Every file. Someone's trust.

Your activity,
its real flows.

A buyer's file alone can carry an ID copy, proof of income, a bank statement and financing details. Add the prospects collected from the website, listing portals and trade shows, the video surveillance running at sales offices and construction sites, and the remote signatures and transfers handled for clients living abroad, and the real flow is far wider than one contract folder.

RGPD Conseil Maroc works on data protection governance, formalities, contracts, procedures and evidence. The mission does not constitute a notarial review, an anti-money-laundering audit, nor an exhaustive analysis of all the construction or real-estate regulations applicable to the agency or developer.

Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.

Triggers
most common.

A mission may begin before a launch, during a negotiation or after a gap appears.

New listing channel

A new portal, a CRM, a lead-generation campaign or a partnership with a foreign agency.

External sharing

Notary, bank, financing partner, syndic or a tool hosted outside Morocco.

Incident or control

A leaked prospect list, a misdirected file or the need to demonstrate your measures.

A journey
in four stages.

Decisions and limits are made visible at each stage.

Map

First contact, viewings, reservation, financing, signature and the overseas clients in the pipeline.

To prioritize

ID numbers, financing files, prospect lists, video surveillance and remote transactions.

Secure

Roles, contracts, procedures, authorizations, traceability and continuity.

Control

Access reviews, incidents, new channels, partners and documentation.

What the documents
Don't always show.

These situations are points of analysis, not automatic conclusions.

Identity copy

The CNDP specifically targets ID-number processing under its authorization regime, yet copies are often kept well past the sale.

A prospect list that travelled

Contacts gathered from the website, portals and trade shows end up in a spreadsheet with no clear owner.

Unannounced surveillance

Cameras at the sales office or the construction site run without the notice people are entitled to.

A financing file at the wrong desk

Income, bank statements and credit details reach staff who have no reason to see them.

A remote client's exposure

Overseas clients sign and transfer funds through tools sometimes hosted outside Morocco, with no transfer mechanism in place.

Retention that outlives the deal

Anti-money-laundering vigilance can extend how long documents are kept, which needs a documented rule, not a guess.

Measures that
teams can apply.

Each check must have a responsible person, frequency and proportionate proof.

Minimised buyer files

Collect only what each stage of the sale needs, and retire what the next stage doesn't.

Owned prospect lists

One register, one owner, with a clear source and retention period for every contact.

Disclosed surveillance

Clear notice at sales offices and construction sites, with a defined retention period.

Restricted financing access

Limit income and credit files to the staff whose role requires them.

Framed remote transactions

Contracts and transfer mechanisms for every tool and partner used with clients abroad.

Documented retention

A written rule for how long each document is kept, including anti-money-laundering requirements.

What RGPD Conseil Maroc
Leave it to your teams.

The final scope depends on maturity, risks and elements already available.

Client journey mapping

First contact, viewing, reservation, financing, signature and handover.

Priority register

Sensitive processing, purposes, legal bases, retention and existing measures.

Access matrix

Sales, financing, legal and external profiles.

Incident procedure

Qualification, roles, escalation, evidence and communications.

Partner review

Notaries, banks, financing partners, portals and foreign tools.

Control plan

Access, surveillance footage, sharing, archiving and periodic testing.

GDPR and law 09-08,
I didn't confuse them.

The same activity may fall within both frameworks for different reasons.

EU

GDPR

Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.

MA

Law 09-08

Treatment in Morocco, rights, security and formalities of declaration or authorization.

↔

International flows

Access, hosting, recipients, mechanism, context and additional measures.

✓

Evidence

Contracts, registers, decisions, controls, training, incidents and actions followed.

Start small

Start small.
Maintain if necessary.

The amounts are confirmed after scoping; no fictitious pricing is published.

DIAGNOSIS

Starting point

Targeted interviews, review of available elements, major risks and sectoral roadmap.

Fixed price · after scoping TARGETED MISSION

Priority base

Agreed deliverables, corrections, review meeting and operational transfer to internal managers.

From — on estimate ACCOMPANYING

Continuous management

Volume, deadlines, meetings, controls, new projects and contract overruns.

Subscription · on quote

Advise

Advise, structure
and advance.

RGPD Conseil Maroc provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.

• Penetration tests, forensic investigations and certifications are carried out by competent experts.
• Reserved legal consultations and litigation are directed to a lawyer.
• Sectoral regulations excluding data protection remain outside the scope unless expressly stated.

Incidents and rights →CNDP formalitiesGDPR responsibilities

Specific responses

Specific responses.
Contextualized decisions.

These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.

Does collecting a buyer's ID copy always require CNDP authorization? −

The CNDP specifically addresses ID-number processing within its authorization regime. Whether a given file needs authorization or a simple declaration depends on the processing and who is responsible for it. RGPD Conseil Maroc prepares the analysis and the file without promising the CNDP's decision.

Can a prospect list from a listing portal be reused for marketing? +

It depends on what the person agreed to when the contact was collected and what the portal's own terms allow. A mismatch between the original purpose and a later marketing use is one of the most common gaps in this sector.

Does RGPD Conseil Maroc handle the notarial or anti-money-laundering side of a sale? +

No. RGPD Conseil Maroc examines data protection governance, available evidence, contracts, access and procedures. Notarial review, anti-money-laundering audits and construction-law compliance are handled by the competent specialists.

What about clients who sign and pay from abroad? +

Remote signature and payment tools often involve a transfer of data outside Morocco, which needs the right mechanism and should be reviewed alongside the agency's or developer's own hosting choices.

How long should a buyer's file be kept after the sale closes? +

Retention should follow a documented rule that accounts for both data protection principles and any anti-money-laundering vigilance obligations that apply to the transaction, rather than being kept indefinitely by default.

Your sector deserves A concrete scoping.

Present your tools, data, customers, suppliers, countries and deadlines. RGPD Conseil Maroc will indicate the first useful perimeter.

Keep reading

• Serve your mission. Protect your people.
• Convert customers. Keep their trust.
• Health data. Essential trust.
• Welcome guests. Control their data.