Law No. 09-08, transfer of data to a foreign country

Loi n° 09-08, arts. 43-44 (transfert de données vers un pays étranger)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not transfer personal data to a foreign country unless that country appears on the CNDP's list of states that ensure a sufficient level of protection.
Where the destination country is not on that list, transfer personal data only with the data subject's express consent, under one of the Article 44 necessity grounds, under a bilateral or multilateral agreement Morocco is party to, or with the CNDP's own express and reasoned authorization.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 43 bars a controller from transferring personal data to a foreign state unless that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms with regard to the processing, judged by the state's rules, its security measures, and the processing's purpose, duration, origin and destination, and the CNDP maintains the list of states meeting that standard.

Article 44 lets a controller transfer to a state that does not meet it where the data subject has expressly consented, or without that consent where the transfer is necessary to save the person's life, to preserve the public interest, to establish, exercise or defend a legal claim, to perform a contract with the data subject or precontractual measures at their request, to perform a contract concluded in the data subject's interest between the controller and a third party, to carry out international judicial assistance, or to prevent, diagnose or treat a medical condition; it also permits a transfer under a bilateral or multilateral agreement Morocco is party to, or on the CNDP's own express and reasoned authorization where contractual clauses or internal rules ensure a sufficient level of protection.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics

Read the law

Text of Law No. 09-08 (French, consolidated)
reproduced by the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) and mirrored by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived December 25, 2023. Publisher's page: https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app