CNDP filing in Morocco: prepare your company’s documentation

RGPD Conseil Maroc · Updated 6 October 2026

Preparing a CNDP dossier starts with identifying the processing activity and its characteristics. The relevant formality and supporting documents are then assessed. Declarations, authorisations and transfer requests address different situations; one form does not automatically cover every activity of a company.

Start with a business inventory

List recruitment, payroll, customers, website, access control and other actual activities. For each, record purpose, affected people, data, tools and internal owner. Avoid an overly broad category such as “business management” that hides different practices. The inventory supports assessment of the required formalities.

Gather facts before completing forms

Verify data categories, recipients, hosting locations and intended retention. Assemble notices, contracts and contact details relevant to the dossier. Have the appropriate teams confirm them. A form consistent with documentation and operations is easier to follow up when clarification is requested.

Examine overseas tools and flows

List HR tools, CRM, messaging and hosting providers with known countries and access. Transfer procedures should be assessed alongside the underlying processing and its formalities. A widely used tool is not automatically authorised. Retain provider information to support the assessment.

Organise signature and follow-up

An RCM engagement can cover document collection, preparation and the pre-submission checklist. The client remains applicant, decision-maker and signatory. Maintain versions, submission dates, follow-up requests and responses. Assistance does not guarantee CNDP approval or processing times.

Illustrative example: a Moroccan SME adopts a cloud HR platform. Before submission it records employee files, provider access, hosting and retention. Processing formalities and transfer questions are assessed using that factual description.

Your starting dossier

• Processing inventory
• Data, notices and supporting evidence
• Tools, hosting and transfers
• Signatory and follow-up log

Describe the situation without submitting customer records, passwords or confidential documents in the initial form.

Practical questions

What should I prepare before contacting RCM?

Prepare: Processing inventory; Data, notices and supporting evidence; Tools, hosting and transfers; Signatory and follow-up log. Include your deadline and unresolved decisions. A summary is enough for the initial conversation.

Does an introductory call replace the engagement?

No. The introductory conversation clarifies your requirements. A proposal then defines documents reviewed, deliverables, responsibilities and price before work starts. Customer or regulator decisions are not guaranteed.

Continue preparing

European client GDPR requirements: documents for Moroccan suppliers

Prepare GDPR contracts, data-flow records and supporting evidence when a European customer reviews your Moroccan company. Practical supplier checklist.

Read the guide

Keep reading

• Call centre GDPR audit: prepare your Moroccan BPO for a client review
• DPA, SCCs and TIA: which transfer documents do you need?
• When is a DPIA required?
• EU hosting with overseas support: GDPR access checks