MOROCCO Law and Practice Contributed by: Mehdi Kettani, Adil Mouline, Othman Sentissi and Kawtar Mouti, DLA Piper Casablanca
4.4 Data Protection in M&A In Morocco, personal data processing in M&A trans - actions is subject to the general obligations of Law No 09-08, meaning that any review or transfer of per - sonal data requires a lawful basis, transparency and adequate security measures. During due diligence, sellers may only disclose personal data that is neces - sary, proportionate and relevant to the transaction, and must ensure confidentiality through controlled access and contractual safeguards. If a transaction results in a change of data controller, the new data controller is required to notify the data subjects and the CNDP of said change. Upon notifica - tion, the CNDP may require the new data controller to file new declarations and/or authorisation requests. In theory, personal data transfers to countries speci - fied by the data protection authority (see list below) can be completed freely, whereas transfers to any other countries are subject to obtaining authorisation from the same authority. However, in practice, the CNDP requires prior authori - sation to be obtained for data transfers to all coun - tries, with the authorisation being more easily granted if the data is transferred to one of the countries speci - fied in the CNDP’s list. The transfer of personal data abroad requires an ade - quate level of protection for the privacy and funda - mental rights and freedoms of individuals, particularly through standard contractual clauses governing the transfer. 5. International Considerations 5.1 Restrictions on International Data Transfers
The data protection authority’s list of countries is as follows: Austria, Belgium, Bulgaria, Canada, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slo - vakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. 5.2 Government Notifications and Approvals Data controllers are required to obtain a separate transfer authorisation for each notified or authorised processing by the CNDP. 5.3 Data Localisation Requirements Data localisation requirements in Morocco are provid - ed by the cybersecurity regulations and apply exclu - sively to sensitive information systems owned by a public entity or a critical infrastructure. 5.4 Blocking Statutes There are no blocking statutes in Morocco. 5.5 Recent Developments Morocco is continuously working towards joining the list of countries recognised by the EU as providing an adequate level of data protection, but it has not yet obtained a European Commission adequacy decision under the GDPR.
333 CHAMBERS.COM
Powered by FlippingBook