Law 09-08 governs personal data processing in Morocco. As soon as a chatbot, CRM or AI agent handles customer names, numbers or emails, it applies. The good news: compliance is simple if you plan for it from the start.
Key principles
- Purpose: collect only the data needed for a specific goal.
- Consent: inform people clearly and obtain their agreement.
- Security: protect data (encryption, restricted access).
- Rights: allow access, correction and objection.
The CNDP
Morocco's data protection authority (CNDP) must be notified of data processing. A prospect list or a chatbot collecting contact details generally requires a declaration. Transfers of data outside Morocco may require authorisation.
Where does AI fit?
- Choose AI providers that don't train their models on your data.
- Tell users clearly that they're talking to an AI.
- Send the model only the data it strictly needs.
- Provide a hand-off to a human.
Our approach
At Sabylis, every project includes a compliance review: notices, consent, logging, suitable hosting and support for the CNDP declaration. This article is informational and doesn't replace legal advice.