On a website that data is everywhere: a name and email in a form, a phone number in a callback request, a delivery address in a cart, a CV on a careers page, an IP address inside your analytics. A newsletter that asks only for an email address is already a processing operation.<\/p>\n
Two misconceptions keep circulating. First: \u00abit is only a brochure site, we sell nothing\u00bb. A single contact form puts you in scope. Second: \u00abour host is in France, so GDPR applies instead\u00bb. If your company is established in Morocco and decides the purposes of the processing, Law 09-08 binds you. GDPR may apply on top<\/em> if you target EU residents; it does not replace the Moroccan text.<\/p>\n One practical consequence: the obligations start at launch, not at the first sale. That is why these items belong in the project scope, alongside design and SEO.<\/p>\n The disclosure duties do not come from one single law. Law 09-08 requires you to inform the person whose data you collect. Law 31-08 on consumer protection adds obligations for distance selling. Law 53-05 covers electronic exchange of legal data and electronic signatures. A serious site covers all three instead of copying a French template found online.<\/p>\n In practice, a usable \u00abLegal notices\u00bb page contains:<\/p>\n A separate \u00abPrivacy policy\u00bb page is the first thing the CNDP will look at. In plain language it must state who the data controller is, what data you collect, for what purpose, how long you keep it, who else receives it (email platform, CRM, courier, payment provider), whether it leaves Morocco, and how to exercise rights of access, rectification and objection. That last part needs a concrete channel \u2014 a dedicated email address or form, not a generic sentence.<\/p>\n On an online store, add the distance-selling information: prices including tax, shipping costs and lead times, payment methods, return conditions and the withdrawal period set by Law 31-08, and after-sales support. Check the exact period that applies to your activity in the current text rather than reusing a figure you heard somewhere.<\/p>\n This is where most Moroccan sites fall short. A compliant form rests on three things.<\/p>\n A purpose stated before submission.<\/strong> One line under the form is enough: \u00abThis information is used only to answer your request and is not shared with third parties.\u00bb If you intend to add the contact to a prospecting list, say so \u2014 and make it a separate checkbox.<\/p>\n Separate consent for marketing.<\/strong> A pre-ticked box is not consent. Nor is a single box that mixes \u00abI agree to be contacted\u00bb with \u00abI agree to receive the newsletter\u00bb. Use two unticked boxes with clear wording. Every commercial email must carry an unsubscribe link that genuinely works.<\/p>\n Minimisation and retention.<\/strong> Do not ask for a date of birth, an ID card number or a revenue figure if you do not need it to answer. Then set a written retention period \u2014 for example 24 or 36 months after the last contact for an unconverted lead \u2014 and actually enforce it. A CRM holding every form submission since 2017 is a liability, not an asset.<\/p>\n Two technical details missed in nine projects out of ten: the form must be served over HTTPS, otherwise data travels in clear text, and notifications should not land in a personal Gmail inbox shared by three people.<\/p>\n The CNDP treats cookies and trackers as data processing as soon as they allow a visitor to be identified or followed. The expected logic is simple: cookies strictly necessary to run the site (session, cart, security, language preference) need no prior agreement; detailed analytics, advertising and social cookies do.<\/p>\n A correct banner:<\/p>\n A five-minute test you can run yourself: open your site in a private window, reject cookies, then open the browser developer tools and look at the cookies and network tabs. If calls to advertising or analytics domains still fire, your banner is decoration. That describes the large majority of banners installed as a plugin and never configured.<\/p>\n Law 09-08 does not force you to host in Morocco, but it does regulate transfers of personal data abroad. The principle: a transfer to a country recognised as offering an adequate level of protection fits within the declaration regime; a transfer to a country that is not requires CNDP authorisation or another specific basis. The CNDP publishes the relevant list \u2014 check the current version on its site before you pick a hosting region.<\/p>\n Translated into project decisions:<\/p>\n The useful deliverable is not a debate about sovereignty. It is a simple table \u2014 even in a plain document \u2014 listing every tool on the site, the data flowing through it, the storage country and the contract covering it. You will need it the day an enterprise client or an auditor asks.<\/p>\n Law 09-08 works through two regimes. Prior declaration<\/strong> covers ordinary processing: commercial contacts, newsletters, customer accounts in an online shop, job applications received through the site. Prior authorisation<\/strong> covers more sensitive cases: health data, data revealing beliefs or origins, biometric data, national ID numbers used as identifiers, cross-linking files with different purposes, and certain transfers outside Morocco.<\/p>\n In practice, a brochure site with a contact form and a standard online store fall under declaration. A teleconsultation platform, a site that collects ID card scans, or an HR portal centralising medical files move to the authorisation side \u2014 and that changes the project timeline, because such a request is examined, not settled the day before launch.<\/p>\n Filings go to the CNDP, which provides forms and an online service. Plan to name an internal owner for the file, describe each processing operation separately (contacts, newsletter, customers, recruitment), and keep the receipt. Failing to file exposes the company to penalties set by the law, financial and in some cases criminal; the exact amounts are in the text, so check them on the CNDP website rather than on a blog. Our Morocco CNDP Law 09-08 compliance checklist<\/a> covers the scope beyond the website itself.<\/p>\n Go through this with your provider, before final acceptance:<\/p>\n Twelve lines. On a new build, handling them costs a few days of attention. On a live site it usually means reopening code, tags and contracts \u2014 which is why they belong in the specification from day one, next to the budget described in our guide to professional website pricing in Morocco<\/a>.<\/p>\n You can do this alone, with no budget: read your legal notices and confirm the numbers match your actual situation; test the cookie banner in a private window; submit one of your own forms and see where the email lands; ask your provider for the list of third-party scripts loaded; open your CRM and see how old the oldest dormant contacts are. That round alone removes half the visible gaps.<\/p>\n Outside help earns its cost in three places: writing documents that describe your real processing rather than a generic template; reconfiguring the tracking layer so a rejection is actually honoured, which means touching the tag manager and sometimes the theme; and sensitive cases \u2014 health, biometrics, HR, transfers outside adequate jurisdictions \u2014 where classifying the right regime has real consequences.<\/p>\n Typical Morocco ranges in 2026: MAD 3,000\u20138,000 to write the legal pages and privacy policy of a brochure site; MAD 5,000\u201315,000 for a consent banner genuinely wired to your tags; MAD 12,000\u201330,000 for a full compliance audit of an e-commerce site including a data-flow inventory; MAD 5,000\u201315,000 to prepare a declaration file. Those figures stay marginal next to rebuilding the collection layer after launch, especially on an online store \u2014 a topic we also cover in our guide to choosing an ecommerce platform in Morocco<\/a>. No provider can promise you immunity; what you build is a defensible, current file.<\/p>\nMandatory legal notices: what your site must show in 2026<\/h2>\n
![\"Legal](\"https:\/\/storage.googleapis.com\/arrowlancer-prod.firebasestorage.app\/blog-ma\/conformite-cndp-site-web-maroc-2026\/1.jpg\")
<\/p>\n\n
Contact and lead forms: consent, purpose, retention<\/h2>\n
Cookies and tracking tools: what the CNDP expects<\/h2>\n
\n
Where the site data lives: Morocco, the EU, or elsewhere<\/h2>\n
\n
CNDP declaration or authorisation: which one for a website?<\/h2>\n
The website CNDP compliance checklist to clear before you go live<\/h2>\n
\n
What you can check yourself, and what needs help<\/h2>\n
What now?<\/h2>\n