Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Morocco's Law No. 09-08, enforced by the CNDP, has no statutory mandatory data-breach notification requirement, but imposes criminal fines of up to MAD 300,000 per violation (doubled for companies) plus imprisonment for unlawful processing.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Morocco's principal data protection statute, promulgated by Dahir n° 1-09-15 of 18 February 2009. Establishes the CNDP, requires prior declaration or authorization before processing (Articles 12-22), sets out data subject rights (Articles 5-11) and security obligations (Articles 23-26), and criminal/administrative sanctions (Articles 51-66). Confirmed by a full read of the law: it does NOT contain any provision requiring notification of a personal data breach to the CNDP or to data subjects.
SourceNo fixed statutory hour limit
Law 09-08 does not impose a mandatory obligation to notify the CNDP or affected data subjects of a personal data breach, confirmed directly by reading the full 67-article law text, including its security obligations (Articles 23-24) and its entire sanctions chapter (Articles 51-66), none of which reference breach notification. The closest existing obligation is the prior declaration/authorization a controller must file with the CNDP before processing begins, a processing-registration duty, not a breach-notification duty. Voluntary CNDP notification is recommended good practice, and a law reform introducing mandatory notification has reportedly been under discussion but had not been submitted to Parliament as of the verification date.
Notify: Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
Law No. 09-08, Criminal/Administrative Sanctions (Articles 52-65)
Fines range from MAD 10,000 up to MAD 300,000 per violation depending on the offence, the highest tier (MAD 50,000-300,000) applies to unauthorized processing of sensitive personal data. Most offences also carry 3 months to 2 years' imprisonment
Under Article 64, where the offender is a legal entity (company), fine amounts are DOUBLED, so the sensitive-data offence can reach up to MAD 600,000 for a company. Under Article 65, penalties are doubled again for a repeat offence within one year of a prior conviction.
SourceNot applicable , as of 2026-09-08
Commission Nationale de contrôle de la protection des Données à caractère Personnel(CNDP)
Visit authority siteNo. As of September 2026, Law 09-08 contains no mandatory statutory breach-notification duty to the CNDP or to affected individuals. Voluntary CNDP notification is recommended as good practice, and a law reform that would introduce mandatory notification has been under discussion but not yet submitted to Parliament.
The highest statutory range is MAD 50,000-300,000 (for unauthorized processing of sensitive personal data such as health, ethnicity, or political/religious opinion), plus 3 months to 2 years' imprisonment. Fines are doubled when the offender is a company, so this offence can reach MAD 600,000 for a corporate entity.
Under Articles 12-19, most processing requires a prior declaration to the CNDP, while processing of sensitive data or certain other listed categories requires prior CNDP authorization before processing may begin.
Talk to us about scoping an engagement around your specific regulatory context.
