Make your website CNDP and GDPR compliant
· by the Agence Web Premium team, Guéliz Marrakech
Direct answer: in Morocco, any site that collects personal data (contact form, registration, order) falls under the law 09-08 and must be declared to the CNDP. If you have European customers, GDPR also applies. Agence Web Premium brings your site into compliance from 1,500 MAD.
Important clarification: we are a web agency, not a legal firm. We implement the technical and editorial aspects of compliance; for complex situations, we refer you to a specialized lawyer.
What is Law 09-08 and the CNDP?
In short: Law 09-08 governs the protection of personal data in Morocco. The CNDP is the authority responsible for enforcing it. A declaration is required before any data processing.
As soon as a site collects a name, email, telephone number or address, it processes personal data. A simple contact form is therefore concerned.
The declaration is made online with the National Commission for Control of the Protection of Personal Data. It is free and relatively quick, but still largely ignored in Morocco.
Does the GDPR apply to a Moroccan site?
In short: Yes, as soon as you process data from people located in the European Union — which is the case for a riad, a travel agency or any exporting activity.
The criterion is not your place of establishment but that of your visitors. A Marrakech riad which takes reservations from French people processes data from European residents: the GDPR applies.
In practice, the two regulations largely overlap. A well-built CNDP site is already three-quarters GDPR compliant.
What is actually needed on the site?
In short: Legal notices, a confidentiality policy, a cookies banner with real choice, forms with explicit consent, and HTTPS encryption.
- Legal notices : company identity, ICE, publication manager, host.
- Privacy Policy : what data, why, for how long, who accesses it, how to have it deleted.
- Cookie headband with a real possibility of refusing. An “OK” banner without a refusal option is not compliant.
- Consent on forms : checkbox not pre-checked, clear mention of the purpose.
- HTTPS required on all pages.
- Right of access and deletion : a dedicated contact address.
What are the risks in the event of non-compliance?
In short: Administrative and criminal sanctions provided for by law 09-08, and for the GDPR fines which can reach a percentage of turnover.
In Morocco, controls remain infrequent but the CNDP is increasingly active, particularly on e-commerce sites and platforms collecting health data.
Beyond the legal risk, there is an issue of trust: a site without legal notices or confidentiality policy inspires distrust, particularly among European customers.
How does compliance work?
In short: Audit of processing, drafting of documents, technical implementation of the cookies banner and consents, then support for the CNDP declaration.
- Inventory. What data is collected, through what forms, stored where.
- Editing. Legal notices and confidentiality policy adapted to your activity.
- Technical. Cookie banner with real choice, blocking of trackers before consent, consent boxes on forms.
- CNDP declaration. We prepare the file and support you in the online procedure.
CNDP and GDPR: what concerns you
| Your situation | CNDP (law 09-08) | GDPR |
|---|---|---|
| Showcase website with contact form | Yes | If European visitors |
| Online store | Yes | If European customers |
| Riad, hotel, travel agency | Yes | Yes, almost systematically |
| Medical office | Yes, reinforced diet | If European patients |
| Showcase website without any form | No | No |
| Newsletter | Yes | If European subscribers |
Frequently asked questions
Should you declare your site to the CNDP in Morocco?
Yes, as long as the site collects personal data — a simple contact form is enough to trigger this obligation. The declaration is free and is done online.
Does the GDPR concern Moroccan companies?
Yes as soon as you process data from people located in the European Union. This is the case for most riads, travel agencies and exporters.
How much does compliance cost?
From 1,500 MAD for a showcase website: drafting of documents, compliant cookie banner, consents on forms and support for the declaration.
Is an “I accept” cookie banner enough?
No. Refusal must be as simple as acceptance, and trackers must not be triggered before consent.
What should the legal notices contain?
The identity of the company, its ICE, the publication manager, contact details and the identity of the host.
Are you a legal firm?
No. We implement the technical and editorial aspects. For complex situations, we refer you to a specialized lawyer.
Are my new sites compliant by default?
All the sites we deliver include the legal notices, the confidentiality policy, a compliant cookie banner and HTTPS.
How long does the CNDP declaration take?
Preparing the file takes a few days. Treatment by the CNDP varies depending on the nature of the treatment declared.
A compliant site, and reassured customers
Audit, documents drawn up, cookie banner compliant and support for the CNDP declaration.
