Material Applicability

The material scope of Law no. 09-08 is determined by the following factors:

• Automated and non-automated processing
• Filing system requirements
• Sectoral exceptions
• National security and law enforcement exemptions

Processing Methods and Filing Systems

Law no. 09-08 Art.2(1):

"This law applies to the processing of personal data, whether automated in whole or in part, as well as to the non-automated processing of personal data contained in or intended to be included in manual files."

The law covers:

• Fully or partially automated data processing
• Manual processing when data is part of or intended for a filing system
• Both current and prospective filing system inclusions

Exemptions and Exceptions

Law no. 09-08 Art.2(2)(3):

"This law does not apply to:- Personal data collected and processed in the interest of national defense and internal or external state security.- Personal data collected in accordance with specific legislation."

Key exemptions include:

• National security and defense activities
• Law enforcement activities (subject to specific conditions)
• Activities governed by sector-specific legislation

Territorial Applicability

The territorial scope of Law no. 09-08 is established through:

• Establishment-based criteria
• Equipment-based criteria
• Processing location criteria

Establishment-Based Applicability

Law no. 09-08 Art.2(2)(1)(a):

"This law applies to the processing of personal data [...] When carried out by a natural or legal person whose data controller is established on Moroccan territory. The data controller of a processing activity conducted within Moroccan territory, regardless of its legal form, is considered established there."

The law applies to:

• Controllers established in Morocco
• Any legal form of establishment
• Processing activities linked to Moroccan establishments

Equipment-Based Applicability

Law no. 09-08 Art.2(2)(1)(b):

"When the data controller is not established on Moroccan territory but uses automated or non-automated means, located on Moroccan territory, for the purpose of processing personal data, excluding processing used solely for transit"

This provision covers:

• Non-established controllers using equipment in Morocco
• Both automated and non-automated processing means
• Excludes mere data transit

Representative Requirements

Law no. 09-08 Art.2(2):

"The data controller must notify the National Commission of the identity of a representative established in Morocco who, without prejudice to their personal responsibility, acts on their behalf"

Non-established controllers must:

• Appoint a local representative
• Notify the National Commission
• Ensure compliance through the representative