SaaS Security and Data Protection in Morocco: Law 09-08, CNDP and GDPR

A SaaS stores the data of dozens or hundreds of companies: customers, invoices, employees, sometimes health or banking information. Security and data protection are therefore not a technical option but a condition for selling, especially to structured companies that will ask before signing. This guide summarises the legal framework for a SaaS operated from Morocco, the expectations of European customers and the concrete measures to put in place. It doesn't replace legal advice, but it lets you ask the right questions.

The Moroccan framework: Law 09-08 and the CNDP

In Morocco, the processing of personal data is governed by Law 09-08 on the protection of individuals with regard to the processing of personal data, and supervised by the CNDP (National Commission for the Control of Personal Data Protection). In short, an organisation processing personal data must, among other things: inform the people concerned, obtain their consent where required, limit collection to what's necessary, secure the data, respect access, rectification and objection rights, and complete the prior formalities with the CNDP (declaration or authorisation request depending on the nature of the processing). Transfers of data abroad are also regulated.

For a SaaS, there's a subtlety: your customer (the subscribing company) is generally the controller for its own customers' and employees' data, and you are its processor. Your obligations then concern security, confidentiality, assisting the customer and contractual framing. The data you collect on your own behalf (user accounts, billing, usage) falls under your direct responsibility.

Selling in Europe: GDPR applies

As soon as your SaaS processes data of people located in the European Union, GDPR applies, even if your company is in Morocco. Your European customers will require a data processing agreement (clauses on security, confidentiality, sub-processors, breach notification), guarantees on hosting and transfers outside the Union, and the ability to respond to access, portability and erasure requests. Hosting in the European Union for European customers often simplifies the conversation.

Hosting: where to put the data?

• In Morocco: local hosting providers and cloud offers exist; relevant for customers who require national localisation or for certain regulated sectors.
• In Europe: the major cloud providers offer European regions, with good contractual guarantees for customers subject to GDPR.
• Both: a well-designed multi-tenant architecture lets you host certain customers in a specific region if their contract requires it.

Whatever the choice, document it: your customers will ask where their data is, who has access to it and how it's backed up.

The technical measures that really matter

Access control

• Strong passwords, two-factor authentication, single sign-on (SSO) for companies that request it.
• Fine-grained roles and permissions: each user sees and changes only what their role requires.
• Strict data isolation between customers (see our multi-tenant guide).
• Activity log: who viewed, changed or exported what, and when.

Data protection

• Encryption in transit (HTTPS everywhere) and at rest, particularly for backups.
• Secrets (API keys, database passwords) stored in a dedicated manager, never in the code.
• Automatic, encrypted backups kept in a separate location, and tested through regular restores.
• Minimisation: collect only what's useful, delete what's no longer needed.

Application security

• Dependencies kept up to date and monitored for known vulnerabilities.
• Validation of all inputs, protection against injections, rate limiting on APIs and forms.
• Test environments separated from production, with anonymised data.
• Security review before launch, then at every major change; penetration test for demanding customers.

Operations and incidents

• Monitoring of errors, performance and abnormal access.
• A written incident procedure: who does what, how to notify customers and authorities if required.
• Administrator access limited, logged and revoked when a team member leaves.

What your customers will ask you

Structured companies often send a security questionnaire before subscribing. Prepare in advance a security page or document that answers the recurring questions: data location, encryption, backups, access control, sub-processors, incident procedure, reversibility (data export at the end of the contract). Answering clearly shortens sales cycles.

Security and AI in the product

If your SaaS includes AI features, check that model providers don't train their systems on your customers' data, limit what's sent to them and consider self-hosted models for the most sensitive data. Our AI agents page details these precautions.

Individuals' rights: how to handle them in the product

Beyond principles, Law 09-08 and GDPR give individuals concrete rights: to access their data, have it corrected, object to certain processing, have it erased. For a SaaS, that translates into features: your customer (the controller) must be able to find all of a person's data, correct it, export it in a readable format and delete or anonymise it without breaking the accounting history. Build these functions into each organisation's back office, and document the procedure so your customers can respond within the legal deadlines.

The contract with your customers: clauses to include

• Roles: who is the controller (your customer) and who is the processor (you), for which data and which purposes.
• Security: the measures you commit to maintaining, described precisely but without revealing anything that would help an attacker.
• Sub-processors: hosting provider, email service, AI provider, with prior notice in case of change.
• Location and transfers: where the data is hosted and under which framework it may be transferred.
• Breach notification: timeframe and method for informing your customer in case of a data breach.
• Reversibility: full data export at the end of the contract, format and timeframe, then certified deletion.
• Confidentiality: commitment of your team and your sub-processors.

A contract template prepared with an adviser, ready to sign, considerably speeds up sales to structured companies.

The twelve questions in security questionnaires

1. Where is the data hosted and with which provider?
2. Is the data encrypted in transit and at rest?
3. How is our company's data isolated from other customers' data?
4. Which authentication methods are available (two-factor, SSO)?
5. How is your employees' access to our data controlled and logged?
6. How often are backups made and tested?
7. What is your continuity plan in case of a major outage?
8. Have you carried out security or penetration tests, and when?
9. How are vulnerabilities tracked and fixed?
10. What is your procedure in case of a security incident?
11. Which sub-processors have access to the data?
12. How do we get our data back at the end of the contract?

An incident response plan in six steps

1. Detect: alerts on errors, abnormal access and unusual volumes.
2. Contain: revoke compromised access, isolate the affected component, preserve the logs.
3. Assess: which data, which customers, how long the exposure lasted.
4. Notify: the customers concerned and, where regulations require it, the authorities, within the set deadlines.
5. Fix: close the gap, restore if necessary, check there's no persistence.
6. Learn: write an honest report and change what allowed the incident.

Security by design

Security costs little when planned into the foundations, and a great deal when added after an incident. In every SaaS development project, we build in access control, data isolation, encryption, backups and monitoring from the first version, and document it all for your customers. To assess your situation, contact us.