Page 1

OFFICIAL BULLETIN N ° 5714 - 7 rabii I 1430 (5-3-2009)
Dahir n ° 1-09-15 of 22 safar 1430 (February 18, 2009) promulgating
Law No. 09-08 relating to the protection of individuals with regard to
processing of personal data
PRAISE TO GOD ALONE!
(Great Seal of His Majesty Mohamed VI)
Let it be known hereby - may God uplift and strengthen the tenor!
May Our Cherifian Majesty,
Having regard to the Constitution, in particular its Articles 26 and 58,
HAS DECIDED AS FOLLOWS:
Is promulgated and will be published in the Official Bulletin, following this
dahir, Law No. 09-08 relating to the protection of individuals with regard to
processing of personal data, as adopted by the Chamber of
representatives and the House of Councilors.
Done in Fez, on 22 safar 1430 (February 18, 2009).
For countersignature:
The Prime Minister,
Abbas El Fassi

-1-

Page 2

Law No. 09-08 relating to the protection of individuals with regard to
processing of personal data

First chapter
GENERAL PROVISIONS
Section one. - Definitions and scope
First article
IT is at the service of the citizen and evolves within the framework of cooperation
international. It must not undermine identity, rights and freedoms
collective or individual of Man. It should not be a means of
disclose secrets of the privacy of citizens.
For the purposes of this law, the following terms are understood to mean:
1- "personal data": any information of any kind
regardless of its medium, including sound and image,
concerning an identified or identifiable natural person, hereinafter referred to as
after "person concerned".
A person who can be directly identified is deemed to be identifiable
or indirectly, in particular by reference to an identification number or to
one or more specific elements of his physical identity,
physiological, genetic, psychological, economic, cultural or social;
2- "processing of personal data" ("processing"): any
operation or set of operations carried out or not by means of processes
automated and applied to personal data, such as
the collection, recording, organization, conservation, adaptation or
modification, extraction, consultation, use, communication
by transmission, distribution or any other form of provision, the
reconciliation or interconnection, as well as the locking, erasure or
the destruction ;
3- "sensitive data": personal data which reveals the origin
racial or ethnic, political opinions, religious beliefs or
philosophical or trade union membership of the person concerned or who
relate to his health, including his genetic data;
4- "personal data file" ("file"): all together
structured personal data accessible according to criteria
determined, whether this set is centralized, decentralized or distributed
functional or geographic manner, such as archives, banks
data, census files;
-2-

Page 3

5- "controller": the natural or legal person, the authority
public service or any other body which, alone or jointly
together with others, determines the purposes and means of processing
personal data. When the purposes and means of
treatment are determined by legislative provisions or
regulations, the controller must be indicated in the law
organization and operation or in the legal status of the entity
or legally competent to process personal data
in question ;
6- "subcontractor": the natural or legal person, the public authority, the
service or any other body that processes personal data
staff on behalf of the controller;
7- "third party": the natural or legal person, the public authority, the service or
any other body other than the person concerned, the person responsible for
processing, the processor and the persons who, under the authority
direct from the controller or processor, are authorized to
process data ;
8- "recipient": the natural or legal person, the public authority, the
service or any other body that receives data communication, whether it
it may or may not be a third party. Organizations that are likely to receive
communication of data within the framework of a legal provision is not
considered as recipients, in particular the National Commission for
control of the protection of personal data instituted at
article 27 below and called the National Commission;
9- "consent of the person concerned": any manifestation of
will, free, specific and informed, by which the data subject
accepts that the personal data concerning him / her are subject
treatment;
10- "transfer or communication": any disclosure or information of a
data brought to the attention of a person other than a person
concerned;
11- “data interconnection”: form of processing which consists in establishing
a relationship between the data in a file and the data in a file or
several files kept by another or by other managers, or kept
by the same manager but for a different purpose.

Article 2
1- This law applies to the processing of personal data,
automated in whole or in part, as well as the non-automated processing of
personal data contained or called to appear in files
manuals;
-3-

Page 4

2- This law applies to the processing of personal data
meeting the definition in paragraph 1 above:
a) When carried out by a natural or legal person whose
responsible is established on Moroccan territory. The manager of a
processing which carries out an activity on Moroccan territory in the
part of an installation, whatever its legal form, is
considered established;
b) When the person in charge is not established on Moroccan territory but
uses, for the purposes of processing personal data,
means, automated or not, located on Moroccan territory,
the exclusion of processing operations which are only used for purposes of transit on
the national territory or that of a State whose legislation is
recognized as equivalent to that of Morocco in terms of the protection of
personal data;
3- In the case referred to in paragraph 2 above, the controller must
notify the National Commission of the identity of a representative installed in Morocco
who without prejudice to his personal responsibility, replaces him in all
its rights and obligations resulting from the provisions of this law and the texts
taken for its application;
4- This law does not apply:
- the processing of personal data carried out by a
natural person for the exercise of exclusively personal activities
or domestic;
- personal data collected and processed in the interest of
national defense and internal or external security of the State.
It does not apply to personal data collected and processed
for the purposes of prevention and repression of crimes and misdemeanors only in
conditions set by law or regulation that creates the file in question; this
regulation specifies the controller, the condition of legitimacy
of the processing, the purpose (s) of the processing, the category (s) of
data subjects and the data or categories of data therein
reporting, the origin of this data or third parties or categories of third parties
to whom this data may be communicated and the measures to be
take to ensure the safety of processing. It is subject to the notice
prerequisite of the National Commission;
- personal data collected in application of a
specific legislation. The bills or proposals of law establishing
files relating to the aforementioned data are communicated to the
National Commission, specifying the authority responsible for the file, the
the purposes of the processing, the category or categories of data subjects and
the data or the categories of data relating thereto, the origin of these
-4-

Page 5

data, third parties or categories of third parties to whom this data may
be communicated and the measures to be taken to ensure the safety of the
treatment.

Section 2 . - Data quality and consent
prior notice of the person concerned
Article 3
1- Personal data must be:
a) treated fairly and lawfully;
b) collected for specific, explicit and legitimate purposes, and not
be further processed in a manner incompatible with the purposes;
c) adequate, relevant and not excessive, having regard to the purposes for
which they are collected and for which they are processed
later;
d) accurate and, if necessary, kept up to date. All reasonable steps
must be taken, so that inaccurate or incomplete data,
with regard to the purposes for which they are collected and for which
they are subsequently processed, erased or rectified;
e) kept in a form allowing the identification of persons
concerned for a period not exceeding that necessary for the
fulfillment of the purposes for which they are collected and for
which they are subsequently processed.
2- At the request of the controller and, if there is a legitimate interest, the
National Commission may authorize the retention of data, of a
personal for historical, statistical, or scientific purposes beyond the period,
cited in e) of the previous paragraph;
3- It is the responsibility of the controller to ensure compliance with the provisions of
preceding paragraphs, under the control of the National Commission.

Article 4
The processing of personal data can only be carried out if the
data subject has undoubtedly given their consent to the operation or
all the operations envisaged.
Personal data subject to processing cannot be
communicated to a third party only for the achievement of purposes, directly related to the
functions of the assignor and the assignee and subject to prior consent,
of the person concerned.
However, this consent is not required if the processing is necessary:
-5-

Page 6

a) compliance with a legal obligation to which the person is subject
concerned or the controller;
b) the performance of a contract to which the data subject is a party or
the execution of pre-contractual measures taken at the request of the latter;
c) to protect the vital interests of the data subject, if it is
physically or legally unable to give a
consent;
d) the performance of a mission of public interest or falling within the exercise of
the public authority vested in the controller or the
third party to whom the data is communicated;
e) the realization of the legitimate interest pursued by the person responsible for
treatment or by the recipient, subject to not ignoring
the interest or fundamental rights and freedoms of the data subject.

Chapter II
THE RIGHTS OF THE PERSON CONCERNED
Article 5
Right to information during data collection
1- Anyone directly solicited for the collection of their data
personal information, must be informed in advance in an express, precise and
unequivocal by the controller or his representative, unless it
has already been made aware of the following:
a) the identity of the controller and, where applicable, of his
representative;
b) the purposes of the processing for which the data are intended;
c) any additional information such as:
- the recipients or categories of recipients;
- whether the answer to the questions is compulsory or
optional, as well as the possible consequences of a
reply ;
- the existence of a right of access to personal data
concerning and rectification of these data, insofar as,
taking into account the particular circumstances in which
data is collected, this information is necessary for
ensure fair processing of data with regard to the individual
concerned;
d) the characteristics of the receipt for the declaration to the
National Commission or those of the authorization issued by the said
commission;
-6-

Page 7

2- The documents, which serve as the basis for collecting personal data
personnel must contain the information referred to in the previous paragraph;
3- When the data of a personal nature have not been collected from the
data subject, the controller or his representative must,
prior to data recording or if data communication to
a third party is considered, at the latest during the first communication of
data, provide the data subject with at least the information referred to in
a), b) and c) above, unless the person is already aware of it.
4- In the event of data collection, in networks, open, the data subject must
be informed, unless they already know that the personal data
concerning can circulate on networks without security guarantees and
that they may be read and used by unauthorized third parties.

Article 6
Limits to the right to information
The information obligation provided for in article 5 above is not applicable:
a) personal data, the collection and processing of which are
necessary for national defense, internal or external security of
the State, prevention or repression of crime;
b) when information to the data subject proves impossible,
in particular in the case of processing of personal data for
statistical, historical or scientific purposes. In this case, the manager
processing is required to notify the Commission of the impossibility
inform the person concerned and present the reason for this
impossibility;
(c) whether the law expressly provides for the registration or
communication of personal data;
d) to the processing of personal data carried out for purposes
exclusively journalistic, artistic or literary.

Article 7
Permission to access
The person concerned, proving his identity, has the right to obtain from the person in charge
processing, at reasonable intervals, without delay and free of charge:
a) confirmation that the personal data concerning him are
or not processed, as well as information relating to at least
the purposes of the processing, the categories of data to which it relates,
and the recipients or categories of recipients to whom the
personal data are communicated;
-7-

Page 8

b) the communication, in an intelligible form, of data, of a
personnel being processed, as well as any information
available on the origin of the data.
The controller can ask the National Commission
response times to legitimate access requests and may oppose
manifestly abusive requests, in particular, by their number and
their repetitive nature.
In the event of opposition, the burden of proof of the clearly
abusive, is the responsibility of the controller with whom these
requests have been made.
c) Knowledge of the logic behind any automated processing
personal data concerning him.

Article 8
Right of rectification
The person concerned, proving his identity, has the right to obtain from the person in charge
processing:
a) Updating, rectification, erasure or blocking of
personal data the processing of which does not comply with the
this law, in particular because of the incomplete and inaccurate
those data ; the controller is required to carry out
necessary corrections at no cost to the applicant and within a
ten days free.
In the event of refusal or no response within the aforementioned period, the person
concerned may submit a request for rectification to the
National Commission, which instructs one of its members to
carry out all useful investigations and have the rectifications carried out
necessary, as soon as possible.
The person concerned is kept informed of the follow-up to their
request ;
b) Notification to third parties to whom the personal data have
been communicated of any update, any rectification, any
erasure or any blocking carried out in accordance with point a) below
above, if that is not impossible.

-8-

Page 9

Article 9
Right of opposition
The person concerned, proving his identity, has the right to object, for
legitimate reasons, for data concerning him to be processed.
She has the right to object, free of charge, to the data concerning her being
used for prospecting purposes, in particular commercial, by the person in charge
current treatment or that of further treatment.
The provisions of the first paragraph do not apply when the processing meets the
a legal obligation or when the application of these provisions has been excluded, for example
an express provision of the act authorizing the processing.

Article 10
Prohibition of direct prospecting
Direct prospecting by means of an automatic call machine, a fax machine
or electronic mail or a medium employing similar technology
nature that uses, in any form whatsoever, a person's contact details
physical person who has not expressed their prior consent to receive
direct surveys by this means.
For the purposes of this article, consent means any
free, specific and informed manifestation of will by which a person
accepts that personal data concerning him / her may be used for
direct prospecting purposes.
Constitutes a direct prospecting the sending of any message intended to promote,
directly or indirectly, goods, services or the image of a person
selling goods or providing services.
However, direct prospecting by e-mail is authorized, if the
contact details of the recipient were collected directly from him, in the
compliance with the provisions of this law, on the occasion of a sale or service
of services, if the direct prospecting concerns similar products or services
provided by the same natural or legal person, and if the recipient is offered,
in an express, unambiguous and simple way, the possibility of opposing, without
costs, except those related to the transmission of the refusal, to the use of his contact details
when these are collected and each time that an e-mail from
prospecting is addressed to him.
In all cases, it is forbidden to issue, for the purpose of direct prospecting,
messages by automatic call machines, fax machines and electronic mail,
-9-

Page 10

without indicating valid contact details to which the recipient can usefully
send a request to obtain that these communications cease without
costs other than those related to the transmission thereof.
It is also prohibited to conceal the identity of the person on behalf of
which the communication is sent and to mention an object unrelated to the
delivery or service offered.

Article 11
Neutrality of effects
No court decision involving an assessment of the behavior of a
no one can have as a basis the automated processing of data to
personal character intended to assess certain aspects of his personality.
No other decision producing legal effects with regard to a person
can be taken on the sole basis of automated data processing intended
to define the profile of the person concerned or to assess certain aspects of his personality.
Are not considered to be taken on the sole basis of treatment
automated decisions taken in connection with the conclusion or execution of a
contract and for which the data subject has been able to present his
observations, nor those satisfying the requests of the person concerned.

Chapter III:
OBLIGATIONS OF THE RESPONSIBLE
TREATMENT
Article 12
Unless there are specific legislative provisions, the processing of data of a
personnel must be subject to:
1- Prior authorization when the processing concerns:
a) Sensitive data referred to in paragraph 3 of article 1 above.
However, the processing operations put in place are exempt from said authorization.
work by an association or any other non-profit group and
of a religious, philosophical, political, trade union, cultural or sporting nature:
- for only data which reveals one or more of the
characteristics referred to in paragraph 3 of article 1 below
above and corresponding to the purpose of said association or
of said group;
- provided that the data only concerns members
of this association or group and, where applicable, the
-10-

Page 11

people who have contact with him
regular within the framework of its activity;
- and that they relate only to data not communicated to
third parties, unless the persons concerned
expressly consent and that the group can provide the
proof of this consent at the first request of the authority
competent;
b) the use of personal data for purposes other than those
for which they were collected;
c) genetic data, with the exception of those implemented by
health workers and for medical purposes, whether they are
preventive medicine, diagnostics or care;
d) data relating to offenses, convictions or measures of
safety, with the exception of those implemented by court officials;
e) data including the number of the national identity card of the
concerned person ;
f) The interconnection of files belonging to one or more persons
legal entities managing a public service and whose purposes of public interest are
different files or the interconnection of files belonging to other people
moral and whose main purposes are different.
2- A prior declaration in other cases

Section one. - Prior declaration
Article 13
The prior declaration provided for in article 12 above, which includes the commitment
that the processing will be carried out in accordance with the provisions of this law, is
filed with the National Commission under the conditions provided for in this
section.
The purpose of this declaration is to enable the National Commission to exercise the
powers vested in it by this law, in order to monitor compliance with
its provisions and ensure the publicity of the processing of personal data.

Article 14
The controller or, where applicable, his representative must send a
declaration to the National Commission prior to the implementation of a
fully or partially automated processing or a set of such
processing having the same purpose or related purposes.
-11-

Page 12

Article 15
The declaration provided for in article 12 above must include:
a) the name and address of the controller and, where applicable, of his
representative;
b) the name, characteristics and purpose (s) of the processing
considered;
c) a description of the category or categories of data subjects and of the

data or categories of personal data therein
reporting;
d) the recipients, or the categories of recipients to whom the data
are likely to be communicated;
e) planned data transfers to foreign states;
f) the retention period of the data;
g) the service with which the data subject may exercise, if
if applicable, the rights which are recognized by the provisions of this
law, as well as the measures taken to facilitate the exercise thereof.
h) A general description allowing a preliminary assessment of the
appropriateness of the measures taken to ensure confidentiality and
the security of processing in accordance with the provisions of Articles 23 and
24 below;
i) Crossovers, interconnections, or any other form of
reconciliation of data as well as their transfer, subcontracting,
any form, to third parties, free of charge or against payment.
Any modification to the above information and any deletion of processing
must be brought to the attention of the National Commission without delay.
In the event of transfer of a data file, the transferee is required to complete the
declaration formalities provided for by this law.
The modalities of the declaration to the National Commission of changes affecting
the information referred to in the above paragraph is set by the government, after
opinion of the said committee.

Article 16
The National Commission sets the list of categories of data processing to be
personal character which, taking into account the data to be processed, is not likely
to infringe the rights and freedoms of the persons concerned, and for whom the
declaration must specify only the elements provided for in b), c), d), e) and f) of
article 15 above.
The decision of the National Commission is subject to approval by the
government.
-12-

Page 13

Article 17
The National Commission sets the list of non-automated data processing to be
personal character which may be the subject of a simplified declaration, of which it
specifies the elements by a decision approved by the government.

Article 18
The reporting obligation does not apply to processing operations having as their sole purpose the
keeping of a register which is, by virtue of legislative or regulatory provisions,
intended for public information and open to consultation of the public or any
person showing a legitimate interest.
However, in this case, a data controller must be appointed.
whose identity is made public and notified to the National Commission and which is
responsible for the application of the provisions of Chapter II of this law vis-à-vis
of the people concerned.
The controller exempted from declaration must communicate to any
person who requests it information relating to the name and
purpose of the processing, the identity of the controller, the data processed, their
recipients and, where applicable, the planned transfers for the exchange.
The National Commission establishes the list of treatments meeting the definition provided
above by a decision subject to government approval.

Article 19
The National Commission issues, within 24 hours from the date of
date of filing of the declaration a receipt for the said declaration, including
characteristics must be included in all collection or
data transmission. The controller can put said processing
implemented upon receipt of said receipt.

Article 20
When he appears before the National Commission, upon examination of the declaration submitted to him
provided, that the treatment envisaged presents obvious dangers for compliance
and the protection of the privacy and fundamental rights and freedoms of individuals
with regard to the processing to which these data are or may be the subject, it
decides to submit said processing to the prior authorization regime provided for below.
after.
Its decision, motivated, is notified to the declarant within eight days following that of the
filing of the declaration.
-13-

Page 14

Section 2. - Prior authorization
Article 21
1- The processing of sensitive data is subject to legal authorization
which sets the conditions. Otherwise, it must be authorized by the Commission
national;
2- This authorization is granted on the basis of the express consent of the person
concerned or when data processing is essential for the exercise
the legal or statutory functions of the controller;
3- In addition to the rule of law, the express consent of the person concerned or
the legal or statutory obligation of the person in charge, the prior authorization of the
National Commission may also be granted in cases where:
a) the treatment is necessary for the defense of vital interests of the person
data subject or a person and if the data subject is in
physical or legal inability to give consent;
b) the processing relates to data clearly made public by
the data subject and their consent to the processing of
data can legitimately be inferred from its statements;
c) the processing is necessary for the recognition, exercise or defense
a legal right and is carried out exclusively for this purpose.

Article 22
By way of derogation from the provisions of article 21 above, the processing of data
relating to health is subject to a declaration to the National Commission,
when its sole purpose is:
- preventive medicine, medical diagnostics, administration of
care or treatment or the management of health services and that it is
carried out by a health practitioner subject to professional secrecy or by
any other person also subject to an obligation of secrecy;
- to select the people likely to benefit from a right, a
service or contract, as long as they are not excluded by any
legal or regulatory provision.

-14-

Page 15

Section 3. - Obligations of confidentiality and security of
treatment and professional secrecy
Article 23
1- The controller must implement the technical measures and
appropriate organizational structures to protect personal data
against accidental or unlawful destruction, accidental loss, alteration,
unauthorized distribution or access, in particular when the processing involves
data transmissions in a network, as well as against any other form
unlawful processing. These measures must ensure, taking into account the State of
art and costs associated with their implementation, an appropriate level of security
with regard to the risks presented by the processing and the nature of the data to be
protect ;
2- The controller, when the processing is carried out for his
account, must choose a subcontractor who provides sufficient guarantees to the
with regard to technical and organizational security measures relating to
treatments to be carried out and he must ensure compliance with these measures;
3- The performance of the subcontracting treatment must be governed by a contract or
a legal act which binds the processor to the controller and which
provides in particular that the subcontractor acts only under the sole instruction of the
controller and that the obligations referred to in paragraph 1 below
it is also incumbent on him;
4- For the purposes of preserving evidence, the elements of the contract or deed
data protection law and the requirements for
measures referred to in paragraph 1 above, are recorded in writing or in a
other equivalent form.

Article 24
1- Those responsible for processing sensitive or health-related data
must take appropriate measures to:
a) prevent unauthorized access to the facilities
used for the processing of this data (control of entry into
facilities);
b) prevent data carriers from being read, copied, modified
or removed by unauthorized persons (control of media
data);
c) prevent unauthorized entry, as well as awareness,
unauthorized modification or elimination of personal data
personnel introduced (integration control);
d) prevent automated data processing systems
can be used by unauthorized persons by means of
-15-

Page 16

data transmission installations (monitoring of use);
e) ensure that only authorized persons can have access to
data covered by the authorization (access control);
f) guarantee the verification of the entities to which the personal data
personnel can be transmitted by transmission facilities
data (transmission control);
g) ensure that it is possible to verify a posteriori, within an appropriate timeframe
depending on the nature of the treatment to be set in the regulations
applicable to each particular sector, which data
personnel are introduced, when they have been introduced and for whom (control of
introduction);
h) prevent the transmission of personal data and
the transport of the media, the data can be read, reproduced,
modified or eliminated without authorization (transport control);
2- Depending on the nature of the bodies responsible for processing and the type
installations with which it is carried out, the National Commission may
exempt from certain security measures, provided that compliance with
rights, freedoms and guarantees of the persons concerned is ensured.

Article 25
Any person acting under the authority of the controller or that of the
subcontractor, as well as the subcontractor himself who accesses data at
personal character can only be processed on the instruction of the person in charge of
processing, except under legal obligations.

Article 26
The person responsible for processing personal data, as well as
persons who, in the performance of their duties, have knowledge of personal data
personal character processed, are required to respect professional secrecy
even after having ceased to exercise their functions, under the terms provided by law
criminal.
The provisions of the first paragraph above do not exempt from the obligation to
provide information, in accordance with the legal provisions applicable to
files in question or in accordance with common law legislation.

-16-

Page 17

Chapter IV
From the National Commission for the Control of
protection of personal data
Section one. - Institution, powers and
attributions
Article 27
A National Commission for the Control of
protection of personal data, responsible for implementing and
ensure compliance with the provisions of this law and the texts adopted for its
application.
To this end, it is responsible for:
A- Give your opinion:
1- to the government or parliament on projects or proposals for
laws or draft regulations relating to the processing of personal data
personal character of which it is seized;
2- to the competent authority on draft regulations creating
files relating to personal data collected and
processed for the purposes of prevention and repression of crimes and offenses,
the opinion requested, in the present case, constitutes a declaration;
3- to the competent authority on bills and proposals
on the creation and processing of data relating to surveys
and statistical data collected and processed by authorities
public;
4- to the government on the terms of the declaration provided for in
paragraph 2 of article 12 above;
5- to the government on the terms of registration in the national register
instituted by article 45 of this law;
6- to the government on the rules of procedure and protection of
data from the processing of security files which must be
of a recording.
B- Receive:
1- notification of the identity of the representative installed in Morocco who is
substitute for the controller residing abroad;
2- the declarations provided for in Articles 12 (paragraph 2) and 13 and
issue receipt of the declaration;
3- the identity of the person responsible for processing the registers kept to be
open to the public, provided for in article 19 above.

-17-

Page 18

Article 28
For the purposes provided for in Article 27 (1 st paragraph) above, the National Commission is
empowered to:
1- authorize the retention of data beyond a specified period;
2- grant the controller additional time to
respond to communication requests made by the person
concerned;
3- make justified corrections when the person in charge of
treatment refuses to proceed at the request of the interested party;
4- instruct and issue the authorizations provided for in article 12 above;
5- set the list of categories of processing benefiting from a declaration
simplified;
6- set the list of non-automated processing operations subject to declaration
simplified;
7- set the list of processing operations corresponding to the definition in article 18 of
this law;
8- issue receipt of the declaration provided for in article 13, specifying the
content;
9- issue the authorizations provided for in article 21 above;
10- establish the list of countries with adequate protection legislation
of natural persons with regard to the processing of personal data
staff ;
11- authorize data transfers in the cases provided for in article 43 below
below;
12- ensure the maintenance of the national data protection register provided for in
article 45 below;
13- grant exemptions from security measures in view of the quality of the
responsible for the processing and the type of installation with which this
processing is carried out;
14- decide to submit to authorization a processing legally subject to
declaration in accordance with article 20 above;
15- withdraw the receipt or authorization in accordance with the
provisions of article 51 of this law.
The National Commission is also responsible for:
1- receive complaints from any person concerned who believes they have been wronged by
the publication of the processing of personal data,
investigate and follow up by ordering the publication of corrigenda
or / and referral to the public prosecutor for the purpose of prosecution;
2- assess, at the request of public authorities, in particular
-18-

Page 19

judicial authorities, the elements submitted for their assessment during
disputes arising from the application of this law or of texts taken for
its application;
3- assist the government in the preparation and definition of the position
Moroccan during international negotiations in the field of
protection of personal data;
4- cooperate with similar bodies controlling the processing of
personal data in foreign states.

Article 29
In order to enable proper enforcement of data protection,
the National Commission carries out a permanent public information mission and
of the persons concerned on the rights and obligations decreed by this law and
the texts taken for its application.

Article 30
The National Commission has:
1- investigative and investigative powers allowing its agents,
regularly commissioned for this purpose by the president, to have access
to the data being processed, to request direct access to
premises in which the processing is carried out, to collect and enter
all the information and documents necessary to complete the
control functions, all in accordance with the terms of the commission
that they perform;
2- the power to order that it be communicated, on time and
according to the terms or possible sanctions that it fixes, the documents of
any kind or on any medium allowing him to examine the facts
concerning complaints brought before it;
3- the power to order or carry out or cause to be carried out
modifications necessary for fair keeping of the data contained
in the file ;
4- the power to order the locking, erasure or destruction of
data and that of prohibiting temporarily or definitively, the
processing of personal data, even those included in
open data transmission networks from servers located
on the national territory.

-19-

Page 20

Article 31
The exercise of the powers referred to in paragraphs 2 and 4 of Article 30 above is
subject to compliance with a disciplinary procedure guaranteeing the rights of the
defense and in particular the adversarial principle specified in the regulations
within the National Commission and applicable to all other procedures
implemented by the National Commission and of a disciplinary nature.

Section 2. - Composition of the national commission
Article 32
The National Commission for the Protection of Personal Data
staff consists of seven members:
- a president appointed by His Majesty the King;
- six members also appointed by His Majesty the King, on proposal:
• the Prime Minister;
• the President of the House of Representatives;
• the president of the Chamber of Councilors.
The term of office of the members of the National Commission is five years
renewable only once.
The terms and conditions for the appointment of members of the Commission
national regulations are set by decree.

Section 3. - Organization and operation
of the National Commission
Article 33
The National Commission meets when convened by its president, acting on his
own initiative or at the request of half of the members. The president sets the order
of the day of the meeting.

Article 34
The meetings of the National Commission are validly held when the two
at least a third of the members are present. Decisions are made validly at the
majority of members present, the president's vote being decisive in the event of
equal division of votes.

-20-

Page 21

Section 4. - Membership status
Article 35
The functions of a member of the National Commission are incompatible with those
director, manager, member of the management board or sole managing director
or member of the supervisory board of a data processing company at
personal character.
A member of the National Commission cannot participate in a deliberation or
verifications relating to an organization in which he has held a direct interest
or indirect, or has exercised a mandate or a function, if a period of five years has not been
elapsed between the date on which the termination of service took place, the end of the mandate or
of the disposition of the interest and the date of his appointment to the Commission
national.
If the incompatibility decreed by the preceding paragraph concerns the president of the
National Commission, it appoints a member of the National Commission to
exercise their full powers when the matter concerning the body in question
case is called before the National Commission. The president's ruling is
published in the “Official Bulletin”.

Article 36
Members of the National Commission are bound by professional secrecy for
facts, acts and information of which they may have become aware during the
the performance of their duties. They are subject to the same obligation, even
after the end of their term.
Civil servants, agents or technicians who exercise functions within the
National Commission or to its members are also subject to
the obligation to respect professional secrecy.

Article 37
Members and officials or agents and technicians of the Commission
national rights are protected against insult or injury to their person in the
terms of Articles 265 and 267 of the Criminal Code.

Article 38
When the National Commission deliberates on a question involving a
administration, government representatives participate in
deliberations in an advisory capacity.

-21-

Page 22

Article 39
The National Commission draws up and approves its internal regulations, which are submitted
government approval before publication in the “Official Bulletin”.

Section 5. - Administration
Article 40
The president is assisted, in the exercise of his administrative and financial functions,
by a secretary general appointed by the government on the proposal of the president.
The Secretary General, in addition to the powers he exercises by delegation from the President, is
charge :
- manage the staff recruited or seconded according to the decisions of the president;
- prepare and execute the budget of the National Commission for which it is
assistant officer;
- prepare and award contracts for the National Commission;
- prepare working documents for Commission meetings
national and keep a register of its decisions;
- to follow the work of the committees set up by the Commission
national level and provide them with the material and human resources
necessary for the accomplishment of their missions.

Article 41
The Secretary General has, for the exercise of his powers, a staff
administrative and technical staff made up of public administration officials
or public officials, seconded to the National Commission, and staff
recruited in accordance with the applicable procedures in the matter, in particular by
contractual way.

Article 42
The National Commission creates the permanent or ad hoc committees necessary to
the accomplishment of its missions by provisions of the internal regulations.
It sets out in the same regulations the operating and organizational procedures
these committees, which must be chaired by a member of the National Commission,
but can be composed of personalities chosen outside the members of the
National Commission or part of its staff.

-22-

Page 23

Chapter V
Data transfer to a foreign country
Article 43
The controller cannot transfer personal data
to a foreign state only if that state ensures a sufficient level of protection of life
privacy and fundamental rights and freedoms of individuals with regard to processing
of which these data are the subject or may be the subject.
The sufficiency of the level of protection provided by a State is assessed
in particular according to the provisions in force in that State, the measures of
security applied therein, the specific characteristics of the processing such as
its purposes and duration, as well as the nature, origin and destination of
data processed.
The National Commission establishes the list of States meeting the criteria defined in
paragraphs 1 and 2 above.

Article 44
By way of derogation from the provisions of article 43 above, the person in charge of a
processing may transfer personal data to a State not
not meeting the conditions set out in the above article, if the person to whom
report the data has expressly consented to their transfer or:
1- If the transfer is necessary:
(a) to safeguard the life of that person;
b) the preservation of the public interest;
c) compliance with obligations to ensure recognition,
the exercise or defense of legal claims;
d) the performance of a contract between the controller and

the interested party, or pre-contractual measures taken at the request of
this one ;
e) the conclusion or performance of a contract concluded or to be concluded, in
the interests of the data subject, between the controller
and a third;
f) the execution of a measure of international legal assistance;
g) the prevention, diagnosis or treatment of medical conditions.
2- If the transfer is made in application of a bilateral or multilateral agreement
to which the Kingdom of Morocco is a party;
3- On the express and reasoned authorization of the National Commission when
the processing guarantees a sufficient level of privacy protection
as well as the fundamental rights and freedoms of individuals, in particular
due to contractual clauses or internal rules to which it is subject.
-23-

Page 24

Chapter VI
From the national register for the protection of
personal data and limits to
the creation or use of central registers
and files
Article 45
A national register for the protection of personal data is hereby established,
hereinafter referred to as the national register, the keeping of which is vested in the commission, which
ensures that it is made available to the public.

Article 46
Are entered in the national register:
a) the files for which the public authorities are responsible for processing;
b) files processed by private persons;
c) references to published laws or regulations creating files
public;
d) the authorizations issued in application of this law and the texts
taken for its application;
e) data relating to files which are necessary to enable the
data subjects to exercise the rights of information, access,
rectification, deletion and opposition provided for by this law,
in particular the details contained in the declaration, set out in a) to e)
of article 15 above.

Article 47
Files the sole purpose of which is to keep a register which, by virtue of
legislative or regulatory provisions, is intended for the information of the public and is
open to public consultation are exempt from registration in the national register.
However, the identity of the person responsible for the
processing for the purposes of the exercise by the data subjects of the rights provided for in
chapter II of this law.

Article 48
The procedures for entering the data provided for in Article 46 above in the register
national and those for keeping it up to date are set by the government, after consultation with the
National Commission.

-24-

Page 25

Article 49
Processing of personal data relating to infringements,
convictions and security measures can only be implemented by:
- courts, public authorities and legal persons managing a
public service, acting within the framework of their legal attributions;
- auxiliaries of justice, for the strict needs of the exercise of the missions
entrusted to them by law;
- the body responsible for the protection of copyright and rights
neighbors referred to in Article 11 (2 nd paragraph) of Law No. 34-05 amending and
supplementing Law No. 2-00 on copyright and neighboring rights.

Article 50
The creation, maintenance and processing of central registers concerning persons
suspected of illicit activities, misdemeanors and administrative offenses and the
decisions providing for penalties, security measures, fines and
ancillary sanctions are the sole responsibility of the public services which have
express by virtue of the law of organization and operation and which must
comply with the procedural and data protection rules provided for by law,
after opinion of the National Commission.

Chapter VII
Sanctions
Article 51
Without prejudice to criminal penalties, when it appears, following the implementation
implementation of the processing object of the declaration or authorization provided for in Article 12
of this law, whether this processing adversely affects public safety or order or
is contrary to morality and good morals, the National Commission may, without
deadlines, withdraw, as the case may be, the receipt of the declaration or the authorization.

Article 52
Without prejudice to civil liability towards persons who have suffered
damage due to the offense, is punished by a fine of 10,000 to 100,000 DH,
anyone who has implemented a personal data file without the
declaration or authorization required in Article 12 above or will have continued
personal data processing activity despite the withdrawal of the
receipt of the declaration or authorization.

-25-

Page 26

Article 53
Is punished by a fine of 20,000 to 200,000 DH per offense, any person responsible for
processing of personal data denying the rights of access,
rectification or opposition provided for in Articles 7, 8 and 9 above.

Article 54
Is punished by imprisonment of three months to one year and a fine of 20,000 to
200,000 DH or one of these two penalties only anyone, in violation of a),
b) and c) of article 3 of this law, collection of personal data
by fraudulent, unfair or unlawful means, implements processing for the purposes of
other than those declared or authorized or submits the aforementioned data to a
further processing incompatible with the declared or authorized purposes.

Article 55
Is punished by imprisonment of three months to one year and a fine of 20,000 to
200,000 DH or one of these two penalties only anyone who:
- keeps personal data beyond the planned duration
by the legislation in force or that provided for in the declaration or
authorization;
- keeps the aforementioned data in violation of the provisions of e) of
article 3 of this law.
The same penalties apply to processing for purposes other than historical ones,
statistical or scientific data of a personal nature kept beyond
of the duration mentioned in the first paragraph above.

Article 56
Is punished by imprisonment of three months to one year and a fine of 20,000 to
200,000 DH or one of these two penalties only anyone who carries out a
processing of personal data in violation of the provisions of article
4 above.

Article 57
Is punished by imprisonment from three months to one year and a fine of 50,000 to
300,000 DH or one of these two penalties only anyone who proceeds, without the
express consent of the interested parties, to the processing of data at
personal character which, directly or indirectly, reveal the origins
racial or ethnic, political, philosophical or religious opinions,
union memberships of people or relating to their health.
Anyone who proceeds to the processing of personal data is subject to the same penalties.
personal character concerning offenses, convictions or measures
security.
-26-

Page 27

Article 58
Is punished by imprisonment of three months to one year and a fine of 20,000 to
200,000 DH or one of these two penalties only, whoever has proceeded or
causes personal data to be processed without putting
implement the measures to preserve data security provided for in Articles 23
and 24 above.

Article 59
Is punished by imprisonment of three months to one year and a fine of 20,000 to
200,000 DH or one of these two penalties only, whoever carries out a
processing of personal data concerning a natural person
despite the opposition of that person, when this opposition is based on
legitimate reasons or when this processing is for prospecting purposes,
in particular commercial, as mentioned in article 9 or by electronic means such as
as provided for in article 10 of this law.

Article 60
Is punished by imprisonment of three months to one year and a fine of 20,000 to
200,000 DH or one of these two penalties only, anyone who carries out a
transfer of personal data to a foreign state, in violation of the
provisions of articles 43 and 44 of this law.

Article 61
Is punished by imprisonment of three months to one year and a fine of 20,000 to
200,000 DH or one of these two penalties only, all responsible for
processing, any subcontractor and any person who, by reason of his or her duties, is
responsible for processing personal data and who, even through negligence,
cause or facilitate the abusive or fraudulent use of the data processed or received or
communicates to unauthorized third parties.
The court may also order the seizure of the material used to commit
the infringement as well as the erasure of all or part of the personal data
personnel subject to the processing giving rise to the infringement.

Article 62
Is punished by imprisonment for three to six months with a fine of 10,000 to 50,000
DH or one of these two penalties only, anyone who:
- hinders the exercise of the control missions of the National Commission;
- refuses to receive the controllers and to let them fulfill their
commissions;
- refuses to send the requested documents or information;
- refuses to transmit the documents provided for by law.
-27-

Page 28

Article 63
Any official who refuses to apply the decisions of the National Commission is
punishable by imprisonment from three months to one year and a fine of 10,000 to
100,000 DH or one of these two penalties only.

Article 64
When the author of one of the offenses provided for and sanctioned under this
chapter is a legal person and without prejudice to the penalties that may be
applied to its directors responsible for one of the offenses provided for above, the
fines are doubled.
In addition, the legal person may be punished with one of the following penalties:
- partial confiscation of his property;
- confiscation provided for in article 89 of the penal code;
- the closure of the establishment (s) of the legal person where
the offense has been committed.

Article 65
In the event of a repeat offense, the penalties provided for in this chapter are doubled.
Is in a State of recidivism, any person who has been convicted by a court decision
become irrevocable for one of the offenses provided for in this chapter has committed
a similar offense in the year following the delivery of such a decision.

Article 66
In addition to the judicial police officers, the agents of the National Commission
specially commissioned for this purpose by the president and sworn in in the
forms of common law may seek and record, by report, the
infringements of the provisions of this law and of the texts adopted for its application.
Their minutes are sent to the public prosecutor within five days of
research and observation operations.

-28-

Page 29

Chapter VIII
Transitional provisions
Article 67
Natural or legal persons whose activity consisted, before the date of
publication of this law in the Official Bulletin to be carried out, primarily or
accessory, processing of personal data meeting the definition
provided for in article 1 above, have a maximum period of two years,
current from the date of installation of the National Commission which will be
recorded by an administrative act published in the Official Bulletin, to regularize their
situation in accordance with the provisions of this law.
In the absence of this regularization within the aforementioned period, their activities are deemed to be
exercised without declaration or authorization. The offender is exposed, in this case,
to the penalties provided for by this law.

-29-

