“Law 09-08 doesn’t set any retention period, so we keep everything.” That is the sentence I hear most often when scoping a CRM or a data warehouse in Morocco, and it is only half right. The Moroccan text indeed publishes no table of durations by data type, unlike the sector guidelines circulated in Europe. What it does set is a binding principle: personal data cannot be kept longer than the purpose it was collected for requires.
So the duration is not written in the law. It is written by you, in the declaration filed with the CNDP, and that is the figure you will be measured against during an inspection. A company that declared “three years after the end of the commercial relationship” and then shows a customer database going back to 2011 does not have a vague-law problem. It has a gap between what it declared and what it does.
That distinction matters before a CRM, BI or AI project, because a retention period always ends up as a line of code in a pipeline. Whatever is left undecided during scoping becomes, eighteen months later, a 400,000-row table nobody dares to touch.
Data retention CNDP Morocco: what law 09-08 actually requires
Three principles govern retention and they work together. Purpose: you collect for a specified, explicit and legitimate use. Proportionality: you collect only what serves that use. Time limitation: once the purpose is exhausted, nothing justifies keeping the data in a form that still identifies the person.
This is exactly why the declaration form asks for a retention period per processing activity. If you do not know what your company declared, start by finding the receipts: that is the reference document the day an officer asks. The rest of the declaration groundwork is covered in our CNDP law 09-08 compliance checklist.
There is also an uncomfortable point to accept: no universal duration exists for you to copy. The right period depends on the data type, the contract, the sector and the archiving obligations that apply elsewhere. The benchmarks below are the ones commonly applied in Moroccan projects. They do not replace a review by your legal counsel, and any duration imposed by another statute should be confirmed with your chartered accountant or on the CNDP website.
“We keep everything, just in case”: what that argument really costs
Storage costs almost nothing, which is precisely what makes accumulation invisible. The cost sits elsewhere. A customer base carrying fifteen years of history holds duplicates, companies that no longer exist, three versions of the same account with different ICE numbers. Plug a dashboard into that and revenue per customer becomes arguable, and it is the dashboard that loses credibility, not the database.
On an AI project the effect is sharper. A scoring model trained on ten years of buying behaviour also learns the habits of a market that no longer exists, and nobody can say how much of its output comes from 2015. Sorting useful history from dead history is part of the data quality audit before a BI or AI project.
Then there is breach exposure. The records you are no longer entitled to hold are exactly the ones that will surface in a badly protected export. Explaining, after an incident, why CVs from 2017 were still sitting in an open bucket is a conversation nobody handles well.
How long can you keep a customer? And a prospect who never bought?
For a customer, the clock does not start at collection but at the end of the relationship. You still have to define that end: last invoice paid, contract expiry, warranty end, last support action. Three years after that date, absent a separate archiving obligation, the commercial record has no purpose left.
For a prospect who never bought, common practice is three years after the last contact. Which raises the real question: what counts as contact? A newsletter send does not, because you are the one acting. A click, a quote request, a phone call, a reply to an email, yes. If your CRM only stores a creation date, you do not have a clock, you have a date.
At expiry there are two options and they are not equivalent. Deletion removes the row and its history. Anonymisation keeps the analytical value (revenue by region, conversion rate by channel) while stripping direct and indirect identifiers. For an SME that wants long time series in its BI, anonymisation is almost always the better answer, provided it is genuine: an identifier replaced by a hash is still personal data if you keep the mapping table.
One exception worth remembering: unsubscribes and objections. Delete the address of someone who asked never to be contacted again and the next file import will bring them straight back. Keep a suppression list stripped to the minimum, an email hash, a date, a reason, and nothing more.
Rejected CVs: the period almost nobody respects
This is where the gap between policy and reality is widest. Retention for the CVs of candidates you did not hire fits in one sentence: the length of the hiring process, plus a short window to be able to justify the decision. Six months after the role closes is a reasonable and defensible benchmark.
Beyond that you need the candidate’s agreement to stay in the talent pool, and that agreement is asked for explicitly, not through a pre-ticked box at the bottom of a form. Two years is the ceiling most companies that have thought about it impose on themselves. A candidate can also write to ask what you hold on them, and having to answer that you do not know is more awkward than the data itself.
The real problem is never the recruiting tool. Purging an ATS takes one query. What remains is the HR manager’s mailbox with four hundred attachments, the shared drive folder named Recruitment 2022, the PDFs received over WhatsApp, the tracking spreadsheet with interview notes. A policy that does not cover those four places protects nothing. And if automated CV screening is on your roadmap, retention becomes central: see what we wrote on CNDP compliance for AI tools at work.
Do logs, cookies and technical data follow the same rules?
No, and that is a good thing. Technical logs serve a security and operations purpose, not a commercial one. Six to twelve months of application and security logs is the usual range: enough to investigate an incident detected late, too short to build a surveillance history.
Traces that follow employee activity (VPN access, file views, badge readers, call records) move into a different category. You are no longer only in data protection, you are touching monitoring of work: the purpose must be declared, employees informed, the period short and access limited to two or three named people.
On the website side, the widely reused benchmark for the lifetime of consent and tracker identifiers is thirteen months. Aggregated audience measurement can live longer, since it no longer targets anyone. The detail on banners and notices sits in our article on website CNDP compliance in Morocco.
And when another law demands ten years?
That is not a contradiction, it is a different purpose. When accounting, tax or labour rules require archiving, the obligation outranks erasure, but only for the documents concerned and only for that use.
Moroccan accounting rules require keeping accounting records and supporting documents for ten years. Invoices, general ledger, statements: they stay, and the tax authority’s reassessment window layers on top of that floor. For HR data retention in Morocco, contracts, payslips, social declarations and mandatory registers follow the same logic: you keep them because labour law and the CNSS may demand them, not because they are useful. Have each period confirmed by your chartered accountant and check the applicable texts on the CNDP website rather than copying a European table.
The distinction that saves the most time: an invoice is not a customer record. You must keep the invoice for ten years, you do not have to keep that same person’s marketing preferences, browsing history and sales notes for ten years. In practice that means pulling legal archiving out of the live perimeter: cold storage, encrypted, reachable by finance and nobody else, excluded from BI flows and from any model training.
How do you purge without breaking the dashboards?
A retention policy that stays a Word document is not a policy. CNDP data purging is built into the pipeline, in this order.
- Inventory by purpose, not by table. Prospecting, order fulfilment, support, recruitment, payroll, security. One CRM table often carries three purposes with three different periods.
- Set two values per data family: the duration, and above all the event that starts the clock. The starting event is what gets forgotten nine times out of ten.
- Choose deletion or anonymisation family by family, before writing a single query. That decision belongs to the business, not to engineering.
- Implement the purge as a scheduled job, never as a manual action. Soft delete, then hard delete after a few days of safety margin, with an alert if the deleted volume looks unusual.
- Handle backups and copies. A production purge empties neither the snapshots, nor the Excel exports on laptops, nor the database copy in the test environment. Set a bounded backup retention and document it.
- Log every purge: date, scope, record count, rule applied. It is the only usable evidence the day an inspection arrives.
- Name an owner and an annual review. Purposes evolve, tools change, the matrix has to follow.
Always test on a copy before the first run. The most common rule, delete if the last order is more than three years old, treats accounts with no order at all as dating from 1970 when the null date is unhandled. A badly bounded purge wipes active customers, and restoring a backup to fix it brings back exactly what you meant to remove.
What is the actual exposure?
Inspections rarely come out of nowhere. Most start with a complaint: a candidate still receiving messages two years after the interview, a former employee, a customer who asked for deletion and saw nothing happen. The CNDP can request explanations, order a processing activity to stop and, depending on severity, trigger the consequences set out in law 09-08, which includes financial penalties and, for certain breaches, criminal exposure. The amounts are in the text itself, so check them on the CNDP website rather than trusting a figure someone quoted in a meeting.
The more frequent cost, though, is commercial. A large account or a European partner will send a due diligence questionnaire with retention periods spelled out. And a CRM or BI project always slows down when the question was never settled, because nobody wants to migrate into a new tool the data they will then have to justify. Deciding the periods during scoping takes a few days. Deciding them after go-live becomes a history remediation project.
Settle the periods before you build the pipeline
Arrowlancer builds pipelines, dashboards and data quality work for Moroccan companies, and the retention matrix is part of scoping: periods per data family, the event that starts each clock, automated purge rules, anonymisation of history for BI, a deletion log. If a CRM, BI or AI project is coming up and the retention question is still open, have a look at our data services and then write to us with two lines about your current data sources.