1. The framework
Law No. 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data, its implementing Decree No. 2-09-165 and the decisions of the National Commission for the Control of Personal Data Protection (CNDP) apply to any processing of personal data carried out in Morocco. Processing must pursue a specified purpose, rest on a legitimate basis, be declared to or authorised by the CNDP, be secured, and respect individuals' rights.
Clients established in the European Union or processing data of EU residents are also subject to the GDPR; the Data Processing Agreement is written to satisfy both frameworks.
2. Who does what
| Obligation | SAMIFISC | Client company |
|---|---|---|
| Declare to the CNDP the processing for which one is controller | Its own files: clients, prospects, contacts, users, WhatsApp, applicants | Its files: employees, customers, suppliers, video surveillance, etc. |
| Request prior authorisation for processing that requires it (sensitive data, CIN for purposes not provided for, interconnections) | For its own processing | For its own processing |
| Declare the transfer of data abroad (Art. 43) and request authorisation for countries without adequate protection (Art. 44) | Hosting in France and European buckets (Art. 43); Cloudflare, Meta, Anthropic, OpenAI in the United States (Art. 44) — in its formalities | Hosting of its files in the European Union — in its formalities (form F118) |
| Inform individuals (Article 5) | Its clients, contacts and visitors | Its employees, customers and suppliers |
| Secure the data (Articles 23 and 24) | The Client Portal, its servers, its staff | Its own workstations, passwords and users |
| Respond to rights of access, rectification and objection | For its processing; forwards the rest to the client | For its employees, customers and suppliers |
| Govern the processor by contract (Article 23, para. 3) | Offers the data processing agreement | Accepts or signs it |
3. What the firm has put in place
- A data protection officer, reachable at contact@samifisc.com.
- A map of its processing and a sheet for each (purpose, data, individuals, recipients, retention periods).
- Its formalities with the CNDP for the processing for which it is controller — the receipt number is published in the legal notice as soon as it is received.
- Clear information for individuals: this page, the Privacy Policy, the notices on the site's forms and the first messages of the WhatsApp assistant.
- A standard processing contract — the Data Processing Agreement — applicable to all its clients.
- The technical and organisational measures in its Annex B: encryption, segregation by file, logging, antivirus, backups, confidentiality undertakings.
- A breach management procedure: detection, qualification, notification to clients within 72 hours, informing individuals where the risk warrants it, notification to the CNDP where required.
- An annual review of its sub-processors and their commitments.
4. What your company must do
Declare your files
Your employee file, your customer and supplier file, like any other processing whose purpose you decide, must be declared to the CNDP before it is implemented, through the Commission's portal. Personnel management benefits from a simplified declaration when it stays within the scope of the reference decision (payroll, social filings, career management); going beyond that scope — geolocation, biometrics, access control — calls for an ordinary declaration or an authorisation.
Your employees' ID card
The national ID card (CIN) number is data to which the law grants particular protection: processing it for purposes other than those provided for by law requires CNDP authorisation (Article 12-1-e). Its presence in payroll — required by the CNSS and the DGI — falls within the purposes provided for, provided it appears in your declaration. Do not collect a copy of the CIN beyond what these obligations require, and never send it over WhatsApp: the firm's assistant does not ask for it.
Declare the transfer of your data to France
Since your files are hosted in the European Union, you declare this transfer in your formalities with the CNDP (form F118 or the "transfer" section of the declaration). France is on the list of countries providing an adequate level of protection: the transfer is declared, not subject to authorisation. The firm provides you with the details to enter (host, address, purposes).
Inform and respect rights
- Inform your employees, on hiring, of the processing they are subject to, of its recipients — including the firm — and of their rights; a clause in the employment contract or an information notice is enough.
- Inform your customers and suppliers by a notice on your quotes, invoices and forms.
- Respond within the statutory time limit to requests for access, rectification or objection; the Client Portal lets you correct and export the data concerned.
- Do not send commercial messages without prior consent, and respect any "STOP".
Secure your side
- Open the Client Portal only to authorised persons, each with a named account, and remove access as soon as a person leaves the company.
- Choose strong passwords and never share them; report any suspicious use without delay to contact@samifisc.com.
- Record in the file only the WhatsApp numbers of people authorised to receive your documents.
5. In the event of a breach
Loss or theft of a connected device, unauthorised access, documents sent to the wrong person, successful phishing: notify the firm immediately. The firm qualifies the incident, takes containment measures (access revocation, reset, removal of documents) and provides you with what you need for your own notifications. Where the breach is likely to harm the individuals concerned, they must be informed; the firm helps you draft that notice.
6. Penalties provided by law
Law No. 09-08 punishes processing without declaration or authorisation (Article 52), processing for purposes other than those declared (Article 53), failure to secure data (Article 58), unauthorised transfer abroad (Article 60) and obstruction of individuals' rights (Article 61) with fines of up to 300,000 dirhams, doubled in the event of a repeat offence, and with imprisonment in the most serious cases; the CNDP may also order the suspension of processing. These penalties target the controller — that is, for your files, your company.
7. The firm's help
As part of its legal engagement, or on quote, the firm assists you: identifying the processing to be declared, preparing and filing the declarations and the transfer form, drafting the information notices for your contracts and documents, setting up a register. Write to contact@samifisc.com or ask your accountant.
To go further
The CNDP publishes its texts, decisions, forms and declaration portal at www.cndp.ma. The decision references cited here are those in force at the date of this document; the Commission updates them.
Document “CNDP compliance commitment”, version 2026-09, in force since 20 September 2026. Earlier versions are available on request at contact@samifisc.com.