The framework
The operative statute in Morocco is Law No. 09-08 on Personal Data Protection (2009), enforced by the CNDP.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Law No. 09-08 on Personal Data Protection
Morocco's CNDP is one of Africa's most active authorities, running registration, audits and public campaigns under a 2009 law; a GDPR-alignment reform has been in preparation to match the EU adequacy ambition.
Marketing and advertising
Consent-first with prior declaration or authorization duties; direct marketing requires prior consent. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Transfers abroad require CNDP authorization, based on an adequacy-style assessment of the destination.
Enforcement and penalties
The law provides for fines and criminal penalties. How often the authority actually enforces sets the real price.