Course sheet · 2027 catalogueManagement system standards
ISO/IEC 27701:2025 and Law 09-08
One day to link the personal data protection required by Law No. 09-08 to a privacy information management system under ISO/IEC 27701:2025. Processing activities, purposes, information to individuals, processors, transfers abroad, data breaches: each point is worked on your employee, customer and supplier files, with the CNDP as supervisory authority.
Duration1 day
Request a quoteObjectives
- Explain the principles of Law No. 09-08 and the role of the CNDP
- List the company’s personal data processing activities and their purposes
- Identify the formalities, the rights of individuals and the obligations towards processors
- Explain what ISO/IEC 27701:2025 brings to the organisation of privacy protection
- Build an action plan for compliance and management of personal data
Programme
Day 1 — morning
- Law No. 09-08: scope, personal data, sensitive data, controller, processor
- Principles: purpose, proportionality, accuracy, retention period, security
- Prior formalities with the CNDP; rights of information, access, rectification and objection
- Data transfers to a foreign State, including through online tools hosted outside Morocco
Day 1 — afternoon (workshop)
- ISO/IEC 27701:2025: privacy information management system, roles of personal data controller and processor
- Articulation with an existing ISO/IEC 27001:2022 system and with the requirements of the law
- Workshop: register of processing activities of one department of your company and priority gaps
- Knowledge test and action plan
Teaching methods
- Guided reading of the key provisions of Law No. 09-08
- Register of processing activities built on your real employee, customer or candidate files
- Practical cases: payroll processor, online tool hosted abroad, access request from an employee
- Knowledge test at the end of the day
Assessment and documents
Knowledge test at the end of the day, post-course evaluation at D+1. Numbered training certificate, verifiable online; training report, register of processing activities for the department studied and action plan handed to the company.
Bilingual materials for every participant; each classroom course comes with its digital twin on OmniLearn.
Frequently asked questions
How does it differ from the course “Personal Data: Law 09-08 and CNDP”?
That course, from the Digital domain, covers legal obligations and good habits for teams. This day links those obligations to a management system under ISO/IEC 27701:2025, with roles, processes and evidence, and is aimed at the people who run that system.
Is the training enough to bring the company into compliance?
No. It gives the method and produces a first register of processing activities for one department. Compliance then requires listing all processing activities, completing the formalities and keeping the measures alive.
Are online tools hosted abroad a problem?
When they process personal data, they involve a transfer to a foreign State, which is governed by Law No. 09-08. The course shows how to spot these transfers and analyse their conditions; the decision then rests with the controller.
Who should attend?
The functions that create or use files on individuals: HR, sales, marketing, quality, IT, as well as compliance or the legal department. One representative per department is enough to launch the register.
Practical information
- Duration
- 1 day
- Audience
- IT managers, information security officers, compliance and legal managers, HR, marketing, personal data focal points
- Prerequisites
- No prerequisites
- Group size
- Groups of 6 to 12 participants, in-company
- Format
- In-company, face to face on your site
- Language
- French, Darija or English; bilingual materials
- Funding
- OFPPT special training contracts (TFP), GIAC, Maroc PME: we prepare the applications with you, at no extra cost.
- Programme customisation
- Programme adapted to your procedures, your equipment and your audience
Organise this course
Price and dates on quote, depending on your headcount, your site and your preferred period.
Request a quoteDownload the PDF sheetCall +212 661 863 618Going further
Our consultants can also support the project on your site. ISO Consultant in Morocco and Africa: QHSE and Integrated Systems
Related courses
All courses in this fieldTrain your teams on your own site
Book a call with a consultant or request an in-company session: we adapt the programme to your procedures and your audience.