Complying with the CNDP: Your Website Compliance Checklist

Making a website compliant with data protection regulations in Morocco can seem abstract. In practice, it comes down to a handful of concrete actions: informing users, obtaining valid consent, declaring processing activities to the CNDP, and securing data. Here is a checklist to help you move forward step by step.

The CNDP: its role

The National Commission for the Control of Personal Data (CNDP) is the authority responsible for ensuring compliance with Law 09-08. It receives processing declarations, issues authorizations, maintains the public register of processing activities, and can be approached by any individual who feels aggrieved.

In concrete terms, the CNDP is both the portal where you declare your processing activities and the authority empowered to audit you. Compliance means anticipating what they would check: your forms, your legal notices, and your security measures.

Forms and data collection

Every form on your site — contact, quote request, newsletter, account creation — collects personal data. First and foremost, ask yourself whether you truly need every single field. An unnecessary field constitutes an additional risk.

At the time of collection, the individual must be informed of the identity of the data controller and the purposes for which the data is collected. In short: specify next to the form who processes the data and for what purpose, using clear language.

If you rely on consent, it must be free, specific, and informed: no pre-checked boxes or vague wording. A link to your privacy policy must be accessible directly while the individual is filling out the form.

Cookies and trackers

Law 09-08 does not dedicate a specific article to cookies, but trackers that identify a person fall under the same principles: prior information and consent. Prudence therefore consists of:

• informing visitors about the trackers deployed and their purpose;
• obtaining consent for non-essential trackers (statistics, advertising);
• allowing refusal as easily as acceptance.

A clear cookie banner offering a real choice is today the expected standard, even in Morocco.

Legal notices and privacy policy

Your site must publish two distinct documents:

• Legal notices: the publisher’s identity, legal form, and contact details. These inform the visitor about the entity responsible for the site.
• Privacy policy: what data is collected, why, how long it is retained, who has access to it, and how to exercise your rights (access, rectification, opposition).

These documents are not mere formalities: they materialize the information owed to individuals and constitute the first elements checked by the CNDP.

Declarations and authorizations

In principle, all processing of personal data must be the subject of a prior declaration to the CNDP, unless it is excluded from the scope of the law, exempted from declaration, or subject to the authorization regime. The CNDP then issues a declaration receipt.

Certain processing activities require a prior authorization: this applies to sensitive data (ethnic origin, political opinions, religious beliefs, health), the use of data for purposes other than those for which they were initially collected, genetic data, criminal offenses and convictions, national identity card numbers, or the interconnection of files.

The procedure involves forms downloadable from the CNDP website, accompanied by a document authorizing the signatory to commit the legal entity.

Summary checklist

1. Take an inventory: list all forms and trackers on the site.
2. Reduce collection: remove unnecessary fields and trackers.
3. Inform: add an information notice to each form.
4. Consent: implement a cookie banner offering a real choice.
5. Draft documents: legal notices and privacy policy.
6. Declare: submit the declaration (or authorization request) to the CNDP.
7. Secure: enable two-factor authentication and restrict access by IP address in your client area.
8. Document: keep a record of each step, for your organization and in case of an audit.

If your site processes online payments, the PCI DSS standard applies in addition: see Online payments: what the PCI DSS standard requires.

Compliance also relies on secure hosting. To strengthen the security of your access, consult the help articles Enforce two-factor authentication and limit IP addresses and Enable two-factor authentication. For the complete legal framework, read Law 09-08: protecting your customers' personal data.

A compliant site is also a site that stays online and backs up its data. Discover Atlas Hoster's web hosting plan. For the choice of data localization, see Hosting data in Morocco: what it really changes.

Retention period and minimization

The law requires that data be retained only for as long as necessary for the stated purposes. In practice: define a duration for each type of data, and remove what is no longer useful.

• Contact form messages are retained for the duration of handling the request.
• Customer account data is retained as long as the account is active, then deleted or anonymized.
• Prospecting data is retained as long as the individual has not withdrawn their consent.

Minimization goes hand in hand: collect only what you need, and do not keep what you no longer use. This is both a legal requirement and a risk reduction in the event of a security incident.

Document these durations in your privacy policy: this is what the CNDP checks and what your customers expect from a serious site.

FAQ

Do I need to declare a simple contact form?

Yes. Collecting a name and email address constitutes a processing of personal data, subject in principle to prior declaration to the CNDP.

Are cookies explicitly governed by Law 09-08?

Not by a dedicated article, but identifying trackers fall under the general principles of the law: information and consent. A banner with a real choice is the recommended practice.

What should I do if I don't know where to start?

Start with an inventory of forms and trackers, then draft the legal notices and privacy policy. The declaration to the CNDP can come second, once the existing setup is documented.