Morocco’s CNDP issues personal data rules for 2026 election campaign

A polling station in Rabat. . AFP or licensors

Morocco’s National Commission for the Control of Personal Data Protection (CNDP) has set out rules for political parties on handling personal data during the 2026 parliamentary elections, including requirements on voter information, political opinions, direct marketing, artificial intelligence and data transfers.

On 30/08/2026 at 08h00

In a statement, the CNDP said that ahead of the election of members of the House of Representatives, scheduled for Wednesday, September 23, 2026, it had reminded political parties of the rules they must follow, in accordance with the applicable legal provisions and recognized principles governing the protection of personal data.

The Commission subsequently decided to inform all citizens, particularly voters, of these requirements. First and foremost, the statement said, they must comply with Law No. 09-08 by notifying the CNDP of any personal data processing before carrying it out, in accordance with Article 12 of the law.

The CNDP also stressed the need to respect the purpose for which data is collected and the period for which it is retained, under Article 3, while prohibiting the use of political opinions without explicit consent, pursuant to Article 21, paragraphs 1 and 2. The Commission also warned against any direct marketing practices without prior consent, in accordance with Article 10 of Law No. 09-08.

Regarding artificial intelligence (AI), the Commission called for any AI-generated content to be clearly identified, citing Article 447-2 of Morocco’s Penal Code and Articles 39, 51 and 53 of Organic Law No. 53-25 relating to the House of Representatives. The CNDP also recommended that personal data be collected fairly and transparently, in accordance with Article 3, and that the rights of data subjects be guaranteed, as set out in Chapter II, Articles 5 through 9.

The CNDP also stressed the need to regulate outsourcing through contracts compliant with Law No. 09-08, pursuant to Articles 23 and 25. It further called for compliance with the law in any transfer of data, referring to Articles 15 and 18 and Chapter V, Articles 43 and 44.

The Commission also called on the parties concerned to comply with their obligations, cooperate and assume responsibility for the protection of personal data.

As part of its openness to its wider environment and its support for this important democratic stage, the Commission has made a dedicated hotline, 3020, available to the public for requests for clarification or further information regarding these rules, as well as for matters relating to the protection of personal data throughout the different stages of the electoral process, the statement concluded.

By Le360 (with MAP)
On 30/08/2026 at 08h00