CNDP compliance and law 09-08: what your website must do

The moment a website collects a name and an email, it processes personal data. What Morocco's law 09-08 and the CNDP mean in practice for a company website.

The moment a website collects a name and an email address, it is processing personal data. In Morocco, that processing falls under law 09-08 and is declared to the CNDP. Many business owners assume this only concerns large customer databases; in reality, a simple contact form is enough.

What exactly is covered?

Law 09-08 on the protection of individuals with regard to the processing of personal data governs how such data is collected and used in Morocco. It is overseen by the CNDP, the national commission for the protection of personal data.

A contact form, a newsletter sign-up, a client area, order tracking: each of these is personal data processing. The CNDP states that the manager of a website collecting and processing personal data must notify it of that processing, and that the online declaration is free.

This guide describes what that means when building a site. It is not legal advice: for your specific situation, the reference is the CNDP itself, and your legal counsel if the processing is sensitive.

Three principles that become design decisions

• Fairness and transparency: people must know who is collecting, why, and what happens to their data. In practice, a readable privacy policy, and a notice where the data is collected, not only in the footer.
• Proportionality: collect only what the purpose requires. A contact form asking for a postal address, a date of birth or an ID number goes beyond what getting in touch justifies. The upside: fewer fields also means more replies.
• Individual rights: access, rectification and objection. People need a way to reach you to exercise them, and you need to know where the data sits to answer.

What it changes in a web project

• A real privacy policy stating which data is collected, why, how long it is kept and who it is shared with. Text copied from another site describes someone else's processing.
• A form reduced to what is needed, with the purpose stated where the data is collected.
• Separate consent for marketing: agreeing to be contacted about a quote is not agreeing to a newsletter. Two purposes, two boxes, never pre-ticked.
• Attention to third-party tools: analytics, advertising pixels and hosted chat widgets also process data from your site.
• Knowing where the data lands: a database, an inbox, a shared spreadsheet. Every copy is a place where an access request will have to be answered.

The most common mistake: copying a European text

Many Moroccan websites publish a privacy policy that cites the GDPR, mentions a data protection officer and points to a European authority. That text was written for a different framework from the one that applies.

The GDPR can still apply to a Moroccan business when it targets people in the European Union: a travel agency selling to French customers, a shop shipping to Europe. It then falls under both frameworks. Either way, the published text must describe what your site actually does.

Where to start

• List every collection point: each form, sign-up, client area and tool that sets an identifier.
• For each one, write its purpose in one sentence. If that is hard to write, the collection often has no reason to exist: remove it rather than declare it.
• Follow where each piece of data goes: database, inbox, spreadsheet, external tool.
• Remove fields with no purpose and tools whose data nobody uses.
• Write the policy from that inventory, then file the declaration. In that order, the text describes what you really do.

Frequently asked

Does a simple brochure site count? As soon as it has a contact form, it collects personal data. A site with no form, no client area and no identifying analytics collects much less, but that is rare in practice.

Who is responsible, the agency or the business? The controller is whoever decides why and how the data is collected: the business. The agency has a technical role and a duty to advise, without taking the controller's place.

Is the declaration paid? The CNDP states that the online declaration is free. The real cost is elsewhere: the time it takes to inventory what you collect.

A short form is both more compliant and more effective: fewer fields, more replies.

Noor Studio designs lean forms and helps you describe clearly what your site collects. Tell us about your project through our estimate form and we will come back with a proposal.