Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data
Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel promulguée par le Dahir n° 1-09-15 du 22 safar 1430 (18 février 2009)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A comprehensive regime rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Obtain the data subject's unambiguous consent before processing their personal data, unless a legal obligation, contract performance, vital interest, public-interest mission, or legitimate-interest ground applies.
- File a prior declaration with the CNDP before processing personal data, or obtain the CNDP's prior authorization where the processing involves sensitive data, health data, or another category the law subjects to authorization.
- Do not process sensitive data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data including genetic data) without the data subject's express consent or another statutory ground.
- Give the data subject access to, and let them rectify or object to the processing of, their personal data on request, and do not base a decision producing legal effects on them solely on automated profiling.
- Do not send unsolicited direct-marketing communications by automated call, fax, or electronic mail without the recipient's prior consent.
- Do not transfer personal data to a foreign country unless that country ensures a sufficient level of protection as determined by the CNDP, or another statutory exception applies.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Processing sensitive data without the data subject's express consent draws imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams (Article 57), the statute's highest tier; fraudulent or unlawful collection and an unlawful cross-border transfer each draw imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams (Articles 54 and 60); an undeclared or unauthorized processing draws a fine only, of 10,000 to 100,000 dirhams, with no imprisonment (Article 52).
Penalty structure
Graduated by offence: an undeclared or unauthorized processing (Art. 52) draws a fine of 10,000 to 100,000 dirhams only; refusing an access, rectification, or objection request (Art. 53) draws a fine of 20,000 to 200,000 dirhams per infraction; fraudulent or unlawful collection (Art. 54), retention beyond the declared duration (Art. 55), and an unlawful cross-border transfer (Art. 60) each draw imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams; processing sensitive data without express consent (Art. 57) draws imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the highest tier; obstructing CNDP control (Art. 62) draws imprisonment of three to six months and a fine of 10,000 to 50,000 dirhams; and refusing to comply with a CNDP decision (Art. 63) draws imprisonment of three months to one year and a fine of 10,000 to 100,000 dirhams. Article 64 doubles the fine for a legal person, and Article 65 doubles all sanctions on recidivism.
- Rule
- Fixed only
- As of
- 7 September 2026
- Minimum
- 10,000
- Currency
- MAD
- Fixed cap
- 300,000
Who enforces it
Enforcement body
Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)
What it reaches
Obligation class
Consent, Disclosure, Data subject rights, Transfer, Licensing
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 2 applies the law to automated and manual processing of personal data by a physical or legal person, public or private, whose controller is established in Morocco or who uses processing means located there. Article 4 requires the data subject's unambiguous consent before processing, unless the processing falls under Article 4's enumerated exceptions (a legal obligation, contract performance, vital interest, a public-interest mission, or the controller's legitimate interest).
Article 12 requires most processing to be the subject of a prior declaration to the CNDP, and requires CNDP prior authorization for sensitive data (Article 1(3): racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or health data including genetic data), which is otherwise prohibited absent the data subject's express consent or another Article 21 ground.
Articles 7 to 9 give the data subject the right to access, rectify, and object to the processing of their data, and a provision preceding Article 7 bars a decision producing legal effects on a person from being based solely on automated processing intended to profile or evaluate an aspect of their personality. Article 10 bars direct marketing by automated call, fax, or electronic mail to a person who has not given prior consent.
Article 43 bars transferring personal data to a foreign state unless that state ensures a sufficient level of protection, as assessed by the CNDP, which maintains a list of adequate states. The CNDP, established by Article 27, supervises compliance, receives declarations and complaints, and issues authorizations.
Breach of these duties is backed by a graduated schedule of fines and, for several offences, imprisonment: an unauthorized or undeclared processing draws a fine of 10,000 to 100,000 dirhams (Article 52); refusing an access, rectification, or objection request draws a fine of 20,000 to 200,000 dirhams per infraction (Article 53); fraudulent or unlawful collection, or processing beyond the declared purpose, draws imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams (Article 54); an unlawful cross-border transfer draws the same imprisonment and fine range (Article 60); and processing sensitive data without the data subject's express consent draws imprisonment of three months to one year and a fine of 50,000 to 300,000 dirhams, the highest tier in the statute (Article 57).
When LexLint raises it
crawls_webtrains_modelsautomated_outreachhigh_risk_decisions
Read the law
Text of Law No. 09-08 (French, consolidated)
reproduced by the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI) and mirrored by the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)