CNDP authorization is mandatory in Morocco whenever personal data processing presents a higher risk to individuals’ rights, particularly when sensitive data or international transfers are involved.
Processing must not begin until authorization is formally granted by the CNDP.
Table of Contents
General principle under Law 09-08
Law 09-08 establishes a preventive control system.
Certain categories of processing are considered sufficiently sensitive to require prior authorization, not just notification.
The assessment is based on:
- the nature of the data
- the purpose of the processing
- the potential impact on individuals
Situations where CNDP authorization is required
Authorization is generally mandatory for processing involving:
- sensitive personal data (health, biometric, genetic data)
- political, religious, or trade-union information
- criminal records or security measures
- national identity numbers
- interconnection of databases
- use of data for purposes different from those initially declared
- transfers of personal data outside Morocco
Each case must be reviewed individually.
International data transfers
In practice, most transfers of personal data outside Morocco require CNDP authorization, even when contractual safeguards exist.
This applies to:
- cloud hosting abroad
- shared group databases
- outsourced IT or HR services
- foreign headquarters accessing Moroccan data
Consent alone is rarely sufficient.
High-risk business activities
CNDP authorization is frequently required in sectors such as:
- healthcare and medical services
- call centers and call recording
- HR platforms and payroll outsourcing
- fintech and digital platforms
- large-scale customer databases
Failure to obtain authorization in these sectors attracts increased scrutiny.
Consequences of processing without authorization
Processing without required authorization may result in:
- formal warnings from the CNDP
- suspension or prohibition of processing
- criminal liability for company officers
- referral to judicial authorities
- reputational and contractual damage
Authorization obtained after the fact does not regularize past violations.
Frequently Asked Questions
Does company size affect the authorization requirement?
Do foreign companies need authorization?
Is authorization permanent?
Final note
CNDP authorization is a preventive legal safeguard, not an administrative formality.
Understanding when it is mandatory is essential for lawful and secure operations in Morocco.
Brahim Rami | Member of institute of chartered accountants in Morocco
He is a CPA and tax advisor, founder of NeoExpertise.net, a Legal and Tax firm helping foreign companies with business setup, due diligence, payroll, and tax compliance in Morocco and Africa.
