What Is Law 09-08 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel?
Morocco’s general privacy statute is Law 09-08, relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel. It was promulgated by Dahir No. 1-09-15 on 18 February 2009 and published in the French Bulletin Officiel No. 5714 on 5 March 2009. Decree No. 2-09-165 of 21 May 2009 is the implementing instrument. No official promulgated amending or repealing instrument was located, and no official consolidated version was identified. The SGG current consolidated-text index does not list Law 09-08, while current CNDP navigation continues to identify Law 09-08 and Decree No. 2-09-165 as the operative regime. CNDP materials discuss a proposed reform, but no official promulgating instrument replacing Law 09-08 was located. The CNDP, established by Article 27, receives and investigates complaints and can order correction, blocking, erasure, destruction, or temporary or permanent prohibition of processing. No Morocco-specific data-broker, broker opt-out, or dedicated public-record deletion route was located.
At a glance
- Full name
- Law 09-08 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel
- Short code
- Law 09-08
- Jurisdiction
- Morocco
- Enacted
- 2009
- Last major update
- No official promulgated amending or repealing instrument was located; CNDP materials discuss a proposed refonte, but no official instrument replacing Law 09-08 was located
- Regulator
- Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP)
- Private right of action
- Limited
- Statutory citation
- Law 09-08, promulgated by Dahir No. 1-09-15 on 18 February 2009
Scope, who Law 09-08 covers
Protected data
Data subject rights
Right to prior, express, and clear information at collection
Right to access processing confirmation, purposes, categories, recipients, intelligible data, source information, and automated-processing logic
Right to rectification, erasure, or blocking for non-compliant, incomplete, or inaccurate data
Right to free rectification completed within 10 clear days
Right to object for legitimate reasons
Free right to object to prospecting, including commercial prospecting
Protection against automated-call, fax, or email prospecting without prior consent, subject to the limited existing-customer email exception
Protection against specified solely automated decisions with legal effect
Right to complain to the CNDP after non-compliance by the data-holding organization
No separate portability right was located
No general processing-restriction right was located
Notable features
Morocco’s framework remains tied to a 2009 statute and its 2009 implementing decree, while no official consolidated or replacement text was located. The CNDP has substantial complaint, investigation, corrective-order, and transfer-authorization functions. The statute provides a concrete 10-clear-day rectification period, but no fixed statutory deadline for CNDP complaint resolution was located; a published 15-day controller-response period is an administrative procedure detail rather than a statutory CNDP-resolution deadline.
Enforcement & penalties
Regulator: Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP)
Penalties: Unauthorized or undeclared processing, or continuing after withdrawal, may attract DH 10,000-100,000 under Article 52. Refusing access, rectification, or objection rights may attract DH 20,000-200,000 per offense under Article 53. Articles 54-56 and 58-61 cover unlawful collection, incompatible purposes, excessive retention, unlawful processing, inadequate security, unlawful objection handling, unlawful transfers, and abusive disclosure, with 3 months-1 year imprisonment and DH 20,000-200,000, or either alone. Unlawful sensitive, health, criminal-offence, or conviction data processing may attract 3 months-1 year imprisonment and DH 50,000-300,000, or either alone. Obstructing CNDP controls or refusing documents may attract 3-6 months’ imprisonment and DH 10,000-50,000, or either alone. Corporate fines are doubled, with possible confiscation or closure; recidivism doubles sanctions.
Private right of action: CNDP complaint channels and CNDP corrective, blocking, erasure, destruction, and processing-prohibition powers, including referral to the King’s Prosecutor, are the identified mechanisms; no separate standalone private right-of-action route was identified in the reviewed Law 09-08 materials.
Relevance to data brokers
No Morocco-specific "data broker," broker opt-out, or dedicated public-record deletion route was located. Article 18 addresses legally authorized public-information registers as declaration exemptions, while Articles 45-47 establish the CNDP national register and preserve public-register controller identification so people can exercise rights. Article 30 gives the CNDP general correction, blocking, erasure, and destruction authority. Current CNDP guidance provides online, email, and physical complaint channels, but none of these constitute a dedicated data-broker or public-record complaint/deletion mechanism.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is Morocco’s Law 09-08 still the operative privacy regime?+
CNDP’s current materials continue to list Law 09-08 and Decree No. 2-09-165 as the operative regime. No official promulgated amending or repealing instrument, consolidated version, or replacement instrument was located, while a proposed reform remains under discussion.
How quickly must Morocco rectify inaccurate personal data?+
Rectification must be free and completed within 10 clear days under Article 8. If the organization does not comply, the person may escalate the matter to the CNDP.
Does Morocco have a dedicated data-broker deletion route?+
Not located. The reviewed materials identify general CNDP correction, blocking, erasure, destruction, and complaint powers. CNDP currently provides online, email, and physical complaint channels, but no dedicated data-broker, broker opt-out, or public-record deletion mechanism was located.
Official sources & citations
Other international privacy regimes
Law 09-08 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: