Data transfers between
the EU and Morocco.

What is this service?

A transfer of data outside the European Union happens as soon as EU personal data is sent to, stored in or simply viewed from a third country. An agent in Morocco looking at a customer database hosted in France is therefore making a transfer under the GDPR.

Morocco does not have an adequacy decision from the European Commission. These transfers must be covered by appropriate safeguards, most often the Commission’s Standard Contractual Clauses (SCCs), together with a Transfer Impact Assessment (TIA) and, where needed, supplementary measures.

Who is it for?

This service is for European companies working with a team, provider or support desk in Morocco, and for Moroccan companies that receive data from European clients.

Situations that trigger the engagement

• Opening a team or subsidiary in Morocco with access to head-office systems.
• Outsourcing customer service, development or payroll to a Moroccan provider.
• A European client asks for the signed SCCs and the transfer impact assessment.
• Adding a new tool or sub-processor located outside the European Union.

Issues we see most often

• Remote access from Morocco not recognised as a transfer.
• SCCs signed in an old version, or in a module that does not match the real roles.
• No transfer impact assessment, although one has been expected since the Schrems II ruling.
• Privacy notices that do not mention transfers outside the EU.

What the engagement includes

The engagement starts from a map of real data flows, then produces the documents suited to each relationship between data exporter and importer.

Deliverables

• Data flow map: who sends which data, to whom, from which country and with which tools.
• Role assessment: controller or processor, and the matching SCC module.
• Standard Contractual Clauses: completed SCCs with their annexes: description of transfers and security measures.
• Transfer Impact Assessment: an assessment of the destination country’s legal framework and the supplementary measures chosen.
• Notice updates: wording to add to the privacy policy and the record of processing.

What you provide

A description of the teams and providers involved, existing contracts, the tools used and a technical contact to describe access and encryption.

Typical process

Measures that strengthen a transfer to Morocco

A transfer impact assessment is not limited to the destination country’s law: it also looks at the practical measures that reduce risk. The most common are encryption of data at rest and in transit, access limited to what is strictly necessary, logging of access, and hosting the data inside the European Union.

For Moroccan companies, these same measures are often the strongest arguments with a European client. We document them so they can be reused in your questionnaire answers and tender responses.

Important limits

SCCs and a TIA are compliance documents; their effectiveness depends on the measures described being applied in practice. A complex question of foreign law may require specialist legal advice.

RCM provides compliance and DPO support. RCM is not a law firm. When specialized legal consultation or litigation representation is necessary, it must be entrusted to an authorized professional.

Talk about your situation

Present the context, timeline and actors. We will tell you if this service really meets your needs.