Course sheet · 2027 catalogueDigital and artificial intelligence
Personal Data: Law 09-08 and CNDP
One day to understand what Law 09-08 requires of your company when it processes data of employees, customers, candidates or suppliers, and how to comply with the CNDP. Participants list their processing activities and check the information given to individuals, prior formalities, security and transfers, then leave with a prioritised compliance plan.
Duration1 day
Request a quoteObjectives
- Explain the principles of Law 09-08: purpose, proportionality, accuracy, retention period, security
- Identify the company’s personal data processing activities and record them in a register
- Determine the formalities to complete with the CNDP according to the nature of each processing activity
- Organise the information given to individuals and the handling of their requests for access, rectification and objection
- Assess security measures, contracts with processors and transfers of data abroad
- Build a prioritised compliance plan
Programme
Day 1 — morning
- Law 09-08 and the CNDP: scope, key notions, the Commission’s tasks and powers of control
- Principles of lawful processing: a specified purpose, adequate and relevant data, limited retention
- Consent of the individual and other grounds for processing
- Rights of individuals: information, access, rectification, objection
Day 1 — afternoon (workshop)
- Prior formalities with the CNDP: declaration or authorisation request depending on the processing
- Processing that calls for particular attention: video surveillance, biometrics, geolocation, health data
- Security, confidentiality, processors, transfers abroad; how the GDPR fits in for European customers
- Workshop: your company’s processing register and compliance plan; knowledge test
Teaching methods
- Inventory of processing activities from your own processes: recruitment, payroll, customers, access to premises
- Analysis of information notices and contract clauses brought by the participants
- Practical cases: cameras in a workshop, biometric time clocks, a sales prospecting file
- Templates of a register, an information notice and a reply to an access request handed to participants
- Quiz to validate the key notions
Assessment and documents
Knowledge test at the end of the day and end-of-course survey the next day. Numbered certificate, verifiable online, for each participant; the company receives the training report, the first version of its processing register and the compliance plan.
Bilingual materials for every participant; each classroom course comes with its digital twin on OmniLearn.
Frequently asked questions
Is our company concerned by Law 09-08?
As soon as it processes data of natural persons — employees, candidates, individual customers, contacts at suppliers —, yes. A personnel file, payroll, video surveillance or a sales file is enough to create obligations.
What is the difference between Law 09-08 and the GDPR?
Law 09-08 applies to processing carried out in Morocco and provides for formalities with the CNDP. The GDPR is the European regulation; it can also concern a Moroccan company that processes data of people located in the European Union, for example for export or subcontracting.
Can we work on our own processing during the day?
Yes. The afternoon workshop builds the first version of your register from your real processes. We ask in advance for the list of your main software and files.
Does the course replace legal advice?
No. It gives teams the means to understand their obligations and organise compliance day to day. A dispute or a complex processing activity calls for legal counsel.
Practical information
- Duration
- 1 day
- Audience
- Management, legal staff, HR, IT, sales and customer relations managers, data protection leads
- Prerequisites
- No legal prerequisites
- Group size
- Groups of 6 to 12 participants, in-company
- Format
- In-company, face to face on your site
- Language
- French, Darija or English; bilingual materials
- Funding
- OFPPT special training contracts (TFP), GIAC, Maroc PME: we prepare the applications with you, at no extra cost.
- Programme customisation
- Programme adapted to your procedures, your equipment and your audience
Organise this course
Price and dates on quote, depending on your headcount, your site and your preferred period.
Request a quoteDownload the PDF sheetCall +212 661 863 618Going further
Our consultants can also support the project on your site. AI and Digital Transformation for Companies in Morocco and Africa
Related courses
All courses in this fieldTrain your teams on your own site
Book a call with a consultant or request an in-company session: we adapt the programme to your procedures and your audience.