Morocco

Law 09-08, article 2(2) covers processing by a controller established on Moroccan territory, and processing by a controller not established there who uses automated or non-automated means located on Moroccan territory, excluding pure transit. Article 2(3) then requires that controller to notify the CNDP of the identity of a representative installed in Morocco who, without prejudice to the controller's own liability, substitutes for the controller in all rights and obligations under the law. National defence and state security processing is carved out entirely; criminal-justice files are covered only under the instrument that creates them. Note the trigger is means in Morocco, not the "targeting" test used in Europe and India, so a purely offshore service with Moroccan users sits in a grey zone that the regulator has not publicly resolved.

Sector by sector, as checked on 18 August 2026. GOVERNMENT AND VITAL INFRASTRUCTURE: closed. Law 05-20 article 11 says sensitive data must be hosted exclusively on national territory, and article 14 extends the whole public-entity chapter to vital infrastructures. On top of that, decree 2-24-921 requires a cloud provider qualified by the national authority for sensitive systems (level 1) and sensitive data (level 2); level 2 demands that processing and storage, and even management and supervision of the service, happen exclusively from and on Moroccan territory. BANKING: conditional, not closed. Bank Al-Maghrib's cloud directive 4/W/2022 requires the bank's prior agreement before outsourcing any significant function to the cloud, and requires the institution to control which countries are eligible to host its data, but we found no rule in the central bank's own compendium forbidding hosting abroad. PAYMENTS: same as banking, plus a ten-year register of payment transactions. TELECOMS AND ONLINE PLATFORMS: no localisation rule found, but network operators, internet access providers, digital service providers and internet platform publishers must retain connection data and logs for one year and follow the national authority's directives; any of them designated vital infrastructure falls under the localisation rule. HEALTH: health data is sensitive data, so processing needs the privacy regulator's prior authorisation and a transfer outside the approved list needs a separate permission; public hospitals are public entities and therefore inside the localisation rule. INSURANCE AND SECURITIES: no localisation rule located on the regulators' own sites, so treat as the national rule. EDUCATION, GAMING AND MAPPING: no official rule located, recorded as unconfirmed rather than as an absence.

Law 09-08 article 43 allows transfer only to a state ensuring a sufficient level of protection of privacy and fundamental rights, and gives the CNDP the job of listing those states. Article 44 sets out the exceptions: explicit consent of the person, protection of life, public interest, exercise or defence of legal claims, performance of a contract, medical treatment, an international agreement to which Morocco is party, or an express CNDP authorisation granted where sufficient guarantees are shown. In practice a bank or a software company running on United States cloud infrastructure needs the authorisation route, because no United States mechanism appears on the 2015 list. Two quirks in that list: Croatia was never added after it joined the European Union, and the United Kingdom is still on it years after leaving. Both are one deliberation away from changing.

This is the honest picture. The CNDP is constituted and busy on registration, authorisations, model forms and awareness partnerships, but we found no published penalty decisions against named organisations on its own site, and the law gives it ordering powers (blocking, erasure, a temporary or permanent ban on processing) rather than a power to fine. Fines and prison sentences under law 09-08 come from the criminal courts on referral. The DGSSI is visibly operational: its published list of qualified security-audit providers carries qualification decisions running to 2029, and in June 2025 it published the results of its investigation into a leak, attributing it to a notaries' platform rather than the land registry agency. Its cloud qualification regime, however, has qualified nobody yet. Overall this is a waking regime rather than an active one: the machinery exists and is moving, but public enforcement output is thin.

Law 09-08 article 3 sets the ceiling in general terms, with no fixed number of months, so the practical answer is a documented retention schedule per purpose. Law 05-20 article 26 sets the one-year floor for technical data and expressly says it can be changed by regulation, which makes it a dormant switch. Where a floor and the ceiling collide, the floor normally wins because keeping the data becomes a legal obligation, but the safe practice is to segregate the legally required records and delete everything else on schedule. We could not open the tax administration's own site to confirm the general commercial and tax retention periods, so those are not asserted here.

Law 05-20 article 8 requires each public entity to declare an incident affecting the security or operation of its information systems as soon as it becomes aware of it, and to supply further information on request without delay. Article 14 extends this to vital infrastructures and article 30 to operators, access providers, cyber security providers, digital service providers and internet platform publishers, who must also warn their own customers about vulnerabilities affecting them. Failing to declare is punishable by a fine of 100,000 to 200,000 dirhams, roughly 11,000 to 22,000 United States dollars. Because the privacy law has no breach-notification article, in practice the duty to tell customers usually comes from contracts, from foreign law such as Europe's, or from the sector regulator, not from Moroccan privacy law.

On the criminal point: law 09-08 punishes running a file without the required declaration or authorisation with a fine of 10,000 to 100,000 dirhams, roughly 1,100 to 11,000 United States dollars; unlawful international transfer with three months to one year in prison and 20,000 to 200,000 dirhams; and processing sensitive data without consent with three months to one year and 50,000 to 300,000 dirhams, about 33,000 dollars. Article 64 doubles the fines for legal persons and allows confiscation or closure of the premises, and article 65 doubles everything again on a repeat offence. On the vital-infrastructure point: law 05-20 article 16 says the list of these infrastructures must be kept secret and refreshed at least every two years, and article 18 says the list of their sensitive systems is secret too. On the cloud point: decree 2-24-921 article 5 requires, for level 2, Moroccan majority ownership, Moroccan-national operating staff, and a ban on any foreign group company accessing the data, with an exceptional waiver possible only with the prior agreement of the head of government.

Dormant switches to watch, each of which can move without consultation. One: the regulator can rewrite the approved-country list by a single deliberation, adding the United States or removing the United Kingdom. Two: any company can be designated vital infrastructure by the ministry coordinating its sector, secretly, which pulls it into the localisation regime. Three: the head of government can waive the Moroccan-ownership requirement for a cloud provider case by case, which is the only realistic path for a global provider. Four: the one-year retention period for technical data can be changed by regulation. Five: the national cyber authority can impose sector-specific security rules on vital infrastructures at their own cost. The decree entered into force when the qualification standard was published in the official gazette issue dated 21 August 2025, and the twenty-four month transition runs from that date.