This tool applies to Morocco only (Moroccan data protection law 09-08 and the CNDP).
An indicative template, not legal advice. This generator produces a starting text from your answers. It does not replace a lawyer’s review or the formalities with the CNDP. Read the text and adapt it to what your website really does.
What law 09-08 requires
In Morocco, personal data protection is governed by law no. 09-08 of 18 February 2009 on the protection of individuals with regard to the processing of personal data, and by its implementing decree no. 2-09-165. Compliance is overseen by the national data protection commission, the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel). A website that collects names, e-mail addresses or phone numbers, even through a simple contact form, processes personal data.
- Inform people: who collects the data, for what purposes, who receives it and how to exercise their rights. That is the job of the privacy policy.
- Respect their rights: the rights of access, rectification and objection.
- Complete the prior formalities with the CNDP: a declaration or an authorisation request, depending on the processing.
- Frame transfers abroad, for example when the website is hosted outside Morocco or uses American services.
- Get consent before sending marketing e-mails.
Using the generated text
Publish the policy on its own page, linked from the footer of every page, and add a link to it under each form. Update it whenever you add a tool (analytics, advertising, chat) or start collecting new data. The text is generated in your browser; nothing is sent to our server. The generated text is in English; for a French text, use the French version of the generator. Many Moroccan websites publish both.
Official sources
- Law no. 09-08 enacted by dahir no. 1-09-15 of 18 February 2009 (Bulletin officiel no. 5714 of 5 March 2009).
- Decree no. 2-09-165 of 21 May 2009 implementing law 09-08.
- CNDP website: www.cndp.ma (declaration forms, guides and decisions).
Read our guide: law 09-08 and the CNDP: what a website must do.
Are you an agency? We work white-label →
Frequently asked questions
Is the generated text legally sufficient?
It is an indicative template, not legal advice. Read it, adapt it to what your website really does, and have it reviewed if your processing is sensitive.
Do I also need to declare my website to the CNDP?
Usually yes: under law 09-08, most processing of personal data requires a declaration or an authorisation with the CNDP before it starts. The privacy policy does not replace that formality.
My website is hosted abroad: what changes?
Transfers of personal data outside Morocco are regulated by articles 43 and 44 of law 09-08. The generated text mentions it; check the formalities with the CNDP.
Is my information sent to IT LABS PRO?
No. The text is generated in your browser.