Law 09-08 and your website: a CNDP compliance checklist for Moroccan businesses

If your website has a contact form, a booking form, Google Analytics, a Meta Pixel or a newsletter sign-up, it collects personal data. In Morocco, that brings it under law 09-08 on the protection of individuals with regard to the processing of personal data, and under the control of the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel).

This guide explains what that means for a small business website. Every rule links to the official text. Where we could not confirm something, we say so.

What law 09-08 requires, in short#

The key points of the text of law 09-08 (Dahir 1-09-15 of 18 February 2009) for a website:

Personal data is broad. Any information about an identifiable person, “including sound and image” (article 1). A name and phone number in a booking form count. So does a photo of a client.
The law applies to you if your business is established in Morocco (article 2).
Five quality rules (article 3): collect fairly and lawfully, for a specific purpose, only what you need, keep it accurate, and do not keep it longer than necessary.
Consent is the default (article 4). The exceptions include processing needed to perform a contract or to take steps the person asked for before a contract. Answering a booking request you received fits there. Adding that person to a promotional mailing list does not.

Step 1: notify the CNDP before you start#

Under article 12, every processing of personal data needs either:

a prior declaration (déclaration préalable), which is the general case; or
a prior authorisation (autorisation préalable) when it involves sensitive data such as health data, national ID card (CIN) numbers, use of data for a purpose other than the one it was collected for, or the interconnection of files.

The CNDP issues a receipt (récépissé) for a declaration within 24 hours, and you may start once you have it (article 19). If the CNDP sees clear risks, it can move a declaration to the authorisation regime within eight days (article 20). For authorisations and transfer requests, the CNDP’s notification procedure gives a two-month review period, which it can extend once.

For common situations, the CNDP has published model texts that make the filing lighter:

Your website does this	CNDP text	Regime
Keeps a customer file (bookings, orders, invoices)	Deliberation 32-2015	Model declaration
Sells goods or services online	Deliberation 508-AU-2014	Model declaration
Uses cookies	Deliberation D-939-2025	Simplified declaration
Sends a newsletter	Deliberation D-940-2025	Simplified declaration
Books medical appointments, follows patients	Deliberation D-941-2025	Model authorisation request

The forms are on the CNDP site: F211 (normal declaration), F214 (declaration following a CNDP decision), F112 and F113 (authorisation), and F118 (transfer abroad). The 2025 deliberations also mention a CNDP-FORMS platform; we found no public link to it.

Step 2: tell people what you do with their data#

Article 5 says that before you collect data, you must tell the person, clearly:

who you are (the controller);
why you collect the data;
who receives it, whether each field is required, and that they can access and correct their data;
the reference of your CNDP receipt or authorisation.

The documents used for collection must carry this information (article 5, paragraph 2): on a website, a short notice under each form, linking to a full privacy page. The CNDP publishes model wording.

Step 3: cookies, Google Analytics and the Meta Pixel#

On 28 November 2025 the CNDP adopted its first text on cookies, deliberation D-939-2025:

Allowed purposes: personalised ads based on browser or location (without building a personal profile), content personalisation, social-network sharing, and audience statistics (without a personal profile). Using cookie data to build a profile of the visitor needs a prior CNDP authorisation.
Consent is required before the first cookie for personalised advertising and social-sharing features. It must come from a “clear and explicit action”, and visitors must be able to refuse.
Audience measurement and content personalisation do not need prior consent under this deliberation, as long as no profile is built.
Six months maximum: cookie data must be deleted or anonymised after six months, and the visitor’s choice is kept for up to six months.
Inform before the first cookie: your identity, purposes, data categories, recipients (including authorised transfers abroad), how to exercise rights, and your CNDP receipt references.
Sites already using cookies had to bring their processing into line and file a simplified declaration.

In practice, the Meta Pixel is an advertising tool, so it needs consent. Google Analytics is audience measurement. D-939-2025 does not require prior consent for it if no profile is built, but the older online-sales model (508-AU-2014, article 8) asks e-commerce sites to obtain consent for web metrics. Because the texts differ, the cautious approach is a banner that blocks both tools until the visitor accepts. Whether Meta’s audience features count as “profiling” under D-939-2025 is not settled in the text.

Step 4: data that leaves Morocco#

Hosting abroad, Google Analytics, the Meta Pixel and most newsletter tools send data outside Morocco. Article 43 allows transfers only to countries with a sufficient level of protection. The CNDP’s list (deliberation 236-2015) covers 26 EU countries (Croatia is not listed) plus the United Kingdom, Switzerland, Norway, Iceland, Liechtenstein and Canada. The United States is not on it. Even for listed countries, the deliberation says the transfer must still be notified to the CNDP.

For other countries, article 44 allows a transfer with the person’s express consent, for a few listed needs (such as performing a contract with them), or with an express CNDP authorisation based on contractual clauses. D-939-2025 and D-940-2025 both state that cookie and newsletter data may not be transferred abroad without prior CNDP authorisation. The request uses form F118, and the CNDP only grants it once the underlying processing has been declared or authorised.

Step 5: respect people’s rights#

Access (article 7): free, without delay, at reasonable intervals.
Correction or deletion (article 8): free, within ten clear days. If you refuse or do not answer, the person can go to the CNDP.
Objection (article 9): for legitimate reasons, and always free for marketing.
Email marketing (article 10) needs prior consent. The exception is your existing customers, for similar products or services, if they can opt out each time.

For newsletters, D-940-2025 asks for a checkbox (or a signature on paper), an unsubscribe link in every message, data limited to name, job or activity and address, and deletion when the person unsubscribes.

Step 6: keep the data secure#

Article 23 requires security measures suited to the risks, and a written contract with any processor (host, web agency, booking software). At minimum: HTTPS, one account per staff member, backups, and that contract.

Clinics and schools: sensitive data#

Clinics. Health data is sensitive (article 1). Processing it needs a CNDP authorisation (article 12) and the patient’s express consent (article 21). An appointment form that asks “reason for visit” collects health data. D-941-2025 provides a model authorisation request for patient follow-up, and it names medical appointment booking among its purposes.

Schools. Law 09-08 has no article dedicated to minors, and we found no CNDP deliberation specific to schools or children’s data. A pupil’s data is not “sensitive” by itself, but a health form (allergies, vaccinations) is. Photos of pupils are personal data. Getting written consent from parents before collecting data or publishing photos is common practice, but we could not find a specific legal text requiring it.

Legal notices: what Moroccan law asks for#

Morocco has no single “legal notices” law like France’s. Two texts apply when you sell or take bookings online:

Law 31-08, article 29 (text, Ministry of Justice): a distance-selling offer must give your name or company name, phone, email and physical address, registered office, and for an online seller the trade register (RC) number and share capital, your tax ID if you pay VAT, and any licence or professional body. It also covers delivery terms, the right of withdrawal, payment terms and price validity. Article 30: your terms must be reachable from the home page and accepted before the order is confirmed.
Law 53-05 (consolidated text), which added article 65-4 to the Code of Obligations and Contracts: terms must be available in a form that can be saved and reproduced, along with the steps to conclude the contract, how to correct input errors, the languages offered and how the contract is archived.

The ICE (common business identifier) is not named in article 29. We could not confirm a text that requires it on a website, though many businesses show it.

Penalties under law 09-08#

10,000 to 100,000 DH

fine for running a personal data file without the required CNDP declaration or authorisation.

Source: Law 09-08, article 52 (B.O. 5714, 2009)

Other penalties in the law include 20,000 to 200,000 DH per offence for refusing access, correction or objection (article 53). Processing without valid consent (article 56), failing to secure data (article 58) and unlawful transfers abroad (article 60) carry 3 months to 1 year in prison and/or 20,000 to 200,000 DH. Sensitive data without express consent carries 50,000 to 300,000 DH (article 57). For companies, fines are doubled, and a court can close the business premises concerned (article 64). Repeat offences double the penalties (article 65).

Is law 09-08 being reformed?#

Commentators have discussed updating the law for years, often to bring it closer to the EU’s GDPR. As of early November 2026, we found no replacement bill adopted or published by the government or parliament; the CNDP’s recent changes came through deliberations. Law 09-08 remains in force. Check cndp.ma for updates.

Checklist for your website#

List every place your site collects data, and decide for each: declaration, simplified declaration or authorisation.
File with the CNDP before going live, and note each receipt number.
Add a short information notice under every form, with the receipt reference.
Publish a privacy and cookie page that covers article 5 and D-939-2025.
Install a cookie banner that blocks the Meta Pixel and analytics until the visitor accepts, with a visible “refuse” option.
Set analytics data retention to six months or less.
Map where your data goes (host, Google, Meta, email tool) and file form F118 for transfers abroad.
Use an unticked checkbox for the newsletter, and an unsubscribe link in every email.
Give people one email address for access, correction and objection requests, and answer within ten days.
Sign a data protection contract with your host and web provider.
Clinics: file for authorisation before taking appointments online. Schools: collect parental consent.
If you sell or take bookings online: show your company details and terms as law 31-08 requires.

FAQ#

Do I need to declare a simple contact form to the CNDP?#

Under article 12, any processing of personal data needs a declaration unless it falls under authorisation. A contact form that stores names and phone numbers is processing. If it feeds a customer file, deliberation 32-2015 gives you a model.

Is Google Analytics allowed in Morocco?#

Yes, within the rules of D-939-2025: no profiling, six-month retention, clear information, and a declaration. Its data goes to Google outside Morocco, so the transfer rules also apply.

It can. Under article 3(2) of the GDPR, it applies to businesses outside the EU that offer goods or services to people in the EU. A riad that takes bookings from European tourists should look into it.