Morocco
North Africa
Morocco regulates personal data through Law No. 09-08 on the protection of individuals with regard to the processing of personal data, promulgated by Dahir No. 1-09-15 of 18 February 2009, Morocco's first comprehensive data protection statute and one of the earliest in North Africa. After a two-year transition while the regulator stood up, full enforcement began on 16 March 2011. The law applies to processing by controllers established in Morocco or using means located there, public and private, excluding purely private processing. Controllers must observe the core data-quality principles and generally rely on prior consent, with derogations for legal obligation, contract, vital interests, public-interest tasks, and legitimate interests. Sensitive data (racial or ethnic origin, political opinions, religious belief, health, sexual life) is prohibited in principle, with limited exceptions including express consent and regulator authorisation. Processing requires a prior declaration to the regulator, and prior authorisation for sensitive data, cross-border transfers, and high-risk operations. Data subjects have rights of prior information, access, rectification, and objection, with an absolute right to object to direct marketing. Cross-border transfers are permitted only to adequate countries or with authorisation. Enforcement rests with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP), an independent authority that receives declarations and authorisations, issues opinions, investigates and inspects, imposes sanctions, and authorises transfers. Notably, since 2025 the CNDP has intensified enforcement through targeted sectoral campaigns, marking a shift from awareness-raising to active compliance action. Having legislated in 2009 with a continuously operating regulator now moving into active enforcement, Morocco runs one of the more established regimes in its region.
| Topic | Instruments | Cases | Coverage |
|---|---|---|---|
| Data Protection | 1 | 0 | ◐ |
| AI Governance | 2 | 0 | ◐ |
| Fintech | 4 | 0 | ◐ |
| Cybercrime | 1 | 0 | ◐ |
| Digital Rights | 2 | 0 | ◐ |
| Platform Liability | 0 | 0 | ○ |
| Telecoms | 0 | 0 | ○ |
● Covered ◐ Partially covered ○ Not yet covered
Constitution of the Kingdom of Morocco, 2011, Articles 24, 25 and 27 (Privacy of communications, freedom of expression and right to information)
Enacted 29 Jul 2011
Loi n° 88-13 relative à la presse et à l'édition (Law No. 88-13 on the Press and Publishing) (Morocco)
Enacted 10 Aug 2016
Loi n° 07-03 complétant le code pénal en ce qui concerne les infractions relatives aux systèmes de traitement automatisé des données (Law No. 07-03 supplementing the Penal Code regarding offences relating to automated data processing systems)
Enacted 11 Nov 2003
Cadre réglementaire du paiement mobile domestique de Bank Al-Maghrib (2018), décision réglementaire et lettre circulaire (Bank Al-Maghrib Domestic Mobile Payment Regulatory Framework (2018), regulatory decision and circular letter)
Enacted 1 Nov 2018
Guide de Bank Al-Maghrib sur le parcours réglementaire des porteurs de projets fintech (2025) (Bank Al-Maghrib Guide on the Regulatory Pathway for Fintech Project Holders (2025))
Enacted 1 Dec 2025
Circulaire du Wali de Bank Al-Maghrib n° 5/W/15 du 20 mai 2015 relative aux documents et renseignements nécessaires à l'instruction des demandes d'agrément des établissements de paiement (Circular No. 5/W/15 of 20 May 2015 on the documents and information required to process payment institution licensing applications)
Enacted 20 May 2015
Loi n° 103-12 relative aux établissements de crédit et organismes assimilés, régime des établissements de paiement (Law No. 103-12 on Credit Institutions and Similar Bodies, Payment Institutions regime)
Enacted 24 Dec 2014
Maroc IA 2030, National Artificial Intelligence Roadmap ("AI Made in Morocco")
Enacted 12 Jan 2026
Proposition de loi portant création de l'Agence Nationale de l'Intelligence Artificielle (Draft Law establishing the National Agency for Artificial Intelligence) (Morocco)
Enacted 17 Apr 2024
Loi n° 09-08 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel (Law No. 09-08 on the Protection of Individuals with regard to the Processing of Personal Data)
Enacted 18 Feb 2009
The 2009 law predates the GDPR generation and lacks, on its face, a fixed statutory breach-notification deadline, a general DPO mandate, and portability and modern erasure rights. ATLPF holds the primary law but no separate implementing decrees.