Morocco: Adopted CNDP guidance for data controllers on camera surveillance in workplace including retention period for recorded videos or images

On 1 February 2023, the National Commission for the Protection of Personal Data (CNDP) issued a guidance for data controllers on camera surveillance in the workplace. The guidance outlines requirements for data controllers, including the obligation to notify the CNDP of surveillance system installations and ensure compliance with Law No. 09-08 on personal data protection. Cameras may only be installed in locations necessary to protect property and people, excluding areas where privacy might be violated, such as rest areas, meeting rooms, and places of worship. The retention period for recorded videos or images must not exceed three months. Data controllers are required to maintain the integrity and confidentiality of images, inform individuals via visible signage, and establish contracts or legal documents, ensuring data security. Any transfer of data abroad must be declared in advance to the CNDP.