What law 09-08 changes for a Moroccan website
Law 09-08 governs the processing of personal data in Morocco. For a website, it translates into three concrete obligations: clearly inform people about what's collected and why, declare the processing to the CNDP, and let everyone exercise their rights of access, rectification, and objection.
A simple contact form is enough to trigger these obligations. There's no need to manage a large customer database: as soon as a name, email, or phone number is stored, that's a processing operation involving personal data.
Why European generators fall short
Most generators available online produce text modeled on the GDPR. They mention neither the trade register, nor the ICE, nor the tax ID, nor the CNDP receipt, and point people toward European authorities to exercise their rights. A Moroccan visitor trying to exercise their rights is then left with no one to turn to.
Where to find your legal identifiers
- Your trade register number and court are on your Modèle J.
- Your ICE number is on your ICE certificate and on your invoices.
- Your tax ID is on your tax identification certificate.
- Your hosting provider's name and address are supplied by your hosting company.
Frequently asked questions
What legal notices are required on a Moroccan website?
A professional website must let visitors identify its publisher: company name, legal form, registered office address, contact details, legal identifiers (trade register number, ICE, tax ID), the name of the publication director, and the identity of the host. As soon as the site collects personal data, the information required by law 09-08 must be added as well.
What is law 09-08?
It's the Moroccan law on the protection of individuals with regard to the processing of personal data. Among other things, it requires informing the people concerned, declaring the processing to the CNDP (the national data protection commission), and guaranteeing the rights of access, rectification, and objection.
Do I have to declare my website to the CNDP?
As soon as your website collects personal data, for example through a contact form, a newsletter sign-up, or a customer account, the processing must be declared to the CNDP. This is done directly with the commission, which issues a receipt (récépissé). This tool doesn't file the declaration for you, it prepares the text that goes alongside it.
Are law 09-08 and the GDPR the same thing?
No. The two frameworks share a similar logic but remain distinct. A Moroccan website that also targets residents of the European Union may fall under both regimes. In that case, have the text reviewed by a legal professional, since the template produced here only covers the Moroccan framework.
Does this document replace a lawyer?
No, and it doesn't claim to. It's a base template that structures the expected notices from the information you enter. Depending on your activity, particularly for online sales, health data, or banking data, additional clauses are needed. Have the text proofread before publishing it.