[{"data":1,"prerenderedAt":175},["ShallowReactive",2],{"seo-verification":3,"blog-hosting-outside-morocco-cndp-prior-authorization-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":23,"featuredImage":25,"bgImage":26,"posterImage":27,"relatedSolution":25,"intro":28,"sections":29,"ctaTitle":124,"ctaBody":125,"ctaButton":126,"ctaUrl":127,"relatedPosts":128},276,"hosting-outside-morocco-cndp-prior-authorization",{"fr":10,"en":8,"ar":11},"conformite-cndp-hebergement-hors-maroc","cndp-والاستضافة-خارج-المغرب-الترخيص-المسبق-إلزامي","Hosting Outside Morocco: CNDP Prior Authorization","Moroccan Law 09-08 requires prior CNDP authorization for any international data transfer. It applies as soon as a contact form collects an email address.",9,1,false,"2026-08-17T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},10,"Compliance & Regulation","conformite","bg-amber-500\u002F10 text-amber-400",[24],{"id":19,"name":20,"slug":21,"color":22,"icon":21},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fconformite-cndp-hebergement-hors-maroc-poster.svg","Your agency hosts dozens of websites in Europe. Every contact form, every newsletter sign-up, every client account collects email addresses. Under Moroccan Law 09-08, those addresses are personal data — and their transfer to a server located outside Morocco triggers a legal obligation that most agencies have never fulfilled: prior authorization from the CNDP. Not a simple notification — an authorization. This article explains why it is required, how to obtain it, and what happens if it is missing.",[30,34,45,48,76,79,98,102,105,108,111,114],{"type":31,"title":32,"body":33},"h2","Law 09-08: What It Protects and Who It Covers","Moroccan Law n° 09-08 on the protection of personal data was published in the Official Gazette n° 5682 on 19 April 2009. It applies to all personal data processing carried out in Morocco, regardless of the medium. Article 1 defines personal data as any information, of whatever nature and regardless of its medium, including sound and image, concerning an identified or identifiable natural person. A contact form collecting an email address therefore creates processing of personal data. The party operating the website — whether the client company or the agency managing it on their behalf — is a data controller under this law. The physical location of the server then determines whether an international transfer is taking place and whether CNDP authorization is required.",{"type":35,"title":36,"items":37},"ul","Personal Data That a Website Collects Without Always Realizing It",[38,39,40,41,42,43,44],"**Email addresses** — any contact, sign-up, or quote form collects at least one.","**Names and surnames** — present in registration forms, client accounts, and quote requests.","**Phone numbers** — common on service, commerce, and professional practice websites.","**IP addresses** — recorded in the server logs of any web hosting environment.","**Identification cookies** — a cookie that links a session to an identifiable user constitutes personal data.","**Billing data** — name, address, and partial card details on e-commerce websites.","**Form messages** — the content of a contact form delivered by email remains archived personal data.",{"type":31,"title":46,"body":47},"Articles 43 and 44: Prior Authorization for Any Transfer Abroad","This is the core issue for any agency hosting websites outside Morocco. Article 43 of Law 09-08 establishes the principle: a data controller may only transfer personal data to a foreign country if that country ensures a sufficient level of protection of privacy and fundamental rights. The CNDP evaluates this level by considering the legal provisions applicable in the destination country, the security measures in place, and the characteristics of the processing. Article 44 lists derogations — explicit consent, contractual necessity, vital interest, public register — but none of them removes the need for prior formalities in all cases. In practice, any Moroccan website whose data lands on a server in Europe or the United States is subject to this requirement: physical storage of data abroad constitutes a transfer under the law.",{"type":49,"title":50,"headers":51,"rows":55},"comparison","Simple Declaration vs. Prior Authorization: Understanding the Difference",[52,53,54],"Criterion","Simple Declaration","Prior Authorization",[56,60,64,68,72],[57,58,59],"Forms required","F211 or F214","F112 or F113 (+ F118 for the transfer)",[61,62,63],"Processing time","Receipt within 24 hours","Decision within 2 months (extendable once)",[65,66,67],"Data types covered","Standard personal data","Sensitive data, national ID, interconnections — and all international transfers",[69,70,71],"Transfer abroad","Does not apply to the transfer itself","Required for any country without adequate protection",[73,74,75],"CNDP silence","Not applicable (declaration is self-executing)","Equals refusal — the transfer cannot begin without an authorization number",{"type":31,"title":77,"body":78},"A Two-Step Process: Declare the Processing, Then Authorize the Transfer","Compliance is structured in two distinct stages that the CNDP requires in order. Transfer authorization can only be granted once the underlying processing has itself been declared or authorized. This sequence is the most common compliance gap in agencies: some are aware of the processing declaration but do not know that Form F118 — specific to international transfers — is a separate procedure. The CNDP then has two months to issue its decision, extendable once. An incomplete file pauses this deadline until it is complete. Without an authorization number, the transfer is unlawful — regardless of whether the destination server is in France, Germany, or the United States.",{"type":80,"title":81,"steps":82},"steps","CNDP Procedure for a Website Hosted Outside Morocco",[83,86,89,92,95],{"title":84,"body":85},"Identify and map all data processing activities","List all personal data processing activities carried out for client websites: forms, client accounts, newsletters, server logs. For each processing activity, document the purpose, categories of data, retention period, and recipients — including the foreign hosting provider.",{"title":87,"body":88},"Submit the processing declaration (F211 or F214)","File the prior processing declaration with the CNDP through the online platform available at \u003Ca href=\"https:\u002F\u002Fwww.cndp.ma\u002Fnotifier-un-traitement\u002F\">cndp.ma\u003C\u002Fa>. A receipt is issued within 24 hours. If the processing involves sensitive data (health, political opinions, union membership), a prior authorization form (F112 or F113) is required instead.",{"title":90,"body":91},"Submit the international transfer request (F118)","Once the processing is declared or authorized, separately submit Form F118 available at \u003Ca href=\"https:\u002F\u002Fwww.cndp.ma\u002Fnotifier-une-demande-de-transfert-a-letranger\u002F\">cndp.ma\u003C\u002Fa>. Include the signatory authorization letter and subcontracting agreements describing the security measures at the foreign hosting provider.",{"title":93,"body":94},"Wait for the CNDP decision (up to 2 months)","The CNDP reviews the application and notifies its decision within two months from receipt of a complete file. This deadline may be extended once. During this period, the transfer must not take place. An incomplete file suspends the deadline — the CNDP signals missing documents within the first 10 to 15 days.",{"title":96,"body":97},"Record the authorization number and include it in legal notices","The authorization number issued by the CNDP must appear in the legal notices and privacy policy of the website. Any change of hosting provider involving a transfer to a new country requires an updated CNDP filing.",{"type":99,"title":100,"body":101},"tip","EU Countries Are Generally Recognized as Providing Adequate Protection","The CNDP takes into account the effective level of protection in the destination country. EU member states, subject to the GDPR, are generally considered to provide a sufficient level of protection. Hosting in France, Germany, or the Netherlands therefore simplifies the CNDP filing compared to hosting in the United States, where prior authorization remains necessary but the file is more complex to build. Check the adequacy list published by the CNDP before selecting your server location.",{"type":31,"title":103,"body":104},"The Common Objection: My Clients Do Not Have Sensitive Data","This is the objection agencies raise most often — and it rests on a confusion between sensitive data and personal data. Law 09-08 distinguishes two categories. Sensitive data (health, ethnic origin, political opinions, religious beliefs, union membership) are subject to an even stricter regime. But ordinary personal data — a name, an email address, a phone number — are sufficient to trigger the law's obligations, including international transfer authorization. A contact form that only asks for a first name and email address is enough to create processing within the meaning of Law 09-08. The size of the website or the volume of data does not change the obligation: the law sets no threshold.",{"type":31,"title":106,"body":107},"Penalties for Unauthorized Transfers","Law 09-08 provides for criminal penalties applicable to data controllers who fail to comply. Article 60 specifically targets unlawful international transfers of personal data: it exposes the responsible party to imprisonment of three months to one year and a fine of 20,000 to 200,000 dirhams — or either penalty alone. For legal persons, fines are doubled. Reputational risks add to these: the CNDP may publish its decisions, and a documented audit weighs on an agency's client relationships. In February 2023, the CNDP issued a public statement specifically targeting companies that had failed to notify an international data transfer, confirming that this obligation is actively enforced.",{"type":31,"title":109,"body":110},"What Agencies Should Include in Their Service Offering","CNDP compliance is not a formality that clients handle alone. When an agency selects the hosting provider, configures the server, and manages the website's forms, it is in the position of a data controller or sub-processor depending on the contracts in place. In either case, obligations fall on the agency. Integrating CNDP support into the launch service — processing audit, declaration filing, compliant legal notices — differentiates the agency and removes a legal liability that the client does not know exists. It is also a commercial argument: the client does not have to navigate an administrative procedure with an authority they have never heard of.",{"type":99,"title":112,"body":113},"Check Before Migrating a Website to a New Hosting Provider","Any change of hosting provider that involves a change of host country reopens the transfer question. If a website was hosted in Morocco and migrates to European servers, a new CNDP authorization request is required. Conversely, a migration between two providers in the same adequate country does not require a new request, though updating subcontracting agreements is recommended. Our data centers are located in Europe — a fact worth documenting in your clients' CNDP files from the outset.",{"type":35,"title":115,"items":116},"Compliance Checklist: Points to Check Before Going Live",[117,118,119,120,121,122,123],"**Processing inventory** — complete list of forms, cookies, client accounts, and server logs likely to contain personal data.","**Processing declaration filed** — Form F211 or F214 submitted to the CNDP platform and receipt obtained (within 24 hours).","**Form F118 submitted** — international transfer request filed separately, with supporting documents.","**CNDP authorization number received** — the transfer begins only after receiving this number (up to 2 months).","**Legal notices updated** — authorization number, identity of the data controller, data subject rights, CNDP contact details.","**Sub-processing agreement signed with the hosting provider** — must describe security measures and data processing conditions.","**Update procedure documented** — if the provider, country, or processing activities change, a CNDP file update is triggered.","European Hosting, Documented for Your Moroccan Clients","Our data centers are located in Europe and our hosting plans include automatic SSL, backups, and cPanel. European hosting simplifies the CNDP file for your clients — we provide the technical information needed to build it.","View Hosting Plans","\u002Fhebergement-web",[129,142,157],{"id":130,"slug":131,"slugs":132,"title":135,"excerpt":136,"readTime":14,"views":15,"isPinned":16,"publishedAt":137,"category":138,"categories":139,"featuredImage":25,"bgImage":26,"posterImage":141,"relatedSolution":25},244,"vat-on-digital-services-in-morocco-what-changes-in-2026",{"fr":133,"en":131,"ar":134},"tva-marocaine-hebergement-web-facturation","ضريبة-القيمة-المضافة-الرقمية-بالمغرب-ما-الذي-تغير-في-2026","VAT on digital services in Morocco: what changes in 2026","Morocco's 2024 Finance Law imposes 20% VAT on foreign digital services sold to Moroccan clients. Who owes it and how to register on tax.gov.ma.","2026-08-10T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[140],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Ftva-marocaine-hebergement-web-facturation-poster.svg",{"id":143,"slug":144,"slugs":145,"title":148,"excerpt":149,"readTime":150,"views":151,"isPinned":16,"publishedAt":152,"category":153,"categories":154,"featuredImage":25,"bgImage":26,"posterImage":156,"relatedSolution":25},211,"nis2-what-the-directive-requires-from-your-hosted-clients",{"fr":146,"en":144,"ar":147},"nis2-hebergement-obligations-clients-2026","nis2-ما-تفرضه-التوجيهات-على-عملائكم-المستضافين","NIS2: what the directive requires from your hosted clients","NIS2 applies from October 2026 across the EU. Clients in essential sectors must choose providers that meet the same security standards.",4,0,"2026-08-02T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":21},[155],{"id":19,"name":20,"slug":21,"color":22,"icon":21},"\u002Fblog\u002Fcovers\u002Fnis2-hebergement-obligations-clients-2026-poster.svg",{"id":158,"slug":159,"slugs":160,"title":163,"excerpt":164,"readTime":165,"views":151,"isPinned":16,"publishedAt":166,"category":167,"categories":172,"featuredImage":25,"bgImage":26,"posterImage":174,"relatedSolution":25},253,"web-hosting-in-morocco-price-vat-and-a-compliant-invoice",{"fr":161,"en":159,"ar":162},"hebergement-web-maroc-prix-et-facturation","استضافة-المواقع-في-المغرب-السعر-والضريبة-والفاتورة-النظامية","Web Hosting in Morocco: Price, VAT and a Compliant Invoice","What web hosting really costs in Morocco: billing in dirhams, Moroccan VAT, an invoice carrying IF, ICE and RC, and the real cost at renewal.",8,"2026-08-13T00:00:00+00:00",{"id":168,"name":169,"slug":170,"color":171,"icon":170},5,"Comparison","comparatif","bg-info\u002F10 text-info",[173],{"id":168,"name":169,"slug":170,"color":171,"icon":170},"\u002Fblog\u002Fcovers\u002Fhebergement-web-maroc-prix-et-facturation-poster.svg",1787581002392]