AI and personal data in Morocco: Law No. 09-08, transfers, CNDP guidance

Analysis note

Asmaa EL FORKANI 6 min read

No Moroccan text specific to artificial intelligence governing the use of personal data by such tools had been identified as at 21 October 2026. The applicable law is therefore Law No. 09-08, which covers every stage of a use of AI. These stages are purpose, information, formalities, security, subcontracting, transfer abroad and automated decision-making. In 2025, the National Commission for the Control of Personal Data Protection (CNDP) announced a specific deliberation. However, its publication had not been identified as at 21 October 2026.

personal data – Information Systems & Digital Transformation

Observation: AI uses as processing of personal data

Moroccan organisations use AI to draft, summarise, respond to customers, sort job applications or analyse data. Each of these uses becomes processing of personal data as soon as it concerns an identified or identifiable natural person. In practice, this is the case for most management uses.

In a press release of 18 March 2025, the CNDP recalled that such processing falls under Law No. 09-08. It also recalled that such processing calls for particular attention with regard to, among other things, its integrity, transparency, fairness and intelligibility. The same attention extends to the existence of means of redress in the event of automated decisions. Moreover, the CNDP announced hearings with a view to a deliberation. In its press release of 3 August 2026 on electoral operations, it further requested the flagging of any content produced by AI.

Analysis: the personal data rules of Law No. 09-08 applied to AI

Data quality (Article 3) first requires a specified purpose. In addition, the data must be adequate and not excessive in relation to that purpose. They must also be accurate and retained for a limited period. A use of AI whose purpose is not defined, or which draws on entire files when a few items suffice, departs from these requirements.

The lawfulness of processing (Article 4) rests on the consent of the data subject or on one of the exceptions provided for. These exceptions cover legal obligation and the performance of a contract or of pre-contractual measures. They also extend to the protection of the vital interests of a person who is physically or legally incapable of giving consent. Next, they encompass the performance of a task in the public interest or the exercise of official authority. Finally, they include a legitimate interest not overriding the rights and freedoms of the data subject.

Prior information (Article 5) covers the identity of the controller, the purposes, the recipients and the rights. Likewise, the rights of access, rectification and objection (Articles 7 to 9) apply to data processed by the tool as to any other data.

Analysis: formalities, security and automated decisions

The formalities (Article 12) take the form of a prior notification, except for processing subject to authorisation. Authorisation applies to sensitive data and to genetic data other than processing by health personnel for medical purposes. It also applies to data relating to offences, convictions and security measures, and to data including the national identity card number. In addition, it covers the use of data for purposes other than those of their collection. The same applies to the interconnection of files in the cases provided for. Consequently, an AI tool fed with such data moves the processing into the authorisation regime.

Security and subcontracting (Article 23) require appropriate technical and organisational measures. They also require a contract binding the service provider to the controller’s instructions. The provider of an AI service that processes data on behalf of an organisation is a processor. Its contractual terms and its data processing agreement govern the permissible use of the service.

Article 11 restricts decisions based solely on automated processing intended to define the profile or personality of a person. The restriction applies where such decisions produce legal effects concerning that person, subject to the exceptions provided for. Accordingly, a tool that ranks job applications, assigns a risk score or proposes a refusal must remain a support for a human decision.

Analysis: transfer of personal data abroad

Providers operate most AI services outside Morocco. Article 43 permits a transfer only to a State ensuring a sufficient level of protection. As amended by Deliberation No. 236-2015, the list drawn up by the CNDP includes thirty-two States. These are twenty-seven of the twenty-eight States then members of the European Union, including the United Kingdom. Croatia does not appear on the list. The list also includes Iceland, Liechtenstein, Norway, Switzerland and Canada. However, the United States does not appear on it.

Outside that list, Article 44 permits a transfer in particular where the data subject has expressly consented to it. The same applies where the transfer is necessary for the performance of a contract. That Article also permits it with the express and reasoned authorisation of the CNDP. Choosing a service whose processing takes place in a State on the list simplifies the analysis. However, it does not remove the formalities. Thus, the notification of the processing mentions the envisaged transfer (Article 15(e)). In addition, the CNDP procedure provides for this purpose a form for the transfer of data abroad (F-118).

Implications

A use of AI involving personal data requires four checks before its implementation. The first check concerns the purpose and the strictly necessary data. Next comes the check of the legal basis and the information of data subjects. The third check concerns the applicable formality (notification or authorisation). Finally, the last check concerns the place of processing and the basis for the transfer. Conversely, uses that do not require such data must rely on anonymised data.

The deliberation announced by the CNDP may clarify these rules. The principles recalled in 2025 (integrity, transparency, fairness, intelligibility, means of redress in the event of automated decisions) indicate its direction. They can already structure the documentation of processing operations.

Points of attention

  • Define for each use of AI the purpose and the strictly necessary data.
  • Inform data subjects when an AI tool processes their data.
  • Check whether the processing is subject to notification or authorisation, in particular where it involves sensitive data.
  • Identify the place of processing of each service and the basis for the transfer under Articles 43 and 44.
  • Maintain a human decision for any decision producing legal effects concerning a person.
  • Monitor the publication of the CNDP deliberation on artificial intelligence processing.

References

See also: Free AI tools: what users pay in data; Checklist – Compliance of AI uses; Register of AI uses. Information Systems & Digital Transformation practice.

Share

General information document; it constitutes neither legal advice nor an opinion on a particular situation. References to legal texts should be checked against the version in force on the date of use.

Consulting firm not registered with the Bar; no representation before the courts and no act reserved to the regulated legal professions.