Morocco: Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data including cross-border data transfer regulation entered into force

On 18 February 2009, Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data entered into force following its publication in the official gazette. This law sets conditions for the transfer of personal data to foreign countries, stipulating that such transfers are permissible only if the receiving country ensures a sufficient level of protection for the data. The law outlines exceptions, allowing transfers in cases such as the individual's express consent, the necessity to preserve public interest, or the execution of a contract. The National Commission for the Protection of Personal Data (CNDP) is tasked with establishing a list of countries with adequate protection standards and overseeing compliance with these transfer regulations.