Legal update · Morocco · Data protection
For a long time, Moroccan companies mainly knew the Commission Nationale de contrôle de la protection des données à caractère personnel (CNDP) as a compliance counterpart: filing declarations, seeking authorisations, receiving guidance. A recent interview published by Médias24 captures the shift under way: the Commission has “closed the awareness-raising phase of Law 09-08 to enter the enforcement phase”, now playing the role of “examiner” where it long played that of “teacher”. This shift does not stem from a reform of Law No. 09-08 on the protection of individuals with regard to the processing of personal data, but from the more active use of inspection and sanctioning powers the law has given the CNDP since its adoption in 2009.
A change of posture documented on the ground
According to the account reported by Médias24, the Commission carried out, over its early years of operation, several hundred inspection operations and referred around a dozen cases to the courts, a minority of which were tried. The real turning point is that, in early 2025, the CNDP moved into a targeted inspection phase, with sector campaigns and strict deadlines rather than mere recommendations; major data controllers have already received formal warnings, and investigations are under way. In practice, the Commission now expects formal internal and external audits: having a handful of protection tools is no longer enough – companies must prove they are used daily and produce a real effect, with activity logs on files, data-leak prevention systems and backups of sensitive data among the evidence sought.
This shift in practice comes alongside growing attention to artificial intelligence. In a notice dated 18 March 2025, the CNDP recalled that any AI system relying on personal data must comply with the principles of Law 09-08 – transparency, fairness, defined purpose, proportionality, security, and the right of access and redress – with particular emphasis on citizens’ ability to challenge an automated decision, which requires traceability and readability of processing. The Commission stated it had carried out an international benchmark and consulted foreign authorities, and plans to hear experts, professional organisations and civil society with a view to a framework resolution on AI.
Broad inspection powers, long provided for in law
Law 09-08 grants the CNDP prerogatives that go well beyond registering declarations. Its agents, duly commissioned by the Commission’s chairperson, hold investigation and inquiry powers allowing them to access data under processing, to require direct access to the premises where processing is carried out, and to gather and seize any information and documents necessary to carry out their supervisory mission.
Beyond investigation, the Commission may order that documents needed to examine complaints be submitted to it within a set time frame; order or carry out the corrections necessary for the fair keeping of data; and, more drastically, order the locking, erasure or destruction of data, or prohibit, temporarily or permanently, a personal data processing operation – including data hosted on servers located on national territory. The exercise of the powers to compel the production of documents and to order the locking, erasure, destruction or prohibition of processing remains subject to a disciplinary procedure guaranteeing the rights of the defence, in particular the adversarial principle.
The Commission may also immediately withdraw a declaration receipt or an authorisation where it appears that a processing operation undermines public safety or order, or is contrary to morality and public decency.
A sanctions regime that goes beyond administrative fines
The enforcement side of Law 09-08 is dense and not limited to symbolic fines. Carrying out a processing operation without the required declaration or authorisation exposes the controller to a fine of MAD 10,000 to 100,000, as does continuing processing despite the withdrawal of the receipt or authorisation. Refusing to grant rights of access, rectification or objection is punishable by a fine of MAD 20,000 to 200,000 per offence.
Several offences carry both imprisonment and a fine: fraudulent or unfair data collection, purpose diversion, retention beyond the authorised period, failure to implement security measures, unlawful data transfers abroad in breach of Articles 43 and 44, or processing sensitive data (racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data) without the data subject’s express consent – this last case carrying up to two years’ imprisonment and a MAD 300,000 fine. Obstructing the CNDP’s supervisory missions, refusing to admit its inspectors, or refusing to provide requested documents is a standalone offence punishable by three to six months’ imprisonment and a fine of MAD 10,000 to 50,000; refusing to comply with the Commission’s decisions is a separate standalone offence, punishable by three months’ to one year’s imprisonment and a fine of MAD 10,000 to 100,000. Where the offender is a legal entity, fines are doubled and additional sanctions are possible, such as partial confiscation of assets or closure of the establishment where the offence was committed; in case of repeat offences, all sanctions under the law are themselves doubled.
Finally, beyond its own agents, the CNDP may forward the reports recording an offence to the public prosecutor within five days of the investigation – a direct gateway to criminal proceedings.
What this means in practice for businesses
For a data controller established or operating in Morocco, this change of posture has immediate practical implications. First, documentary consistency: declarations and authorisations filed with the Commission must accurately reflect the processing actually carried out, its purposes, the categories of data and recipients, and any transfers envisaged abroad – any change must be reported to the Commission without delay. Second, proof of the actual effectiveness of security measures and data-processing agreements: it is no longer a box-ticking exercise, but a matter of documenting real-world use of protection tools, since their inadequacy is itself a standalone offence. Third, the organisational capacity to respond to an inspection or audit: effective access to premises and data must be arrangeable without obstruction, failing which a specific penalty for obstruction applies.
Processing of sensitive data or health data, the deployment of direct marketing tools, any project to transfer data outside Morocco, and the rollout of AI systems using personal data, deserve particular attention: these are the areas where the sanctions regime is most severe, and where the CNDP is now signalling more precise compliance expectations.
This analysis is provided for information only and does not constitute personalised legal advice. As each situation must be assessed on its own merits depending on the nature of the data processing involved, the IP-IT – Data Protection & Cybersecurity teams at UGGC Africa are available to help build, together with you, the compliance strategy best suited to your organisation and to Moroccan law.
Key takeaways
What is actually changing in the CNDP’s approach?
The Commission is moving from a pedagogical approach to a targeted enforcement phase, with sector campaigns, strict deadlines, formal warnings, and audits that require concrete proof that protection measures are effective.
What inspection powers does the CNDP hold?
Investigation and inquiry powers (access to premises and data, seizure of documents), the power to order corrections, and the power to order the locking, erasure or destruction of data or to prohibit processing, subject to an adversarial procedure for the most severe measures.
What are the main sanctions at stake?
Fines ranging from MAD 10,000 to 300,000 depending on the offence, which can be doubled for a legal entity or in case of repeat offences, together with imprisonment of three months to two years for the most serious offences (sensitive data, fraudulent collection, unlawful transfer abroad).
What is the practical takeaway for a legal department?
Check that filings and authorisations on record match actual processing activities, document with concrete evidence that security measures are effective, map AI uses involving personal data, and prepare the internal organisation in advance to respond to a CNDP inspection or audit.
Preparing for a CNDP inspection or audit? Contact the UGGC Africa team