[{"data":1,"prerenderedAt":186},["ShallowReactive",2],{"seo-verification":3,"blog-hosting-outside-morocco-cndp-prior-authorization-ma-en":6,"promo-bar-likely":185},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-hosting-outside-morocco-cndp-prior-authorization-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":128,"ctaBody":129,"ctaButton":130,"ctaUrl":131,"relatedPosts":132},276,"hosting-outside-morocco-cndp-prior-authorization",{"fr":12,"en":10,"ar":13,"es":14},"conformite-cndp-hebergement-hors-maroc","cndp-والاستضافة-خارج-المغرب-الترخيص-المسبق-إلزامي","alojamiento-fuera-de-marruecos-autorizacion-cndp","Hosting Outside Morocco: CNDP Prior Authorization","Law 09-08 governs every transfer of data out of Morocco, from the first email collected. Notification or authorization: it depends on the destination.",11,9,false,"2026-08-17T00:00:00+00:00","2026-11-09T20:55:14+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},10,"Compliance & Regulation","conformite","bg-amber-500\u002F10 text-amber-400",[28],{"id":23,"name":24,"slug":25,"color":26,"icon":25},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fconformite-cndp-hebergement-hors-maroc-poster.svg","Your agency hosts dozens of websites in Europe. Every contact form, every newsletter sign-up, every client account collects email addresses. Under Moroccan Law 09-08, those addresses are personal data — and their transfer to a server located outside Morocco triggers a legal obligation that most agencies have never fulfilled: the transfer formality set out in Law 09-08. What it involves depends on the destination country: to a state the CNDP recognizes as providing a sufficient level of protection, the transfer is notified through a dedicated request, with no derogation to invoke; to any other country, an Article 44 derogation must be invoked or express CNDP authorization obtained. This article explains where that line falls, what to file on each side of it, and what happens if nothing is filed.",[34,38,49,52,80,83,102,106,109,112,115,118],{"type":35,"title":36,"body":37},"h2","Law 09-08: What It Protects and Who It Covers","Moroccan Law n° 09-08 on the protection of personal data was published in the Official Gazette n° 5714 on 5 March 2009. It applies to all personal data processing carried out in Morocco, regardless of the medium. Article 1 defines personal data as any information, of whatever nature and regardless of its medium, including sound and image, concerning an identified or identifiable natural person. A contact form collecting an email address therefore creates processing of personal data. The party operating the website — whether the client company or the agency managing it on their behalf — is a data controller under this law. The physical location of the server then determines whether an international transfer is taking place and whether CNDP authorization is required.",{"type":39,"title":40,"items":41},"ul","Personal Data That a Website Collects Without Always Realizing It",[42,43,44,45,46,47,48],"**Email addresses** — any contact, sign-up, or quote form collects at least one.","**Names and surnames** — present in registration forms, client accounts, and quote requests.","**Phone numbers** — common on service, commerce, and professional practice websites.","**IP addresses** — recorded in the server logs of any web hosting environment.","**Identification cookies** — a cookie that links a session to an identifiable user constitutes personal data.","**Billing data** — name, address, and partial card details on e-commerce websites.","**Form messages** — the content of a contact form delivered by email remains archived personal data.",{"type":35,"title":50,"body":51},"Articles 43 and 44: What the Law Requires, by Destination Country","This is the core issue for any agency hosting websites outside Morocco. Article 43 of Law 09-08 establishes the principle: a data controller may only transfer personal data to a foreign country if that country ensures a sufficient level of protection of privacy and fundamental rights. The CNDP evaluates this level by considering the legal provisions applicable in the destination country, the security measures in place, and the characteristics of the processing. Article 44 lists derogations — explicit consent, contractual necessity, vital interest, international agreement — but none of them removes the need for prior formalities in all cases. In practice, any Moroccan website whose data lands on a server in Europe or the United States is subject to this requirement: physical storage of data abroad constitutes a transfer under the law.",{"type":53,"title":54,"headers":55,"rows":59},"comparison","Simple Declaration vs. Prior Authorization: Understanding the Difference",[56,57,58],"Criterion","Simple Declaration","Prior Authorization",[60,64,68,72,76],[61,62,63],"Forms required","F211 or F214","F112 or F113 (+ F118 for the transfer)",[65,66,67],"Processing time","Receipt within 24 hours","Decision within 2 months (extendable once)",[69,70,71],"Data types covered","Standard personal data","Sensitive data, national ID, interconnections — and transfers to an unlisted country, unless an Article 44 derogation applies",[73,74,75],"Transfer abroad","Does not apply to the transfer itself","Required for an unlisted country, unless an Article 44 derogation applies",[77,78,79],"CNDP silence","Not applicable (declaration is self-executing)","Counts as authorization once the deadline expires (art. 28 of Decree 2-09-165) — the transfer waits for the decision or that deadline",{"type":35,"title":81,"body":82},"A Two-Step Process: Declare the Processing, Then Authorize the Transfer","Compliance is structured in two distinct stages that the CNDP requires in order. Transfer authorization can only be granted once the underlying processing has itself been declared or authorized. This sequence is the most common compliance gap in agencies: some are aware of the processing declaration but do not know that Form F118 — specific to international transfers — is a separate procedure. The CNDP then has two months to issue its decision, extendable once. An incomplete file pauses this deadline until it is complete. That sequence applies to every destination country: Form F211 points to the dedicated form as soon as the \"transfer abroad\" box is ticked. The Article 43 list changes what the request contains, not whether it is needed: to France or Germany, both listed, no derogation has to be invoked; to a country absent from the list — the United States being the most common case — an Article 44 derogation must be invoked or the CNDP's express authorization obtained, failing which the transfer is unlawful.",{"type":84,"title":85,"steps":86},"steps","CNDP Procedure for a Website Hosted Outside Morocco",[87,90,93,96,99],{"title":88,"body":89},"Identify and map all data processing activities","List all personal data processing activities carried out for client websites: forms, client accounts, newsletters, server logs. For each processing activity, document the purpose, categories of data, retention period, and recipients — including the foreign hosting provider.",{"title":91,"body":92},"Submit the processing declaration (F211 or F214)","File the prior processing declaration with the CNDP through the online platform available at \u003Ca href=\"https:\u002F\u002Fwww.cndp.ma\u002Fnotifier-un-traitement\u002F\">cndp.ma\u003C\u002Fa>. A receipt is issued within 24 hours. If the processing involves sensitive data (health, political opinions, union membership), a prior authorization form (F112 or F113) is required instead.",{"title":94,"body":95},"File the transfer request (F118)","This step applies to every destination country, Finland, Germany, and France included: the Article 43 list only removes the need to invoke a derogation. Once the processing is declared or authorized, separately submit Form F118 available at \u003Ca href=\"https:\u002F\u002Fwww.cndp.ma\u002Fnotifier-une-demande-de-transfert-a-letranger\u002F\">cndp.ma\u003C\u002Fa>. Include the document authorizing the signatory, the reference of the processing receipt or authorization and, where applicable, the contractual clauses agreed with the foreign hosting provider.",{"title":97,"body":98},"Wait for the CNDP decision (up to 2 months)","The CNDP reviews the application and notifies its opinion within two months from receipt of a complete file. This deadline may be extended once. A transfer that requires authorization does not take place before the decision; if the CNDP has not ruled within these deadlines, authorization is deemed granted (Article 28 of Decree 2-09-165). An incomplete file suspends the deadline — the CNDP notifies the data controller, and the deadline only runs once the requested documents are provided.",{"title":100,"body":101},"Record the authorization number and include it in legal notices","Where an authorization has been granted, its number must appear in the legal notices and privacy policy of the website. Any change of hosting provider involving a transfer to a new country requires an updated CNDP filing.",{"type":103,"title":104,"body":105},"tip","The CNDP List Names 32 States — and It Is Not \"the European Union\"","The CNDP does not judge case by case: it publishes a list. Deliberation no. 236-2015 of 18 December 2015, issued under Article 43, names 32 states — including Germany, Finland, France, and the Netherlands, but also Canada, Iceland, Liechtenstein, Norway, the United Kingdom, and Switzerland, which are not members of the European Union. Croatia, conversely, does not appear, although it is a member state: the original list dates from September 2013, two months after its accession, and has not been updated since 2015. \"It is in Europe, so it is fine\" is therefore wrong in both directions — read the country name in the deliberation, not its flag. The United States is not on it, and no Data Privacy Framework-style arrangement takes its place: those frameworks are European and do not bind the CNDP.",{"type":35,"title":107,"body":108},"The Common Objection: My Clients Do Not Have Sensitive Data","This is the objection agencies raise most often — and it rests on a confusion between sensitive data and personal data. Law 09-08 distinguishes two categories. Sensitive data (health, ethnic origin, political opinions, religious beliefs, union membership) are subject to an even stricter regime. But ordinary personal data — a name, an email address, a phone number — are sufficient to trigger the law's obligations, including notification of international transfers. A contact form that only asks for a first name and email address is enough to create processing within the meaning of Law 09-08. The size of the website or the volume of data does not change the obligation: the law sets no threshold.",{"type":35,"title":110,"body":111},"Penalties for Unauthorized Transfers","Law 09-08 provides for criminal penalties applicable to data controllers who fail to comply. Article 60 specifically targets unlawful international transfers of personal data: it exposes the responsible party to imprisonment of three months to one year and a fine whose amount the same article sets (\u003Ca href=\"https:\u002F\u002Fwww.cndp.ma\u002Fwp-content\u002Fuploads\u002F2023\u002F11\u002FLoi-09-08-Fr.pdf\">text of Law 09-08\u003C\u002Fa>) — or either penalty alone. For legal persons, fines are doubled. Reputational risks add to these: the CNDP may publish its decisions, and a documented audit weighs on an agency's client relationships. In January 2023, the CNDP made public the case of a visa services provider that had not notified it of a regular transfer of data abroad, stating that the failure to notify is in itself an offence: the obligation is actively enforced.",{"type":35,"title":113,"body":114},"What Agencies Should Include in Their Service Offering","CNDP compliance is not a formality that clients handle alone. When an agency selects the hosting provider, configures the server, and manages the website's forms, it is in the position of a data controller or sub-processor depending on the contracts in place. In either case, obligations fall on the agency. Integrating CNDP support into the launch service — processing audit, declaration filing, compliant legal notices — differentiates the agency and removes a legal liability that the client does not know exists. It is also a commercial argument: the client does not have to navigate an administrative procedure with an authority they have never heard of.",{"type":103,"title":116,"body":117},"Check Before Migrating a Website to a New Hosting Provider","Any change of hosting provider that involves a change of host country reopens the transfer question. If a website was hosted in Morocco and migrates to servers in Finland or Germany, the transfer must be notified with Form F118 — with no derogation to invoke and no express authorization, both countries being listed. To a country absent from the list, the F118 must also invoke an Article 44 derogation or request the CNDP's authorization, before any transfer takes place. A migration between two providers in the same listed country changes the data recipient: the change is reported to the CNDP within 8 working days (Article 49 of the decree), and updating subcontracting agreements is recommended. Our servers are in Finland and Germany — two countries on the list, a fact worth documenting in your clients' CNDP files from the outset.",{"type":39,"title":119,"items":120},"Compliance Checklist: Points to Check Before Going Live",[121,122,123,124,125,126,127],"**Processing inventory** — complete list of forms, cookies, client accounts, and server logs likely to contain personal data.","**Processing declaration filed** — Form F211 or F214 submitted to the CNDP platform and receipt obtained (within 24 hours).","**Destination country checked against deliberation no. 236-2015** — Form F118 must be filed separately in every case, with its supporting documents; if the country is not listed, the request invokes an Article 44 derogation or seeks express authorization.","**CNDP response to the F118** — a transfer that requires authorization begins only after the decision or once the deadline expires (up to 2 months, extendable once).","**Legal notices updated** — authorization number where applicable, identity of the data controller, data subject rights, CNDP contact details.","**Sub-processing agreement signed with the hosting provider** — must describe security measures and data processing conditions.","**Update procedure documented** — if the provider, country, or processing activities change, a CNDP file update is triggered.","European Hosting, Documented for Your Moroccan Clients","Our servers are in Helsinki (Finland) and Falkenstein (Germany) — two countries named on the list of states providing a sufficient level of protection, set by the CNDP in deliberation no. 236-2015 of 18 December 2015 (art. 43 of Law 09-08). For your clients, the formality that changes is a specific one: no derogation to invoke and no express authorization to seek — the transfer still has to be notified with Form F118, alongside the processing declaration. We provide in writing the hosting location and the identity of the host to enter there.","View Hosting Plans","\u002Fhebergement-web",[133,149,165],{"id":134,"slug":135,"slugs":136,"title":140,"excerpt":141,"readTime":23,"views":142,"isPinned":19,"noindex":19,"publishedAt":143,"updatedAt":144,"category":145,"categories":146,"featuredImage":29,"bgImage":30,"posterImage":148,"relatedSolution":29},244,"vat-on-digital-services-in-morocco-what-changes-in-2026",{"fr":137,"en":135,"ar":138,"es":139},"tva-marocaine-hebergement-web-facturation","ضريبة-القيمة-المضافة-الرقمية-بالمغرب-ما-الذي-تغير-في-2026","iva-servicios-digitales-marruecos-2026","VAT on digital services in Morocco: what changes in 2026","Morocco's 2024 Finance Law imposes 20% VAT on foreign digital services sold to Moroccan clients. Who owes it and how to register on tax.gov.ma.",2,"2026-08-10T00:00:00+00:00","2026-11-08T01:13:15+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[147],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Ftva-marocaine-hebergement-web-facturation-poster.svg",{"id":150,"slug":151,"slugs":152,"title":156,"excerpt":157,"readTime":158,"views":159,"isPinned":19,"noindex":19,"publishedAt":160,"updatedAt":21,"category":161,"categories":162,"featuredImage":29,"bgImage":30,"posterImage":164,"relatedSolution":29},211,"nis2-what-the-directive-requires-from-your-hosted-clients",{"fr":153,"en":151,"ar":154,"es":155},"nis2-hebergement-obligations-clients-2026","nis2-ما-تفرضه-التوجيهات-على-عملائكم-المستضافين","nis2-obligaciones-hosting-clientes-2026","NIS2: what the directive requires from your hosted clients","NIS2: who is in scope, the ten measures of Article 21, the 24-hour and 72-hour deadlines, and what your clients will require from their hosting.",16,0,"2026-08-02T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[163],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fnis2-hebergement-obligations-clients-2026-poster.svg",{"id":166,"slug":167,"slugs":168,"title":172,"excerpt":173,"readTime":174,"views":175,"isPinned":19,"noindex":19,"publishedAt":176,"updatedAt":21,"category":177,"categories":182,"featuredImage":29,"bgImage":30,"posterImage":184,"relatedSolution":29},253,"web-hosting-in-morocco-price-vat-and-a-compliant-invoice",{"fr":169,"en":167,"ar":170,"es":171},"hebergement-web-maroc-prix-et-facturation","استضافة-المواقع-في-المغرب-السعر-والضريبة-والفاتورة-النظامية","alojamiento-web-marruecos-precio-iva-factura","Web Hosting in Morocco: Price, VAT and a Compliant Invoice","What web hosting really costs in Morocco: billing in dirhams, Moroccan VAT, an invoice carrying IF, ICE and RC, and the real cost at renewal.",7,1,"2026-08-13T00:00:00+00:00",{"id":178,"name":179,"slug":180,"color":181,"icon":180},5,"Comparison","comparatif","bg-info\u002F10 text-info",[183],{"id":178,"name":179,"slug":180,"color":181,"icon":180},"\u002Fblog\u002Fcovers\u002Fhebergement-web-maroc-prix-et-facturation-poster.svg",true,1794270419231]