Under Moroccan law, personal data includes any information that directly or indirectly identifies a natural person.
If your business collects, stores, uses, or transfers such information in Morocco, it is subject to Law 09-08 and oversight by the CNDP.
This applies to Moroccan and foreign companies alike.
Table of Contents
Legal definition of personal data in Morocco
Law 09-08 defines personal data as any information, regardless of its form, relating to an identified or identifiable individual.
An individual is considered identifiable when they can be identified:
- directly (by name or ID), or indirectly (through a combination of data points)
This definition is intentionally broad.
Examples of personal data under Law 09-08
In practice, personal data includes, but is not limited to:
- full name
- postal address
- email address
- phone number
- national ID or passport number
- bank or payment details
- employee records
- customer files
- IP addresses linked to an individual
- user account information
If data can be linked to a person, it is personal data.
What is considered sensitive personal data?
Certain categories of data are treated as sensitive and are subject to stricter rules.
Sensitive personal data includes:
- health and medical information
- biometric and genetic data
- political opinions
- religious or philosophical beliefs
- trade union membership
- data relating to criminal convictions or security measures
Processing sensitive data usually requires prior CNDP authorization.
Personal data vs business data
Not all data used by companies qualifies as personal data.
Not personal data:
- anonymized statistical data
- information relating solely to legal entities
- data that cannot identify a natural person
However, data relating to a company contact person (name, email, phone) is still considered personal data.
Employee and HR data
Employee data is fully covered by Law 09-08.
This includes:
- payroll information
- attendance records
- performance evaluations
- medical certificates
- disciplinary records
Employers must comply with CNDP requirements for HR processing.
Online and digital personal data
Websites and digital platforms process personal data when they:
- use contact or registration forms
- manage user accounts
- collect IP addresses linked to individuals
- use tracking tools involving identifiable users
Digital activity does not exempt a business from compliance.
Why identifying personal data correctly matters
Incorrectly identifying personal data may lead to:
- failure to file a CNDP declaration
- failure to obtain required CNDP authorization
- exposure to sanctions under Law 09-08
- operational and reputational risks
Proper classification is the first step toward CNDP compliance.
Common mistakes made by businesses
Businesses often assume that:
- only large companies are concerned
- basic contact data is not personal data
- employee data is internal and exempt
- online data is outside Moroccan law
These assumptions are incorrect under Law 09-08.
Frequently Asked Questions
Is an email address considered personal data?
Yes, if it identifies a natural person.
Is a company email address personal data?
Yes, if it relates to an identifiable individual.
Are IP addresses personal data?
Yes, when they can be linked to a person.
Is anonymized data personal data?
No, if identification is no longer possible.
Key takeaway
Moroccan law adopts a broad definition of personal data.
If your business processes information linked to individuals, Law 09-08 applies, and CNDP compliance must be assessed.
Understanding what counts as personal data is essential before filing any CNDP declaration or authorization.
Brahim Rami | Member of institute of chartered accountants in Morocco
He is a CPA and tax advisor, founder of NeoExpertise.net, a Legal and Tax firm helping foreign companies with business setup, due diligence, payroll, and tax compliance in Morocco and Africa.
