Installing cameras on your premises — entrance, parking, warehouse, open space — looks like a simple security decision. In Morocco it is also a compliance one: a camera films identifiable people, so it processes personal data, and Law 09-08 puts those processings under the CNDP’s control. Since the authority ended its awareness phase in February 2025, it runs active controls — and video surveillance, being highly visible, is part of them.
This guide explains, concretely, what to declare before installing cameras, the difference between declaration and authorization, how long you may keep the footage, and how to inform the people filmed. It complements our CNDP declaration guide, which covers Law 09-08 as a whole. As always, we stay on operational ground: the legal qualification of your case belongs to your counsel.
Is video surveillance covered by Law 09-08?
Direct answer: yes. As soon as a camera captures the image of identifiable people — employees, clients, visitors, passers-by — it processes personal data within the meaning of Law 09-08. The CNDP is therefore competent, and a prior formality is required before the system goes live.
The “they’re just security cameras” reflex is exactly what creates exposure: the security purpose does not exempt you from the formality, it frames it.
Declaration or authorization: what must you file?
Direct answer: for ordinary security use, a prior declaration with the CNDP; for sensitive uses or purposes beyond plain security, a prior authorization.
The declaration is the common-law regime: it is filed on the CNDP portal (cndp-forms.ma) before installation, and describes the system — controller, purpose, camera locations and filmed perimeter, retention period, who can access the footage, security measures, any transfers. When the video surveillance serves a purpose other than the security of people and property, or touches a sensitive context, the CNDP requires a prior authorization — its approval must precede installation. Determining which applies to your case is a legal qualification: that is your counsel’s ground. Our role starts after: making sure what is filed matches what is actually installed.
The declaration is prior — before you install, not after
Direct answer: the formality is filed before the cameras go live, not once they are already running.
This is the most common mistake: install first, “regularize” later. The Moroccan regime is built for the opposite. Video surveillance operated without the prior formality — or for a purpose other than the one declared — is a purpose deviation, heavily sanctioned by law (prison terms and fines that can reach 200,000 dirhams). Beyond the penalty, it is a commercial exposure: a client, insurer or partner who discovers undeclared cameras reads it as a sign of failing governance.
What the CNDP expects, in practice
Direct answer: six obligations frame a compliant video-surveillance system.
- A legitimate, proportionate purpose. The security of people and property, not the permanent surveillance of employees.
- A prior declaration (or authorization). Filed before installation, accurate and up to date.
- Informing the people filmed. Visible signage at the entrance of monitored areas — the CNDP publishes template notices for this.
- A limited perimeter. No cameras in private spaces (toilets, locker rooms, break rooms) or permanently trained on workstations.
- A limited retention period. Footage is not kept indefinitely — the reference rule caps retention at one month (often three months maximum depending on context). Beyond that, it must be deleted.
- Restricted, secure access. Only authorized people reach the recordings, on named accounts, with protected and logged storage.
The case of workplace cameras
Direct answer: filming your employees is possible, but tightly framed — proportionality comes first.
Workplace video surveillance is for security, not the continuous monitoring of employee activity. Cameras must not place a workstation under permanent surveillance, nor film break areas or staff-representation spaces. The people concerned — and, where applicable, representative bodies — must be informed. Here too, the exact boundary belongs to your counsel; the operational principle is simple: film strictly what is necessary, for the sole purpose of security, and document it.
How HackingByte helps
The declaration carries an implicit promise: “this footage is protected.” Our job is to make that true and demonstrable — access control over the recordings, named accounts, logging, encrypted storage, retention periods actually enforced. As part of our Law 09-08 readiness and our security assessments, we verify that the security of the footage holds against a control — or an attack. We do not provide legal advice: qualifying your video surveillance and filing belong to your counsel; we make the security measure real.
Where to start
Before you install — or if your cameras already run without a formality — the sequence is simple: inventory your devices and their purpose, qualify the formality with your counsel, file with the CNDP, then lock down access to and retention of the footage. A scoping call is enough to size the security part.
Request a scoping call · GRC advisory
Frequently asked questions
Must you declare security cameras to the CNDP?
Yes. A camera that films identifiable people processes personal data under Law 09-08; a prior formality with the CNDP is required before the system goes live. The precise qualification belongs to your counsel.
Declaration or authorization for video surveillance?
For ordinary security use, a prior declaration on the CNDP portal. For a purpose other than security, or a sensitive context, a prior authorization — the CNDP’s approval must precede installation.
Do you declare before or after installation?
Before. The formality is prior: it is filed before the cameras go live. Installing and then “regularizing” is exactly what the regime forbids.
How long can footage be kept?
Retention is limited — the reference rule is one month, up to three months maximum depending on context. After that, the footage must be deleted. The chosen period must appear in the formality.
Can you film employees at work?
Yes, but proportionately: for security, without permanently monitoring workstations, without cameras in private spaces, and after informing the people concerned. The exact boundary belongs to your counsel.
Must you inform the people filmed?
Yes. Visible signage must inform people at the entrance of monitored areas (controller identity, purpose, rights); the CNDP publishes template notices for this.
What is the risk without a declaration?
Undeclared video surveillance, or surveillance diverted from its purpose, exposes you to penalties set by law (up to prison terms and fines reaching 200,000 dirhams) and, since February 2025, to active CNDP controls — on top of the commercial exposure.
Related services
- Law 09-08 readiness — bring the security of the footage and the evidence up to what you declare.
- Security assessments — verify that access to and storage of the recordings actually hold.
- GRC advisory — embed video surveillance in durable data governance.
Read also: Morocco’s CNDP and Law 09-08: a practical compliance guide. Operating in Morocco? See how we work: Cybersecurity in Morocco.