The Council of Europe’s Convention 108 for the protection of individuals with regard to automatic processing of personal data, and its Additional Protocol, enter into force today for Morocco, which becomes the 55th State Party. The Convention complements Morocco’s Law 09-08 on personal data protection, supervised by the national commission (CNDP).
Key points
- Morocco deposited its instrument of ratification on 28 May 2019.
- The Additional Protocol requires independent supervisory authorities and controls on transborder data flows.
- Under Law 09-08, processing generally requires prior declaration to, or authorisation from, the CNDP.
- Transfers to countries without adequate protection need CNDP authorisation.
- Accession supports Morocco’s ambitions for closer data flows with Europe.
Morocco is a popular nearshore location for call centres and IT outsourcing. UK organisations using Moroccan suppliers should ensure CNDP declarations or authorisations are in place and that contracts reflect security and transfer requirements.
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
