Data protection (Law 09-08, GDPR)
Some links on this page are affiliate links: we may earn a commission at no extra cost to you. Our approach
Compliance is not an administrative file to complete once, but a discipline of data handling: knowing what you collect, why, where it is stored and who can access it. It protects customers as much as the company. ## What Law 09-08 requires The Moroccan law requires declaration to the CNDP, informing individuals, respecting purposes and an appropriate level of security. It applies as soon as a customer database, a prospect file or an online shop exists. ## The GDPR, when it applies to you A Moroccan company without an establishment in Europe is concerned as soon as it processes data of people located there. This often includes European customers of an online shop or of exports. ## Cookie banner and consent A banner is not enough: consent must be freely given, specific and documented. Analytics and advertising tools must be configured not to set cookies before the user's choice.When this guide is for you
- You collect customer data (name, phone, email, address) on a site or through a form
- You use an analytics or advertising tool that transfers data to a third party
- You sell to European customers and must apply the GDPR
- You subscribe to a cloud service and must check how your data is hosted
- You have received a complaint, an access request or an attempted data leak
Step by step
- Processing inventory — List the data collected, where it flows, who has access, how long it is kept and for what purpose. This register is the basis of any compliance work.
- Legal bases and purposes — For each processing activity, identify the legal basis (contract, legal obligation, consent, legitimate interest) and deliberately limit collection to what is necessary (minimisation).
- Declaration and information — File notifications with the CNDP under Law 09-08, write a clear privacy policy and obtain valid consent for cookies and direct marketing.
- Security and processors — Protect data (access, encryption, backups), frame providers with data-processing agreements and check where data is located.
- Rights and incidents — Set up a procedure to respond to access, rectification and erasure requests, and to notify a data breach within the required time.
What it costs (in MAD)
| Service | Indicative price | Good to know |
|---|---|---|
| Inventory and processing register | 15,000 – 40,000 MAD (≈ 1,400 – 3,700 €) | Site, CRM, analytics, providers |
| Full compliance | 30,000 – 60,000 MAD (≈ 2,800 – 5,500 €) | Register, policies, contracts, training |
| CNDP declaration | 2,000 – 8,000 MAD (≈ 180 – 730 €) | Preparing and filing notifications |
| Privacy policy and cookie banner | 5,000 – 20,000 MAD (≈ 450 – 1,800 €) | Writing and consent configuration |
| Annual support | 10,000 – 40,000 MAD / year (≈ 920 – 3,700 €) | Updates, requests and incidents |
| Data security audit | 10,000 – 30,000 MAD (≈ 920 – 2,800 €) | Access, encryption, backups and logging |
Indicative ranges for the Moroccan market in 2026, excluding tax. Prices vary with scope and provider.
Mistakes to avoid
- Collecting as much data as possible "just in case", without a clear purpose or legal basis
- Using a cookie banner that does not actually record consent
- Keeping data indefinitely, with no retention period
- Forgetting processors: CRM, emailing, analytics, hosting, courier
- Assuming the CNDP and the GDPR are only for large companies
Frequently asked questions
What is Law 09-08?
It is the Moroccan personal data protection law. It requires that data collection and processing be declared to the CNDP, that they be fair and proportionate, that individuals be informed and that their data be sufficiently protected.
Do all processing activities need to be declared to the CNDP?
Most processing activities require a notification or prior authorisation. Low-risk processing may sometimes be exempt; a professional review confirms the right regime.
Must a Moroccan company apply the GDPR?
If it processes data of people located in the EU (European customers, a French-language site delivering to Europe, targeted advertising), yes, for those activities. Moroccan Law 09-08 applies in parallel.
How much does compliance cost?
For an SME, an inventory and reasonable compliance cost between 15,000 and 60,000 MAD depending on the number of processing activities and providers. Annual support for updates and requests is more modest.
What to do in case of a data breach?
Contain the breach, document it, inform the organisation and the affected individuals according to the risk, notify the competent authorities within the required time, then fix the cause. The GDPR requires notification to the authority within 72 hours.
Updated on
Related guides
Version française: /services/devops-securite/protection-des-donnees/ · AR · NL