For international companies operating in Morocco, data protection compliance is not limited to GDPR requirements or to the privacy policies adopted by the group at headquarters level. Morocco has its own data protection framework, primarily governed by Law No. 09-08 relating to the protection of individuals with regard to the processing of personal data (Loi n° 09-08 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel). Compliance is supervised by the Moroccan Data Protection Authority (Commission Nationale de contrôle de la protection des Données à caractère Personnel – CNDP). This creates an important practical issue for