MOROCCO Trends and Developments Contributed by: Mehdi Kettani, Adil Mouline, Othman Sentissi and Kawtar Mouti, DLA Piper Casablanca
DLA Piper Casablanca CFC Cube Tower Casablanca Finance City Casablanca Morocco Tel: +212 520 427 827 Email: sara.essouar@dlapiper.com Web: www.dlapiper.com
Introduction Personal data protection in Morocco is governed pri - marily by Law No 09-08 relating to the protection of individuals with regard to the processing of personal data. This law sets the main rules that apply when personal data is collected, stored, used, shared, or combined with other data. In everyday terms, it covers everything from keeping customer contact details, to running a website that remembers user preferences, to managing employee records, to handling medical files. The law is complemented by its implementing decree, Decree No 2-09-165 of 21 May 2009, which clarifies how the law is put into practice and how cer - tain formalities work. Alongside these two texts, the National Commission for the Control of Personal Data Protection ( Commission Nationale de Contrôle de Pro- tection des Données à Caractère Personnel – CNDP) plays a central role. It is not only an institution that receives notifications and authorisation requests, it is also a body that issues decisions. These decisions translate broad legal principles into practical rules for specific, common situations and, in several cases, they set out simplified notification processes for a The practical decisions made by the CNDP matter because many of the questions raised by data protec - tion are not abstract. People do not ask about defi - nitions in a law book, they ask what a website may place on their phone, what a company may keep in a visitor log, whether a clinic may use a tool to follow up with patients, or how long a camera recording may be stored. The CNDP decisions answer these ques - defined type of processing. Why CNDP Decisions Matter
tions by giving a model that data controllers can fol - low, with clear boundaries. They typically specify the purpose that justifies the processing, the categories of people concerned, and the types of data that may be collected. The five decisions issued in 2025 During 2025, the CNDP issued five decisions on differ - ent subjects, all dated 28 November 2025. Although the topics look diverse, they share a common pur - pose: to set practical compliance routes for common processing operations that affect a large number of people. The five decisions cover cookies stored on a user device, the management of newsletters, pro - cessing for patient follow-up, video surveillance inside healthcare establishments, and the collection of per - sonal data in the context of access control to private professional premises. Read together, they show a regulator that is focused on situations that citizens encounter daily, and on the points where small design choices, such as what a form asks or for how long data is kept, can make a major difference for privacy. Cookies The decision on cookies addresses a reality of modern browsing: many websites store small files on a device to remember preferences, measure their audience, or support certain features. The CNDP model treats this as personal data processing when cookies relate to an identifiable person. It then limits the purposes for which the simplified declaration model can be used. Typical purposes that fit within the model include audi - ence measurement and navigation statistics, person - alisation of content or services based on previous
335 CHAMBERS.COM
Powered by FlippingBook