Morocco: National Commission for the Protection of Personal Data adopted Deliberation No. 298-AU-2014 establishing the model authorisation request for the processing of personal data implemented by the private sector or similar entities for Human Resources management

On 11 April 2014, the National Commission for the Protection of Personal Data (CNDP) issued Deliberation No. 298-AU-2014 establishing the model authorisation request for the processing of personal data implemented by the private sector or similar entities for Human Resources management. The deliberation defines the categories of individuals covered, including employees, apprentices, trainees, and job applicants. The processing objectives include recruitment management, administrative management, career management, training management, work organisation, IT management, and health records management. The deliberation outlines the categories of personal data processed, including identity, financial details, professional evaluation, IT credentials, and health records, while enforcing strict confidentiality and security measures. Data recipients include authorised personnel, trade unions, social welfare associations, and legal representatives. It mandates compliance with data retention policies, ensures individuals’ rights to access, rectify, and object to data processing, and imposes requirements for international data transfers and third-party service providers handling personal data.