Playbook · Compliance

CNDP compliance for an AI agent in Morocco: the operator's guide

TL;DR — An AI agent that processes personal data in Morocco falls under Law 09-08 and CNDP oversight. Compliance takes 10–15 business days: data mapping, legal basis, CNDP declaration or authorization, cross-border transfer framing (OpenAI, Anthropic, Google), DPAs with processors, processing register, and user information.

Why CNDP applies to your AI agent

Law 09-08 protects individuals regarding personal data processing. As soon as an AI agent captures a name, phone number, email, conversation history, voice or photo of a person in Morocco, it's a processing operation under the law — regardless of whether the AI runs at OpenAI, Anthropic, Mistral or on a server in France.

The CNDP (National Commission for the Control of Personal Data Protection) is the supervisory authority. Depending on purpose, processing requires either a prior declaration, an authorization, or a prior opinion. Fines reach 300,000 MAD and personal liability extends to the company director.

The 5 things that sink an AI project

1) No clearly documented legal basis for AI use. 2) Transfers to the United States (OpenAI, Anthropic, Google) without safeguards. 3) No signed DPA with the LLM vendor or the WhatsApp BSP. 4) Indefinite retention of conversation logs. 5) No visible user notice (GDPR-like banner at chatbot entry).

The 7 compliance steps

Pre-requisites

  • Functional description of the AI agent (use cases, channels, data captured)
  • List of technical processors (LLM, BSP, hosting, CRM)
  • Existing contracts / DPAs with those processors
  • Current site privacy policy
  • CNDP portal account to upload the declaration

  1. Step 1

    Day 1 — Data mapping

    List every data point captured by the agent: identity, contact, conversation content, metadata (IP, timestamps), CRM enrichments. For each field: purpose, retention period, recipients, processors.

  2. Step 2

    Day 2 — Legal basis qualification

    Pick the legal basis per purpose: consent (marketing, profiling), contract performance (support, orders), legitimate interest (anti-fraud), legal obligation (invoicing). Document the balancing test for legitimate interest.

  3. Step 3

    Days 3–4 — Framing cross-border transfers

    OpenAI, Anthropic, Google process from the US. CNDP requires safeguards: signed DPA, standard contractual clauses, and ideally a transfer authorization for sensitive data. Enable no-training options (OpenAI zero-retention, Anthropic no-training) and document.

  4. Step 4

    Day 5 — DPAs with all processors

    Sign a Data Processing Agreement with: the LLM vendor, the WhatsApp BSP (360dialog, Twilio, Gupshup), hosting provider, CRM, and any analytics tool. The DPA specifies controller instructions, security measures, and sub-processing conditions.

  5. Step 5

    Day 6 — Processing register and retention

    Build the internal register (GDPR-like Article 30): one processing = one row. Set explicit retention: conversations 90 days, technical logs 13 months, customer data for relationship duration + 3 years. Implement automatic purge.

  6. Step 6

    Days 7–8 — User information and rights

    Notice at chatbot entry ("This assistant is an AI, your messages are processed for [purpose]. See privacy policy"). Update the privacy policy with: purposes, legal basis, retention, recipients, transfers, rights (access, rectification, objection, erasure). Link to a rights-exercise form.

  7. Step 7

    Days 9–10 — CNDP declaration or authorization request

    File the package on the CNDP portal. Simple declaration covers most cases (customer relationship, support). Authorization request needed for profiling, sensitive data (health, opinions), or transfers to non-adequate countries without recognized safeguards. Count 30–60 days for the receipt or authorization.

Questions fréquentes

Does a WhatsApp AI agent need to be declared to CNDP?+
Yes, as soon as it processes identifying data (number, name, conversation content). A prior declaration suffices for classic customer-relationship purposes. An authorization request is required for marketing profiling or unframed transfers.
Can we use OpenAI or Anthropic in Morocco and stay compliant?+
Yes, provided you sign their DPA, enable zero-retention / no-training options, inform users about the US transfer, and document the safeguards (contractual clauses, technical pseudonymization of data sent to the LLM).
How much does CNDP compliance for an AI agent cost?+
Expect 25,000 to 60,000 MAD for an SMB project: mapping, drafting documents (DPA, policy, register), filing the declaration and advisory support. An authorization (profiling, sensitive data) adds 15,000 to 30,000 MAD depending on file complexity.
What retention period for AI conversations?+
Operational recommendation: 90 days for active conversations, 13 months for aggregated and pseudonymized technical logs. Beyond that, data must be anonymized or deleted. Any longer period must be justified by an explicit purpose (litigation evidence, accounting obligation).
What's the risk of a CNDP audit without a declaration?+
Administrative fines up to 300,000 MAD per breach, injunction to suspend processing, and publication of the decision. Director-level criminal liability can apply for serious breaches (unfair collection, unlawful transfer of sensitive data).

/ À lire ensuite

Un brief technique sur ce sujet ?

Atelier de cadrage gratuit. Un fondateur, pas un commercial.

WhatsAppFormulaire de contact