The National Authority has set up a digital portal on its website enabling those concerned by the processing of personal data to create an account and fill in electronic forms with the below:

• For prior declaration of processing operations;
• Requests for authorisation; and
• Requests for opinions.

Applicants may also monitor the status of their requests. The processing of personal data is subject to the below:

• A prior declaration must be filed with the National Authority by the data controller of a private or public entity whenever the latter is likely to receive, store and process personal data. This declaration must be renewed before any new data is processed; or
• A prior authorization of the National Authority when the processing concerns any of the following:
  • transfer of personal data abroad;
  • communication of data to a third party;
  • The interconnection of data belonging to one or more legal entities managing a public service for different purposes relating to the general interest must be authorised by the National Authority.

Article 3 of the law No. 18-07 defines “data interconnection” as (free translation): “(…) any mechanism of connection involving the linking of processed data for a specific purpose with other processed data, whether for identical or different purposes, by the same data controller or by one or more other data controllers.”

Since 2025, data controllers and subcontractors-processors are required to maintain detailed records of processing activities, including:

• identity and contact details of the controller and, where applicable, the data protection officer;
• purposes and legal basis of processing;
• categories of data subjects and personal data;
• recipients, including international transfers;
• retention periods;
• security measures implemented.

Subcontractors-processors must also maintain records of processing carried out on behalf of controllers.

These records must be made available to the National Authority upon request.