Law No. 09-08, rights of the data subject

Loi n° 09-08, arts. 5-11 (droits de la personne concernée)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before or when you collect personal data directly from the data subject, tell them, expressly, precisely, and unambiguously, your identity, the purposes of the processing, and, where fair processing requires it, the recipients, whether their response is mandatory, and their access and rectification rights.
Where you did not collect the data from the data subject, give them that same information no later than the first disclosure to a third party, unless they already have it.
On request, confirm to a data subject, at reasonable intervals, without delay and free of charge, whether you are processing their personal data, and tell them the purposes, the categories of data, the recipients, and, where available, the data's origin.
On a data subject's request, update, rectify, erase, or block personal data whose processing does not comply with the law, free of charge, within ten clear days, and notify anyone the data was disclosed to of the correction.
Honor a data subject's objection to processing on legitimate grounds, and their objection, free of charge, to having their data used for marketing by you or by any later processor.
Do not send direct marketing by automated call, fax, or electronic mail to anyone who has not given prior consent, and, for the narrow email exception the law allows to existing customers, always let the recipient opt out, free of charge, of further messages.
Do not base a court decision, or any other decision producing legal effects on a person, solely on automated processing meant to profile them or evaluate an aspect of their personality.

What it reaches

Obligation class

Data subject rights, Disclosure, Access restriction

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 5 requires a controller collecting data directly from a data subject to tell them, expressly, precisely and unambiguously, the controller's identity, the purposes of the processing and, where fair processing requires it, the recipients, whether a response is mandatory and the consequences of not responding, the existence of access and rectification rights, and the receipt or authorization the processing rests on; where the data were not collected from the data subject, Article 5(3) requires that information no later than the first disclosure to a third party.

Article 6 exempts national-defense and internal or external state-security processing, cases where informing the data subject proves impossible for statistical, historical or scientific processing, processing a law expressly directs to be recorded or disclosed, and processing for exclusively journalistic, artistic or literary purposes.

Article 7 gives the data subject the right to obtain, at reasonable intervals, without delay and free of charge, confirmation of processing, the data in intelligible form, and the logic underlying an automated treatment of them, letting the controller ask the CNDP for more time or oppose manifestly abusive requests.

Article 8 gives a right to correct, update, erase or block noncompliant data within ten clear days, free of charge, and to have the correction passed on to any third party the data were disclosed to, escalating to the CNDP on refusal or non-response. Article 9 gives a right to object on legitimate grounds, and an unconditional and free right to object to use of the data for prospecting, including commercial prospecting.

Article 10 bars direct marketing by automated call, fax or electronic mail to a person who has not given prior consent, with a narrow exception for email marketing of similar products to a controller's own existing customers, conditioned on an easy, free opt-out being offered at collection and with every message.

Article 11 bars a judicial decision, and any other decision producing legal effects on a person, from resting solely on automated processing meant to define their profile or evaluate an aspect of their personality, except a decision taken in forming or performing a contract where the person could comment, or one that grants the person's own request.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

Text of Law No. 09-08 (French, consolidated)
reproduced by the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) and mirrored by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived December 25, 2023. Publisher's page: https://www.cndp.ma/wp-content/uploads/2023/11/Loi-09-08-Fr.pdf

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app