MOROCCO Law and Practice Contributed by: Mehdi Kettani, Adil Mouline, Othman Sentissi and Kawtar Mouti, DLA Piper Casablanca
Cybersecurity regulations define critical infrastruc - tures as installations, structures and systems that are essential to the maintenance of the vital functions of society, health, safety, security and economic or social well-being, where damage, unavailability or destruc - tion of this infrastructure could result in the failure of these vital functions. The same regulations define public entities as administrations, local authorities, state-owned enterprises and any other legal entity governed by public law. 3.2 Interaction of Data Regulation and Data Protection Moroccan regulations do not specify how mixed data - sets that include personal data and are also subject to the cybersecurity framework should interact. Con - sequently, the obligations apply cumulatively. Where personal data is involved, Law No 09‑08 governs the legal basis and confidentiality requirements for pro - cessing. In parallel, Law No 05‑20 imposes security and resilience measures on in‑scope entities’ infor - mation systems, irrespective of whether the data is personal or non‑personal. 3.3 Rights and Obligations Under Applicable Data Regulation This is not applicable in Morocco. 3.4 Regulators and Enforcement The General Directorate of Information Systems Secu - rity ( La Direction Générale de la Sécurité des Sys- tèmes d’Information – DGSSI) is Morocco’s national cybersecurity authority, operating under the adminis - tration of National Defence. It is responsible for imple - menting the framework established by Law No 05‑20 on cybersecurity, including defining and overseeing organisational and technical measures to strengthen the security and resilience of information systems used by public entities and critical infrastructures.
circumstances, the deployment of cookies constitutes processing of personal data and becomes subject to the obligations of Law No 09-08, including the require - ment to file a notification or obtain prior authorisation from the CNDP, depending on the type and sensitivity of the data being processed. In this context, that data protection authority has issued Decision No D-939- 2025 which provides for the possibility of filing a sim - plified form for specific processing involving cookies. 4.2 Personalised Advertising and Other Online Marketing Practices Direct marketing by means of automatic calling machines, fax machines, electronic mail or similar technologies is strictly regulated in Morocco. The law expressly prohibits the use of such communica - tion channels when they rely on the contact details of a natural person who has not given their prior and explicit consent to receive promotional messages. Any unsolicited marketing communication using these technologies is therefore unlawful, regardless of the nature of the product or service being promoted. 4.3 Employment Privacy Law Employers, in the same manner as any other data controller, are required to notify and/or obtain prior authorisation from the CNDP for each purpose for which they process the personal data of their employ - ees. The processing of employees’ personal data spe - cifically for HR management purposes is subject to obtaining authorisation under Decision No 298-AU- 2014 of the data protection authority. The decision provides a list of data that may be processed by employers for HR management purposes under a sim - plified authorisation request. If an employer processes any other data, for the same purpose or any other purpose, they are required to file a separate notifica - tion or authorisation request. Employers are also required to obtain employees’ consent for the processing of their personal data and to inform them of the characteristics of the data pro - cessing, in accordance with the requirements set out in the applicable Moroccan regulations.
4. Sectoral Topics 4.1 Use of Cookies
Cookies and similar tracking technologies are regu - lated only when they collect or contain personal data, such as an IP address or any identifier capable of linking the data to an identifiable individual. In such
332 CHAMBERS.COM
Powered by FlippingBook