Morocco Law 09-08

Morocco Personal Data Protection Law 09-08 - CNDP oversight, consent, cross-border transfer.


Short name	MA 09-08
Region	Middle East & Africa
Country or scope	Morocco
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MA 09-08

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for MA 09-08.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for MA 09-08 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MA-0908-SEC` Security and Confidentiality of Processing	Controllers must implement appropriate technical and organisational measures to protect personal data against destruction, alteration and unauthorised access, which for software systems includes verifiable artifact integrity (Law 09-08 security-of-processing obligation, Art. 23-style)	Scan
`MA-0908-PROC` Processor Guarantees	Processing carried out on the controller's behalf must be entrusted only to processors providing sufficient security guarantees, which extends to knowing the suppliers of processing software components (Law 09-08 processor provisions)	Scan
`MA-0908-DECL` Prior Declaration to the CNDP	Processing operations require prior declaration or authorisation filed with the CNDP describing the processing and the systems used, requiring identifiable, dated documentation of the processing platform (Law 09-08 declaration/authorisation regime)	Scan
`MA-0908-QUAL` Data Quality Discipline	Personal data must be adequate, relevant, accurate and up to date; a processing environment demonstrates this discipline only if its own software inventory is complete with names and versions (Law 09-08 data quality principles)	Scan
`MA-0908-INV` Knowledge of Processing Systems	The controller's responsibility for the means of processing presumes maintained knowledge of what software constitutes those means, i.e. a non-empty component inventory (Law 09-08 controller responsibility provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`MA-3`	Data Processing Principles
`MA-8`	Sensitive Data Prohibition & Exceptions
`MA-12`	Data Subject Rights Procedures
`MA-17`	CNDP Declaration & Prior Authorisation
`MA-33`	Cross-Border Transfer Controls
`MA-41`	Security & Breach Management
`MA-CNDP`	CNDP Oversight Cooperation
`MA-PROC`	Processor Agreements
`MA-ROPA`	Records of Processing Activities

Policy templates

Written for MA 09-08:

Morocco CNDP Declaration Procedure

And 22 from the standard set, adapted to MA 09-08.