Morocco

Law 09-08, article 2(2), covers two cases. It covers a company set up on Moroccan territory that uses people's data. It also covers a company not set up there that uses equipment located on Moroccan territory, whether automated or not. Data passing straight through does not count. Article 2(3) then makes that company tell the CNDP who its representative in Morocco is. That representative steps into the company's rights and duties under the law. The company stays liable as well. National defence and state security work is left out completely. Criminal-justice files are covered only by the law that creates them. Note what triggers the rule. It is equipment in Morocco, not the 'targeting' test used in Europe and India. So a fully offshore service with Moroccan users sits in a grey area, and the regulator has not settled it publicly.

Industry by industry, checked on 18 August 2026. GOVERNMENT AND VITAL INFRASTRUCTURE. Closed. Law 05-20 article 11 says sensitive data must be hosted only on national territory. Article 14 extends the whole public-body chapter to vital infrastructures. On top of that, decree 2-24-921 requires a cloud provider qualified by the national authority. Level 1 covers sensitive systems and level 2 covers sensitive data. Level 2 demands that the data is used and stored only in Morocco. Even managing and supervising the service must happen only from Moroccan territory. BANKING. Paperwork works here. Bank Al-Maghrib's cloud directive 4/W/2022 requires the bank's prior agreement before outsourcing any significant function to the cloud. The bank must also control which countries may host its data. We found no rule in the central bank's own compendium forbidding hosting abroad. PAYMENTS. Same as banking, plus a ten-year register of payment transactions. TELECOMS AND ONLINE PLATFORMS. We found no rule that data must stay in Morocco. But network operators, internet access providers, digital service providers and internet platform publishers must keep connection data and logs for one year. They must also follow the national authority's directives. Any of them named as vital infrastructure falls under the must-stay-in-Morocco rule. HEALTH. Health data counts as sensitive data. So you need the privacy regulator's permission before you use it. You need a separate permission to send it to a country not on the approved list. Public hospitals are public bodies, so they must keep their sensitive data in Morocco. INSURANCE AND SECURITIES. We found no storage-location rule on the regulators' own sites, so the national rule applies. EDUCATION, GAMING AND MAPPING. We found no official rule. We record that as unconfirmed, not as proof that none exists.

Law 09-08 article 43 allows a transfer only to a state that gives enough protection for privacy and basic rights. It gives the CNDP the job of listing those states. Article 44 sets out the exceptions. They are the person's explicit consent, protecting life, public interest, bringing or defending legal claims, performing a contract, medical treatment, an international agreement Morocco is party to, or an express CNDP permission where you show enough safeguards. So a bank or a software company running on United States cloud infrastructure needs the permission route. No United States arrangement appears on the 2015 list. Two oddities in that list. Croatia was never added after it joined the European Union. The United Kingdom is still on it years after leaving. Either could change with a single decision by the regulator.

Here is the honest answer. The CNDP is set up and busy with registrations, permissions, model forms and awareness partnerships. But we found no published penalty decisions against named organisations on its own site. The law gives it ordering powers rather than a power to fine. It can order blocking, erasure, and a temporary or permanent ban on using the data. Fines and prison sentences under law 09-08 come from the criminal courts, on referral. The DGSSI is clearly working. Its published list of qualified security-audit providers carries qualification decisions running to 2029. It updated its audit qualification standard in November 2025. In June 2025 it published the results of its investigation into a leak, blaming a notaries' platform rather than the land registry agency. Its cloud qualification scheme, though, has qualified nobody yet. Overall the machinery exists and is moving, but public enforcement output is thin.

Law 09-08 article 3 sets the maximum in general terms, with no fixed number of months. So you need a written keep-it schedule for each purpose. Law 05-20 article 26 sets the one-year minimum for technical data. It says expressly that the period can be changed by regulation, so it can move without a new law. Where a minimum and the maximum clash, the minimum normally wins, because keeping the data becomes a legal duty. The safe approach is to separate the legally required records and delete everything else on schedule. We could not open the tax administration's own site to confirm the general commercial and tax keep-it periods, so we do not state them here.

Law 05-20 article 8 makes each public body report an incident affecting the security or running of its information systems as soon as it knows. It must also supply more information on request without delay. Article 14 extends this to vital infrastructures. Article 30 extends it to operators, access providers, cyber security providers, digital service providers and internet platform publishers. Those must also warn their own customers about weaknesses affecting them. Failing to report is punished by a fine of 100,000 to 200,000 dirhams, roughly 11,000 to 22,000 United States dollars. The privacy law has no breach-reporting article. So the duty to tell customers usually comes from your contracts, from foreign law such as Europe's, or from your industry regulator. It does not come from Moroccan privacy law.

On the criminal point. Law 09-08 punishes running a file without the required declaration or permission. The fine is 10,000 to 100,000 dirhams, roughly 1,100 to 11,000 United States dollars. Unlawful international transfer carries three months to one year in prison and 20,000 to 200,000 dirhams. Using sensitive data without consent carries three months to one year and 50,000 to 300,000 dirhams, about 33,000 US dollars. Article 64 doubles the fines for companies and allows confiscation or closure of the premises. Article 65 doubles everything again on a repeat offence. On the vital-infrastructure point. Law 05-20 article 16 says the list of these infrastructures must be kept secret and refreshed at least every two years. Article 18 says the list of their sensitive systems is secret too. On the cloud point. Decree 2-24-921 article 5 requires, for level 2, Moroccan majority ownership and Moroccan-national operating staff. It also bans any foreign group company from accessing the data. A waiver is possible only with the prior agreement of the head of government.

Powers already in someone's hand. Each can move with no consultation. One: the regulator can rewrite the approved-country list with a single decision. It could add the United States or remove the United Kingdom. Two: any company can be named as vital infrastructure by the ministry that covers its industry, in secret. That pulls it under the must-stay-in-Morocco rules. Three: the head of government can waive the Moroccan-ownership requirement for a cloud provider, case by case. That is the only realistic path for a global provider. Four: the one-year keep-it period for technical data can be changed by regulation. Five: the national cyber authority can impose industry-specific security rules on vital infrastructures, at their own cost. The decree came into force when the qualification standard was published in the official gazette issue dated 21 August 2025. The twenty-four month transition runs from that date.