Applicability of Morocco's Data Protection Law (Law No. 09-08)

Morocco's data protection framework is established through specific legislation governing the processing of personal data. The primary legislative instrument in this domain is Law No. 09-08 on the Protection of Individuals with regard to the Processing of Personal Data, known in French as LOI n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel, which serves as the foundational legal framework for personal data protection in Morocco.

The act was adopted on February 18, 2009 and became effective on March 5, 2009. This legislation establishes the legal foundation for regulating the processing of personal data within Morocco's jurisdiction.

Material Applicability

The material scope of Law no. 09-08 is determined by the following factors:

• Automated and non-automated processing
• Filing system requirements
• Sectoral exceptions
• National security and law enforcement exemptions

Processing Methods and Filing Systems

Law no. 09-08 Art.2(1):

"This law applies to the processing of personal data, whether automated in whole or in part, as well as to the non-automated processing of personal data contained in or intended to be included in manual files."

The law covers:

• Fully or partially automated data processing
• Manual processing when data is part of or intended for a filing system
• Both current and prospective filing system inclusions

Exemptions and Exceptions

Law no. 09-08 Art.2(2)(3):

"This law does not apply to:- Personal data collected and processed in the interest of national defense and internal or external state security.- Personal data collected in accordance with specific legislation."

Key exemptions include:

• National security and defense activities
• Law enforcement activities (subject to specific conditions)
• Activities governed by sector-specific legislation

Territorial Applicability

The territorial scope of Law no. 09-08 is established through:

• Establishment-based criteria
• Equipment-based criteria
• Processing location criteria

Establishment-Based Applicability

Law no. 09-08 Art.2(2)(1)(a):

"This law applies to the processing of personal data [...] When carried out by a natural or legal person whose data controller is established on Moroccan territory. The data controller of a processing activity conducted within Moroccan territory, regardless of its legal form, is considered established there."

The law applies to:

• Controllers established in Morocco
• Any legal form of establishment
• Processing activities linked to Moroccan establishments

Equipment-Based Applicability

Law no. 09-08 Art.2(2)(1)(b):

"When the data controller is not established on Moroccan territory but uses automated or non-automated means, located on Moroccan territory, for the purpose of processing personal data, excluding processing used solely for transit"

This provision covers:

• Non-established controllers using equipment in Morocco
• Both automated and non-automated processing means
• Excludes mere data transit

Representative Requirements

Law no. 09-08 Art.2(2):

"The data controller must notify the National Commission of the identity of a representative established in Morocco who, without prejudice to their personal responsibility, acts on their behalf"

Non-established controllers must:

• Appoint a local representative
• Notify the National Commission
• Ensure compliance through the representative