CNDP and websites in Morocco: what are the obligations for personal data in 2026?

The CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel) is the independent Moroccan authority responsible for:

✅ Receiving declarations and issuing processing authorizations ✅ Monitoring the compliance of data controllers, on site and on the basis of documents ✅ Investigating complaints from data subjects ✅ Recording offences and referring matters to the public prosecutor ✅ Advising businesses and publishing recommendations and simplified procedures

Legal basis: Law No. 09-08 promulgated by Dahir No. 1-09-15 of 18 February 2009, and implementing Decree No. 2-09-165 of 21 May 2009. A reform intended to bring this framework closer to the European GDPR is being prepared, but Law 09-08 remains the applicable text in 2026.

Official website: www.cndp.ma (notification forms, decisions and recommendations)

Any information relating to an identified or identifiable natural person:

✅ Identity: surname, first name, photo, signature, date of birth ✅ Contact details: email, telephone, postal address ✅ Identifiers: CIN (national identity card) number, customer number, cookie identifier ✅ Technical data: IP address, geolocation, device identifier ✅ Sensitive data: racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, genetic data ✅ Banking data: RIB (bank account details), card number (even partial) ✅ Browsing data: history, online behaviour

Example: a list of customer emails constitutes a personal data file subject to Law 09-08.

❌ Anonymized data: impossible to identify the person, even indirectly (e.g. "25% of visitors…") ❌ Data relating to a legal entity: company name, ICE, registered office address ❌ Technical data that cannot be linked to a person (aggregated browser type, overall statistics)

If you collect personal data, each processing operation must be the subject of a prior declaration to the CNDP. A prior authorization is required for the processing of sensitive data, data relating to offences, interconnections of files and changes of purpose. Transfers of data abroad (hosting, CRM or emailing tools located outside Morocco) must be submitted to the CNDP: they are permitted to the countries on its list of States ensuring adequate protection (deliberation No. 465-2013, amended in 2015) and require prior authorization to other countries, subject to the exceptions provided for by law, such as the express consent of the person.

Cases concerned:

• ✅ Newsletter (customer emails)
• ✅ Contact forms (name, email, telephone)
• ✅ Customer area (account with profile)
• ✅ Audience measurement and advertising cookies
• ✅ Job application forms
• ✅ Blog comments, online chat

Cases not concerned:

• ❌ Purely informational website, with no form or data collection
• ❌ Website using only cookies strictly necessary for its operation

Declaration procedure:

1. Preparing the file: description of the processing (purpose, data collected, categories of persons, recipients, retention period), security measures, place where the data are hosted
2. Filing with the CNDP: official notification form, filed online via the CNDP-FORMS platform (www.cndp.ma) or at the Commission's headquarters; fees: free of charge. Simplified procedures exist for common processing operations (personnel management, newsletters, access control) and for cookies
3. Review: the CNDP issues a declaration receipt (récépissé); for an authorization, it rules within the time limit provided for by law, in principle two months
4. Receipt or authorization: its number must appear on your forms and in your privacy policy

CNDP notification template:

NOTIFICATION OF PROCESSING (PRIOR DECLARATION)

Data controller: [Company name, legal form, RC, ICE]
Address: [Registered office]
Representative: [Name of the manager or of the designated officer]
Contact: [Email / telephone]

PROCESSING:
Purpose: management of the customer newsletter
Data collected: email, surname, first name
Categories of persons: customers and prospects
Retention period: 3 years after the last contact
Recipients: internal marketing team, emailing service provider
Data hosting: [Morocco / foreign country: transfer declared to the CNDP, or authorized if the country is not on its list]

SECURITY MEASURES:
- Website in HTTPS, encrypted database
- Access limited to authorized persons, strong passwords
- Regular backups
- Privacy policy published

Attachment: website privacy policy

💡 Tip: declare even a simple processing operation. The formality is free of charge and the declaration is the first document requested during an inspection.

Mandatory on any website that collects data, it gives effect to the right to information provided for by Law 09-08.

Minimum content:

Simplified privacy policy template:

PRIVACY POLICY
[Website name]

1. DATA CONTROLLER
[Company name], [registered office], RC No. [..], ICE No. [..]
Contact: [email]

2. DATA COLLECTED
- Email, surname and first name (contact and newsletter forms)
- IP address and browsing data (server logs, cookies)
- Order and delivery data (online shop)

3. PURPOSES AND LEGAL BASIS
- Responding to your requests (performance of the pre-contractual relationship)
- Sending the newsletter (consent)
- Audience measurement and website improvement (consent for non-essential cookies)

4. RETENTION PERIODS
- Contacts: 1 year after the request
- Newsletter subscribers: 3 years after the last contact
- Order data: term of the contract, then statutory accounting retention periods (10 years)

5. YOUR RIGHTS
In accordance with Law 09-08, you have a right of access, rectification
and objection, in particular to direct marketing.
To exercise them: [email]. You may also refer the matter to the CNDP (www.cndp.ma).

6. SECURITY
Website in HTTPS, restricted access, regular backups.

7. COOKIES
Session cookies (necessary); audience measurement and advertising cookies
(subject to your consent, which can be changed at any time).

8. TRANSFERS AND FORMALITIES
This processing has been declared to the CNDP under No. [..]. Data hosted
outside Morocco are covered, where applicable, by transfer authorization No. [..].

Last updated: [Date]

Where to place it:

• ✅ Link in the footer of every page of the website
• ✅ Dedicated page (/privacy-policy)
• ✅ Link on each form, before submission
• ✅ Readable and accessible text (illegible wording is equivalent to a failure to inform)

For any data collection, the user must be informed and, where the processing is based on their consent, must express it by a positive act. Direct marketing by email or SMS is prohibited without prior consent (Law 09-08).

Types of consent:

Implementation:

✅ Newsletter form

☐ I agree to receive the newsletter from [Name] (consent)
 The information collected is intended for [Name] for sending the newsletter.
 Processing declared to the CNDP under No. [..]. Rights of access, rectification
 and objection: [email]. [Read the privacy policy]
 [Subscribe]

✅ Cookie banner

This website uses audience measurement and advertising cookies.
[Accept all] [Refuse non-essential cookies] [Customize]

❌ To avoid:

By visiting this website, you accept our cookies and our policy… (no real consent)
Pre-ticked box "Receive our partners' offers" (consent not freely given)

Proof of consent:

• Keep logs: who consented, when, by what means
• Subscription confirmation email (double opt-in recommended)
• Logging of cookie choices, including refusals

The operator of a commercial website must make itself identifiable, in accordance with Law 31-08 (consumer information in distance contracts) and the Commercial Code (mention of the Commercial Register number on commercial documents). The template below also includes the Common Company Identifier (ICE) and the tax identification number:

LEGAL NOTICE

Website publisher: [Company name], [legal form], capital [..] MAD
Registered office: [Address]
RC: [Number and city]  |  ICE: [Number]  |  IF: [Number]
Publication director: [Name]
Contact: [Email / telephone]

Host: [Name and address of the host]

Intellectual property: the content (texts, images, logos) is protected;
any reproduction without authorization is prohibited.

Personal data: see the privacy policy (CNDP declaration No. [..]).

Law 09-08 requires the data controller to take the appropriate technical and organizational measures to protect the data.

Technical:

✅ HTTPS encryption: valid SSL certificate across the whole website, forms included ✅ Authentication: strong passwords, two-factor authentication for administrative access ✅ Encryption and segregation: sensitive data encrypted, separate administration interface ✅ Backups: regular copies, stored securely ✅ Updates: CMS, plugins and servers kept up to date

Organizational:

✅ Internal policy: written procedures, staff awareness, access limited to authorized persons ✅ Contracts with service providers: host, web agency, emailing solution, payment gateway, with confidentiality and security clauses; CNDP authorization for service providers located in a country not on the CNDP list ✅ Incident management: procedure in the event of a data breach; Law 09-08 does not impose a formal notification, but informing the CNDP and the data subjects is strongly recommended

Law 09-08 does not impose specific figures for retention periods: the period is set by the data controller in its declaration and must be proportionate to the purpose. Commonly accepted reference periods:

The retention period for invoices and accounting documents falls under the accounting obligations of companies in Morocco.

Deletion procedure:

• Automatic purge when the period expires: the data are deleted or anonymized
• Deletion at the person's request, unless there is a legal obligation to retain the data (for example invoices for 10 years), with written confirmation to the requester
• Documented and verifiable procedure

Every data subject has the following rights:

1. Right to information: to know, at the time of collection, the identity of the controller, the purposes, the recipients and their rights
2. Right of access: to obtain confirmation that their data are being processed and to receive an intelligible copy of them
3. Right of rectification: to have inaccurate, incomplete or unlawfully processed data corrected, completed, updated or erased
4. Right to object: to object, on legitimate grounds, to the processing of their data and, without having to give grounds, to their use for direct marketing purposes
5. Protection against automated decisions: not to be subject to a decision producing legal effects based solely on automated processing

Law 09-08 does not provide for a right to data portability; it is nevertheless good practice to provide the data in a readable format.

Recommended procedure:

1. Receipt: single point of contact (dedicated email address) indicated in the privacy policy
2. Verification of the identity of the requester before any disclosure
3. Processing: disclosure of the data, rectification or cessation of processing, without undue delay; a period of one month at most is a prudent benchmark
4. Documentation: keeping the request and the response to demonstrate compliance in the event of an inspection

The CNDP can inspect any data controller established in Morocco, whatever its size:

✅ E-commerce (customer and delivery data) ✅ SaaS and applications (user data) ✅ Blogs and media (comments, newsletters) ✅ Online services (bookings, appointment scheduling) ✅ Physical shops with a CRM or a loyalty programme

Criminal penalties provided for by Law 09-08 (chapter on penalties, Articles 52 et seq.):

For legal entities, fines are doubled, without prejudice to the penalties incurred by their managers; they are also doubled in the event of a repeat offence. The court may also order the confiscation of equipment and the closure of the establishment. In practice, the CNDP first sends a formal notice before referring the matter to the public prosecutor. The other penalties for business non-compliance (tax, social, commercial) are presented in a dedicated guide.

💡 Tip: voluntary compliance always costs less than an inspection you have to undergo.

If the CNDP contacts you:

1. Notification: the CNDP informs the data controller of a documentary or on-site inspection, or summons it to a hearing
2. Preparation: gather the declaration receipts, the authorizations, the privacy policy, the consent records and the security documentation
3. Inspection: sworn officers examine the processing operations, the systems and the contracts with service providers
4. Report and formal notice: any discrepancies found are given a deadline for regularization
5. Follow-up: follow-up inspection; in the absence of regularization, referral to the public prosecutor and criminal penalties