Law 09-08: your website collects data. Are you compliant?
A contact form, an analytics tool, a share button: your website collects personal data — and in Morocco, that collection is governed by law 09-08. Here is what it expects from a business website, without legal jargon.
What the law covers
Law 09-08 protects individuals with regard to the processing of their personal data: any information that identifies someone, directly or not — a name, a phone number, an email address, down to the browsing traces that follow a visitor.
The authority overseeing its application is the CNDP, Morocco's national commission for the protection of personal data. It is where processing activities are declared, and where a citizen can turn in case of abuse.
Your site collects more than you think
Many business owners think “we collect nothing” because they do not sell online. Take the real inventory:
- the contact form records name, email, phone — collection in the full sense;
- the visit statistics tool sets trackers and follows journeys;
- advertising trackers — when you advertise online — link the visit to a profile;
- a newsletter sign-up constitutes a prospecting file.
A useful marker
This is not a lawyer's article: it is the field experience of a provider that brings websites into compliance. For any binding decision, the official texts and the CNDP prevail.
What the law expects, in practice
Brought down to the reality of a business website, the obligations fit in five points:
- Inform clearly: who collects, why, and what rights the visitor has — the role of a privacy policy that describes YOUR reality, not a copied template's.
- Ask before tracking: trackers that are not necessary for the site to work wait for the visitor's consent — not the other way round.
- Declare processing activities to the CNDP, following its procedures.
- Secure what is collected: a form whose messages sit in a shared, unprotected mailbox is not compliant, whatever the banner says.
- Honour people's rights: access, correction, objection — which requires a contact address through which to exercise them.
What a compliant site looks like
A compliant site shows three signs. Its privacy policy tells the truth — what is actually collected, by which tools, for how long. Its consent banner actually blocks trackers until the visitor has chosen: a banner displayed while trackers are already running is a decoration, not compliance. And its forms ask only for what is needed — every superfluous field is one more piece of data to protect.
That is how our own website works: nothing leaves towards measurement or advertising tools before the visitor agrees, and the “cookie preferences” link in the footer lets anyone change their mind at any time. We apply to our clients what we apply to ourselves.
The three mistakes we see most
First: the privacy policy copied from a foreign site, promising rights from another legal framework and pointing to authorities with no jurisdiction in Morocco — a document that contradicts reality is worse than none.
Second: the decorative banner, added after the fact to a site whose trackers load from the first second. It reassures the owner, not the law.
Third: the wild prospecting file — addresses gathered along the way, then showered with commercial messages nobody asked for. That is precisely the kind of practice the law regulates.
Compliance is not only a constraint: a site that respects its visitors shows it, and it shows in the trust it inspires — especially when your clients are businesses themselves.
Is your site compliant?
Send us its address: we look at what it actually collects and tell you what is missing — no alarmism, no jargon.