Law 09-08

Data protection is a key regulatory requirement for organizations operating in Morocco.

The processing of personal data is governed by Law 09-08 relating to the protection of individuals with regard to the processing of personal data, under the supervision of the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel).

Organizations collecting or processing personal data must comply with several obligations, including:

• notification or authorization of data processing activities to the CNDP
• implementation of appropriate security measures to protect personal data
• information of data subjects regarding their rights
• compliance with rules governing international data transfers

Ensuring compliance with these requirements has become a major governance and risk management topic for many organizations.

HACA Partners Consulting Casablanca assists organizations in structuring and strengthening their data protection frameworks in accordance with Moroccan regulatory requirements.

Our services include:

• Data protection compliance assessments and gap analysis
• Data processing mapping and governance framework design
• Assistance with CNDP notification and authorization procedures
• Implementation of data protection policies and internal procedures
• Support for international data transfer authorization requests
• Training and awareness programs for staff and management

Our approach combines regulatory expertise and operational pragmatism to help organizations ensure sustainable compliance with Moroccan data protection requirements.