The processing of personal data is subject to:

• A prior declaration to be filed with the Moroccan Data Protection Commission; or
• A prior authorization of the Moroccan Data Protection Commission when the processing concerns any of the following:
  
  • Sensitive data (e.g. revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, including genetic data);
  • Using personal data for purposes other than those for which they were initially collected;
  • Genetic data, except for those used by health personnel and that respond to medical purposes;
  • Data relating to offenses, convictions or security measures, except for those used by the officers of the court;
  • Data which includes the number of the national identity card of the concerned person.

The declaration and authorization includes a commitment that the personal data will be treated in accordance with the DP Law.

The prior declaration and authorization shall include, without limitation, the following information:

• The name and address of the person in charge of the processing and, if applicable, its representative;
• The name, characteristics and purpose(s) of the intended processing;
• A description of the category or categories of data subjects, and the data or categories of personal data relating thereto;
• The recipients or categories of recipients to whom the data are likely to be communicated;
• The intended transfers of data to foreign states;
• The data retention time;
• The authority with which the data subject may exercise, if any, the rights granted to him / her by law, and the measures taken to facilitate the exercise of these rights;
• A description of the confidentiality and security measures in place to protect personal data; and
• Overlap, interconnections, or any other form of data reconciliation and their transfer, subcontracting, in any form, to third parties, free of charge or for consideration.