Morocco: Prime Ministerial Decree No. 2-09-165 implementing Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data including cross-Border data transfer regulation was implemented

On 18 June 2009, the Prime Ministerial Decree No. 2-09-165 implementing Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data was implemented following its publication in the official gazette. The decree stipulates that any transfer of personal data to a country offering sufficient protection must include detailed information such as the identity of the data sender and recipient, the purpose of the data processing, and the frequency of transfers. For transfers to countries not providing adequate protection, the decree requires specific derogations or explicit authorization from the National Commission for the Protection of Personal Data (CNDP), ensuring that measures are in place to safeguard the privacy and fundamental rights of individuals. Additionally, the decree mandates that any modifications to the transfer conditions must be promptly reported to the CNDP.