Page 1

Page 2

PREAMBLE

This document is intended to be a practical tool at the service of
people, businesses and organizations that operate
a website using personal data. The
recommendations set out in this text - which is not
comprehensive - are developed from the provisions of the
law 09-08 relating to the protection of natural persons
with regard to the processing of personal data and
its application texts.

Page 3

1

Affected websites

This guide is intended for natural and legal persons who operate
websites using personal data (for example: surname, first name,
address, email, telephone number, CNI number, bank card number, photo, video
deo…).

2

2

Obligation to notify the processing to the CNDP

Any website manager who collects and processes personal data
ORMITY OF WEBSITES

is required by Law 09-08 to notify the CNDP of the processing operations implemented
on said site.
CNDP - CONF

3

Method of notification

Before implementing personal data processing on site
web, it should be notified to the CNDP by means of:
a request for authorization if the data processed relate to the

Page 4

number of the national identity card or on data
sensitive (racial or ethnic origins, political opinions,
religious or philosophical beliefs, trade union membership,
genetic or health-related data); or
a prior declaration in other cases;
a request for transfer abroad in the event of accommodation and
storage of personal data on servers located abroad.

NB
The formalities and forms for prior declaration, request
authorization and transfer request are available on the website
CNDP web ( www.cndp.ma ).
The CNDP only examines a request for a transfer abroad after
have authorized the basic processing (obtaining by the person responsible for
processing of the declaration receipt or authorization).

4

3
data collection
CNDP - CONF

When collecting personal data on a website (using
for example of a form) on the occasion of a registration, an opening
account, an online purchase, a reservation, or any other transaction, it is

ORMITY OF WEBSITES

imperative of:
inform internet users of the characteristics of the processing: identity
of the data controller who operates the site, the purposes of the
ment, the recipients of the data, the mandatory or optional nature
answers to questions, the existence of a right of access, rectification
and - for legitimate reasons - a right of opposition, the service with
from which these rights are exercised, the receipt number of the declaration
or the authorization issued by the CNDP;
request the consent of Internet users to the processing of their data
personal births.

Page 5

Notes:
The acceptance box must not be pre-checked in order to allow
the Internet user to read and take cognizance of the relative legal notices
to the processing of his personal data by the site.
"The general conditions of use" (or any equivalent link: menlegal notices, charter of use, general conditions of sale, etc.) must
contain a notice relating to the protection of personal data.

4

ORMITY OF WEBSITES

Sample data collection form
personal

CNDP - CONF

Page 6

5

Standard clause and reference on data protection
personal

5.1- Standard clause (to be provided for in the “general conditions” section,
"Legal notices" or equivalent)

………. (Indicate the identity of the controller who uses
the site)
The information collected on the www ……… site is subject to a
processing intended for ………. (specify the purpose)
The recipients of the data are: ……… .. (specify)
In accordance with the law n ° 09-08 promulgated by the Dahir 1-09-15
of February 18, 2009, relating to the protection of individuals
with regard to the processing of personal data, you
have the right to access and rectify information

5

which concern you, which you can exercise by contacting
to: ……… (specify an address, an email or a service…).

CNDP - CONF

You can also, for legitimate reasons, oppose
that the data concerning you are processed ORMITY OF WEBSITES

is lying.
This processing has been notified and authorized by the CNDP in accordance with the
pissed / of authorization n ° ……… of… /… /….

5.2- Standard mention (to be included in the data collection form
for example)
In accordance with law 09-08, you have the right to access, rectify
and opposition to the processing of your personal data. This treatment has
been authorized by the CNDP under the number….

Page 7

6

Proportionality of the data collected

In accordance with the principle of proportionality, it is not necessary to collect and process
that the data strictly necessary for the achievement of the purposes of the
fully pursued by the website manager.

7

Security and confidentiality measures

Measures must be implemented to ensure confidentiality and
the security of the personal data recorded to prevent them from being
destroyed, distorted, damaged or accessible to unauthorized third parties,
in particular by making employees aware of their obligations and by
the restriction of access according to the attributions and responsibilities of
each employee, the use of secure IT systems and
possibly the use of encryption of certain data during their

6

storage and / or transmission.
When the website manager calls on a subcontractor to process
personal data, he is required to choose a subcontractor who provides
sufficient guarantees with regard to technical security measures
and organizational. On the other hand, carrying out sub-processing
contracting must be governed by a contract or legal act that binds the subcontractor
dealing with the website manager.

ORMITY OF WEBSITES

CNDP - CONF

Page 8

8

Data retention period

When a site is called upon to process personal data, it must not
be kept only as long as necessary to achieve the purpose of the transaction.
definitely.

7

9

Direct prospecting
CNDP - CONF

Personal data processed by a website cannot be used
for the purpose of direct prospecting for a product or service, unless
the Internet user:
expresses their prior consent at the time of collection; or
has previously benefited from a similar product or service
provided by the same site manager.
In all cases, an Internet user has the right to oppose, free of charge, that he
prospecting messages are sent. For this purpose, the person in charge of
processing must provide - on the occasion of any prospecting message
- a telephone number, an email address or any other means allowing
to unsubscribe from the list of prospects

Page 9

10

Cookies

A website that uses cookies calling on personal data
nelles must obtain the consent of the Internet user before submitting these
Cookies. Likewise, it must specify the purpose of the use of cookies and
explain to the Internet user the means to oppose it.

8

ORMITY OF WEBSITES

CNDP - CONF

Page 10

Annakhil Boulevard, Building Les Patios, 3 rd floor Hay Riad - Rabat - Morocco
Tel: (212) 537 57 11 24 / (212) 537 71 70 73 Fax: (212) 537 57 21 41
Email: contact@cndp.ma

ORMITY OF WEBSITES

