The Moroccan data protection law, specifically Law no. 09-08, establishes its scope of applicability based on the establishment of the data controller within Moroccan territory. The law applies to data processing activities "When carried out by a natural or legal person whose data controller is established on Moroccan territory". This provision extends the law's reach to both individuals and organizations that control data processing operations from within Morocco.

Furthermore, the law clarifies that "The data controller of a processing activity conducted within Moroccan territory, regardless of its legal form, is considered established there". This broad definition of establishment ensures that the law applies to various forms of business presence in Morocco, not limited to specific legal structures.

The inclusion of this factor in the law reflects the principle of territorial jurisdiction, which is common in data protection regulations worldwide. By focusing on the establishment of the data controller, Morocco aims to assert its authority over data processing activities that have a clear connection to its territory.

Implications

This provision has several implications for businesses and organizations:

1. Local presence: Any entity with a physical presence or establishment in Morocco, regardless of its legal form, will be subject to the Moroccan data protection law for its data processing activities.
2. Foreign companies: Multinational corporations with branches or offices in Morocco must comply with the law for data processing related to their Moroccan operations, even if the actual processing occurs outside the country.
3. Legal form flexibility: The law applies regardless of the legal structure of the entity, which means it covers a wide range of business models and organizational setups.
4. Responsibility allocation: The focus on the data controller's establishment places the primary responsibility for compliance on the entity that determines the purposes and means of data processing within Morocco.
5. Cross-border considerations: Companies operating in Morocco need to be aware that their data processing activities may be subject to both Moroccan law and potentially the laws of other jurisdictions where they operate or process data.