Law 09-08: Protecting Your Customers' Personal Data

If your site collects a name, email address, phone number, or IP address, you are processing personal data. In Morocco, this processing is governed by Law 09-08, in force since February 23, 2009, and overseen by the National Commission for the Control of Personal Data (CNDP). This guide explains what the law expects from you, without jargon, and what it concretely implies for your forms and hosting.

Law 09-08 and your personal data: what it's about

Law 09-08 protects individuals with regard to the processing of their personal data. Personal data is any information concerning an identified or identifiable person: first and last name, postal or electronic address, phone number, credit card number, photo, fingerprint, or computer IP address.

Three concepts appear repeatedly and deserve to be defined:

• The data controller: the natural or legal person who determines the purposes and means of the processing. For a business website, this is typically your company.
• The processor: the entity that processes data on behalf of the controller. Your hosting provider, which stores data without deciding its use, falls into this category.
• Sensitive data: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, or data concerning health, including genetic data. These are subject to a stricter regime.

Who is concerned

The law applies to any organization, public or private, that implements a processing of personal data in Morocco. Regardless of size: a SME managing a contact form or prospect file is just as concerned as a large corporation.

Concretely, websites are targeted that collect information via:

• a contact or quote form;
• a newsletter subscription;
• customer account creation;
• an online store that records name, address, and phone number;
• local video surveillance.

If your site collects nothing and leaves no traces, your exposure is minimal. As soon as a visitor can leave a piece of data, the law applies.

Collection, consent, and purpose

The law is based on simple principles. At the time of collection, the concerned person must be informed, among other things, of the identity of the data controller and the purposes for which their data is collected.

Consent is a manifestation of free, specific, and informed will by which the person accepts that their data be subject to processing. A pre-checked consent or one buried in unreadable terms does not meet these conditions.

Purpose matters just as much: you collect data for a specific purpose (answering a request, delivering an order), and you cannot reuse them for another objective without prior authorization from the CNDP.

Finally, the person has rights: to access their data, have it corrected, and object to its exploitation for serious reasons. Your site must allow these rights to be exercised simply.

Data security and confidentiality

The law requires the data controller, and its processor, to take necessary measures to preserve the security and confidentiality of data. This covers concrete reflexes:

• limiting access to authorized persons only;
• protecting admin accounts with strong authentication;
• encrypting exchanges with visitors (HTTPS);
• storing data in updated and backed-up systems.

Two-factor authentication (Enable two-factor authentication) and role-based security rules (Enforce two-factor authentication and limit IP addresses) in your client area contribute to this requirement: these are measures you can activate effortlessly that reduce the risk of unauthorized access.

The role of the CNDP

The CNDP, established by Law 09-08, is the supervisory authority. It receives processing declarations, issues authorizations, maintains a public register of notified processing, and can be contacted by any person who believes their rights have been violated.

A person whose access request went unanswered can file a complaint with the CNDP. This is a concrete recourse and a signal: a site that ignores visitors' requests faces scrutiny.

To learn more about the procedures, consult our guide Complying with the CNDP: the checklist for your website, which details forms, cookies, and declarations.

Implications for hosting your data

Compliance does not stop at your site's content: it also depends on where and how data is stored. Three points to check with your hosting provider:

• Location: knowing where servers are physically located allows you to assess the applicable regime and answer your customers' questions.
• Infrastructure security: updates, monitoring, backups, and access controls fall to the hosting provider, but their level must be verifiable.
• Traceability: a client area that exposes service status and activity facilitates the demonstration of your best practices.

Atlas Hostor hosts in Morocco and Europe, in partner data centers, with continuous supervision and a client area where the status of each service can be verified. If you host sensitive data or applications that cannot afford downtime, discover the high availability offer. To understand the issues of localization, read Hosting your data in Morocco: what it really changes. For billing in dirhams, see Paying for hosting in dirhams.

FAQ

Does Law 09-08 apply to a simple showcase website?

Yes, as soon as the site collects personal data (contact form, identifying statistics). A purely informational site, without forms or trackers, is low exposure.

Do you need to declare your site to the CNDP?

Yes: in principle, any processing must be subject to prior declaration, unless it is excluded from the scope of the law, exempt from declaration, or subject to the prior authorization regime. The CNDP issues a declaration receipt.

What are the risks of doing nothing?

Regardless of the penalties provided by the law, the main risk is the loss of customer trust and the possibility of a complaint with the CNDP. Compliance is also a commercial argument.