Outsourcing to Morocco and MENA: privacy checklist for EU buyers

RGPD Conseil Maroc · Updated 6 October 2026

Before sharing data with a supplier in Morocco or MENA, describe the service, roles and necessary access. Request proportionate evidence, review contracts and the international flow, and record conditions for starting. Revisit the assessment when the service or its suppliers change.

Assess a specific service

Start with delegated tasks and the information genuinely needed. Development without production data and customer support with full access have different scopes. Define minimum access and approved environments before sending the supplier a standard questionnaire.

Request decision-useful evidence

Collect an architecture description, access list, downstream providers and relevant procedures. Dossier size is not a substitute for quality. Allow the supplier to explain controls and limitations. Classify gaps according to their effect on the service and affected data.

Prepare commitments and exit

The onboarding pack should identify contacts, assistance, provider changes and exit arrangements. Prepare a return or deletion scenario. Procurement, business and IT teams need to understand the agreed conditions so later usage does not exceed the assessed scope.

Use a dedicated review contact

RCM can coordinate questions and a supplier’s documentary review, then provide gaps and actions. The internal decision-maker retains risk acceptance and the commercial choice. Start with a per-supplier engagement; recurring volumes can subsequently be organised under an agreed contract.

Illustrative example: a French SME compares two offshore suppliers. It provides the same service scenario and questions to both, then compares evidence, gaps and remediation effort. This produces a more useful comparison than generic compliance declarations.

Your starting dossier

• Tasks and minimum access
• Evidence and blocking issues
• Contracts and international flows
• Start and exit conditions

Describe the situation without submitting customer records, passwords or confidential documents in the initial form.

Practical questions

What should I prepare before contacting RCM?

Prepare: Tasks and minimum access; Evidence and blocking issues; Contracts and international flows; Start and exit conditions. Include your deadline and unresolved decisions. A summary is enough for the initial conversation.

Does an introductory call replace the engagement?

No. The introductory conversation clarifies your requirements. A proposal then defines documents reviewed, deliverables, responsibilities and price before work starts. Customer or regulator decisions are not guaranteed.

Continue preparing

European client GDPR requirements: documents for Moroccan suppliers

Prepare GDPR contracts, data-flow records and supporting evidence when a European customer reviews your Moroccan company. Practical supplier checklist.

Read the guide

GDPR vendor questionnaire: prepare answers and supporting evidence

Answer GDPR vendor questionnaires with evidence on roles, contracts, hosting, access and corrective actions. A practical guide for suppliers and buyers.

Read the guide

EU hosting with overseas support: GDPR access checks

EU servers and overseas teams? Map support access, exports, providers and legal entities before assessing GDPR international transfers.

Read the guide

Keep reading

• Call centre GDPR audit: prepare your Moroccan BPO for a client review
• DPA, SCCs and TIA: which transfer documents do you need?
• When is a DPIA required?
• EU hosting with overseas support: GDPR access checks