Law No. 09-08, sensitive personal data and offense records

Loi n° 09-08, arts. 12(1), 21-22, 24, 49-50 (données sensibles et catégories protégées)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process sensitive data, meaning data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data including genetic data, without a specific legal authorization, the CNDP's prior authorization, or the data subject's express consent.
Where you process health data solely for preventive medicine, medical diagnosis, care, or health service management under a practitioner's or an equally bound person's professional secrecy, file a declaration with the CNDP rather than seeking its prior authorization.
Where you process sensitive or health data, put in place the heightened technical measures Article 24 lists: control who can enter the processing facility, who can read, copy, modify, or remove the data media, and who can access, transmit, or input the data, and keep a record of what sensitive data was input, when, and by whom.
Do not process personal data about offenses, criminal convictions, or security measures unless you are a court, a public authority, a public service body, or an auxiliary of justice acting within your legal duties.

What it reaches

Obligation class

Prohibition, Consent, Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 12(1) makes prior CNDP authorization, rather than a mere declaration, the default for processing sensitive data, for using data outside the purpose it was collected for, for genetic data outside medical care, for data on offenses, convictions or security measures, for a national identity card number, and for interconnecting files serving different public or private purposes.

Article 21 conditions that authorization on the data subject's express consent, a legal or statutory duty of the controller, or the Commission's own finding that the processing protects a vital interest, concerns data the data subject has manifestly made public, or is necessary to a legal claim.

Article 22 lets a controller declare rather than seek authorization for health data processed solely for preventive medicine, diagnosis, care or health-service management by a practitioner or another person equally bound by professional secrecy, or to select beneficiaries of a right, benefit or contract they are not otherwise excluded from.

Article 24 requires a controller of sensitive or health data to additionally control entry to the processing facility, control who can read, copy, modify or remove the data media, control unauthorized input, use, access and transmission, and be able to show after the fact what data was input, when and by whom.

Articles 49-50 restrict processing personal data on offenses, convictions or security measures to courts, public authorities and legally competent public bodies, and to auxiliaries of justice acting within the strict needs of their legal mission. The law's sensitive-data definition (Article 1(3)) does not include a biometric, voiceprint or faceprint identifier.

When LexLint raises it

crawls_web
trains_models
handles_health_records

Read the law

Text of Law No. 09-08 (French, consolidated)
reproduced by the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) and mirrored by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived December 25, 2023. Publisher's page: https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app