Law 09-08 in Morocco: vehicle GPS tracking and CNDP compliance

Putting GPS tracking on your fleet also means processing data about people. The trips of a vehicle assigned to a driver show where that driver is, when they drive and how they drive. In Morocco, this processing falls under Law 09-08 on the protection of individuals with regard to the processing of personal data.

None of this is insurmountable. Thousands of Moroccan fleets are equipped and compliant. But compliance doesn't happen by accident, and a few practices make the difference between a sound setup and one that can be challenged. Here is an overview from a fleet manager's point of view. One useful caveat: this article is for information and doesn't replace a lawyer's advice on your specific situation.

What Law 09-08 covers, in brief

Passed in 2009, Law 09-08 governs the collection, processing and retention of personal data in Morocco. It created the CNDP, the national commission for the protection of personal data, with which processing operations must be declared.

A GPS position on its own isn't personal data. It becomes personal data as soon as it can be linked to an identifiable person, which is the case whenever a known employee drives the vehicle. Fleet tracking is therefore processing of personal data, with the obligations that come with it.

A legitimate and proportionate purpose

The first principle: the system must serve a specific, proportionate business purpose. Securing vehicles and goods, optimizing routes, billing by the kilometer and fighting fuel theft are all accepted purposes, because they are part of running a transport business normally.

What doesn't pass is surveillance for its own sake. Tracking an employee outside working hours, or using location data to monitor anything other than work activity, falls outside the framework. A common good practice is to provide a switch-off mode or privacy windows when a company car is used outside of work.

Inform employees before the system goes live

The second pillar, and the most important one in practice: drivers must be informed before tracking starts. The notice has to cover the fact that tracking exists, what data is collected, the purpose, who receives the data and how long it is kept.

In practice, that means an internal memo handed over against a signature, a clause in the employment contract or the company rules, and ideally a spoken briefing where people can ask questions. Fleets that take care over this step notice something unexpected: the system is better accepted when it is presented as a management and protection tool rather than discovered by chance. A tracker installed on the quiet, by contrast, undermines everything, from trust to the legal value of the data collected.

Declare the processing to the CNDP

Vehicle tracking must go through a formal filing with the CNDP before it is put in place. The Commission has published a specific framework for tracking vehicles used by employees, which sets out the accepted purposes and the conditions of processing. The file is easy to prepare if you have the basics ready: purpose, categories of data, retention period and security measures.

This step is often seen as an administrative chore. In reality it works like insurance. In a dispute with an employee or a third party, a declared and documented processing operation carries far more weight than a system installed without any filing.

Data hosting: the question people forget

Law 09-08 places conditions on transferring personal data abroad, including an authorization when the destination country doesn't provide an adequate level of protection. This is where choosing a provider becomes a compliance decision. If your tracking solution hosts its servers in Europe or the United States, your location data leaves the country, with the formalities that implies.

Tracky's servers are in Morocco. Our customers' positions, trips and fuel data never cross a border. That simplifies the CNDP file and meets the requirements of public-sector clients, for whom data location is often a disqualifying criterion in calls for tender.

Retention and employees' rights

Data can't be kept forever. The retention period has to match the purpose. For fleet management, a history of a few years covers operational, billing and dispute needs. At Tracky, history is kept for two years and then deleted.

Employees also keep their rights of access and correction: a driver can ask to see the data that concerns them. A well-designed system plans for this, with role-based access that lets you answer the request without exposing other drivers' data.

What a non-compliant fleet risks

Law 09-08 comes with criminal penalties. Undeclared processing, or processing diverted from its purpose, exposes the company to fines, and the most serious cases to prison sentences. The CNDP also has inspection powers, and any employee who feels wronged can file a complaint with it.

The most frequent risk lies elsewhere, though. In labor courts, data from a system that was never declared, or installed without informing employees, loses its value as evidence. A fleet that dismisses someone based on GPS trips collected outside the rules may see that evidence thrown out, and the dispute turn against it. Compliance isn't just a constraint. It's what makes your data usable against the other party.

The fleet manager's checklist

To sum it up as a checklist: a written, proportionate business purpose; documented employee notice, signed before the system goes live; the CNDP filing completed; data hosted in Morocco or a properly authorized transfer; a defined retention period; role-based access; and a procedure for handling access requests.

If you equip your fleet with Tracky, some of these boxes tick themselves: hosting in Morocco, history capped at two years, role-based access. The rest depends on your internal documents, and our team can point you to the templates our customers use. Bring it up during your demo.