
- Dahir No. 1-09-15 of 22 Safar 1430 (February 18, 2009) promulgating Law No. 09-08 on the protection of natural persons with regard to the processing of personal data.
- Decree 2-09-165 of May 21, 2009 implementing Law No. 09-08 on the protection of natural persons with regard to the processing of personal data.
I would like support with my personal data protection compliance
Fill in the form to be contacted by the African Legal Factory team regarding your CNDP declarations, prior authorizations or personal data transfers.
By completing this contact form, African Legal Factory collects and processes your personal data as data controller in order to respond to your enquiries. You have the right to access, rectify, object to, erase, restrict, port your data, and to provide instructions regarding its handling after your death.
For more information on the processing of your personal data, please consult our Privacy Policy.
