In Morocco, CNDP declaration and CNDP authorization are two distinct legal procedures under Law 09-08, and choosing the wrong one can place a company in non-compliance.
A declaration applies to standard data processing, while authorization is mandatory for high-risk or sensitive processing and must be obtained before any activity begins.
Both procedures are supervised by the CNDP.
Table of Contents
Legal framework
The distinction between declaration and authorization is established by Law 09-08 on the protection of individuals with regard to the processing of personal data.
The law requires companies to assess the nature, purpose, and risk level of their data processing before determining the applicable procedure.
What is a CNDP declaration?
A CNDP declaration is a formal notification filed with the CNDP for standard personal data processing activities.
It typically applies to:
- customer management data
- supplier and contact databases
- basic HR and payroll data
- commercial and administrative records
The declaration confirms that the processing complies with Law 09-08 and that appropriate security measures are in place.
What is CNDP authorization?
CNDP authorization is a prior legal approval required before starting certain types of data processing.
Unlike a declaration, authorization:
- involves a detailed legal review by the CNDP
- may be granted, refused, or conditioned
- must be obtained before any processing begins
Processing without authorization, when required, is considered a serious violation.
Key legal differences between declaration and authorization
| CNDP Declaration | CNDP Authorization |
|---|---|
| Standard processing | High-risk or sensitive processing |
| Notification-based | Prior approval required |
| Faster procedure | Longer and more detailed review |
| Lower legal risk | Higher scrutiny and sanctions |
Filing a declaration instead of requesting authorization does not regularize the situation.
Common compliance mistakes
Businesses frequently make the following errors:
- assuming declaration is always sufficient
- underestimating what qualifies as sensitive data
- starting processing before authorization is granted
- ignoring international data transfer rules
These mistakes often lead to CNDP warnings or enforcement actions.
Why proper qualification matters
Correctly determining whether a declaration or authorization is required:
- protects the company from sanctions
- avoids operational disruption
- strengthens credibility with partners and regulators
Legal assessment is essential, particularly for foreign companies and digital businesses.
Frequently Asked Questions
Can a company file both a declaration and an authorization?
Is declaration enough for websites?
It depends on the type of data collected and how it is used.
Can authorization be obtained after processing starts?
Key takeaway
Declaration and authorization are not interchangeable.
Choosing the correct procedure is a legal obligation under Moroccan data protection law.
Brahim Rami | Member of institute of chartered accountants in Morocco
He is a CPA and tax advisor, founder of NeoExpertise.net, a Legal and Tax firm helping foreign companies with business setup, due diligence, payroll, and tax compliance in Morocco and Africa.
