Does GDPR apply to non-EU companies? Morocco and MENA guide

RGPD Conseil Maroc · Updated 6 October 2026

GDPR can apply to a non-EU company depending on its establishments and activities targeting people in the Union. A supplier’s commitments to a European customer require a separate assessment. A person’s nationality or the existence of a European customer is not, by itself, a complete applicability test.

Describe activities and affected people

Record who buys, who uses the service and where affected people are during the activity. Separate employees, users, applicants and business contacts. Gather evidence of market targeting and links with any European establishments. This factual brief supports a better assessment than a yes/no answer based on headquarters alone.

Separate your product from work performed for customers

A business may manage its own contacts while also processing data for a customer. Map these activities separately. Service commitments and access arrangements still need examination where direct GDPR applicability requires further assessment. Define the role for each processing activity.

Build a proportionate plan

Group the work into applicability questions, customer commitments and operating arrangements. Assign an owner to each open issue. Start with decisions affecting launch or signature, then address the ongoing programme. Documents should describe your tools and practices rather than simply repeat a downloaded template.

Keep the local dimension in view

For Morocco, scoping also considers processing and formalities under Law 09-08. For a multi-country MENA activity, prepare a matrix by entity and data flow. The engagement should name the questions addressed, necessary approvals and expected deliverables. RCM can start with this assessment before proposing an audit or ongoing support.

Illustrative example: a Moroccan SaaS business supplies a French company and also recruits staff in Morocco. These activities need separate records. Roles, affected people and tools may differ between the two.

Your starting dossier

• Entities and establishments
• Target markets and users
• Roles by activity
• Contracts, flows and local questions

Describe the situation without submitting customer records, passwords or confidential documents in the initial form.

Practical questions

What should I prepare before contacting RCM?

Prepare: Entities and establishments; Target markets and users; Roles by activity; Contracts, flows and local questions. Include your deadline and unresolved decisions. A summary is enough for the initial conversation.

Does an introductory call replace the engagement?

No. The introductory conversation clarifies your requirements. A proposal then defines documents reviewed, deliverables, responsibilities and price before work starts. Customer or regulator decisions are not guaranteed.

Continue preparing

European client GDPR requirements: documents for Moroccan suppliers

Prepare GDPR contracts, data-flow records and supporting evidence when a European customer reviews your Moroccan company. Practical supplier checklist.

Read the guide

CNDP filing in Morocco: prepare your company’s documentation

Prepare a Moroccan CNDP filing: processing activities, purposes, data, providers and international flows. Identify documents and open questions before submission.

Read the guide

Keep reading

• Call centre GDPR audit: prepare your Moroccan BPO for a client review
• DPA, SCCs and TIA: which transfer documents do you need?
• When is a DPIA required?
• EU hosting with overseas support: GDPR access checks