Call centres in Morocco: GDPR and data protection

The firm advises call centres and outsourcing platforms (offshoring, nearshoring, BPO) setting up in Morocco on behalf of European clients. The challenge is twofold: processing the personal data of European Union citizens in Morocco under the General Data Protection Regulation (GDPR), while complying with Moroccan Law No. 09-08 and the oversight of the National Commission for the Control of Personal Data Protection (CNDP).

As a legal expert on European Union-funded programmes, Maître Abdelatif Laamrani combines a European reading of the rules with first-hand knowledge of how they are applied in Morocco. We work in English, French, Spanish and Arabic, in the client's language.

GDPR audits

Our audits start from how the operation actually runs, not from a theoretical checklist: mapping of data flows between the European client and the Moroccan site, records of processing activities (Article 30), allocation of controller and processor roles, review of contracts against Article 28, and security of workstations, remote access and CRM tools.

In the absence of an adequacy decision for Morocco, transfers out of the European Union are secured through the European Commission's Standard Contractual Clauses and a transfer impact assessment, aligned with the formalities required by the CNDP. The client receives a prioritised remediation plan that holds up in a client audit and before any regulator.

Outsourced DPO services

Few call centres have an in-house Data Protection Officer (DPO) who is both independent and fluent in the European and Moroccan frameworks. The firm acts as outsourced DPO (Articles 37 to 39 GDPR): point of contact for regulators and clients, handling of data subject requests within statutory deadlines, data protection impact assessments for high-risk processing, management of personal data breaches and their notification within 72 hours, and training of supervisors and agents.

The European client deals with a qualified lawyer; the call centre gains a decisive edge in competitive tenders.

Data protection policies

Compliance must be demonstrated in writing. The firm drafts the documentation that evidences it under the accountability principle: privacy notices, information security policy, retention and deletion policy, breach response and data subject request procedures, an agent code of conduct, and the framework for sub-processing. These documents are written to be applied on the floor, not to sit in a binder.

Call recording and consent

Call recording is where a call centre's legal exposure is concentrated. The firm determines the lawful basis for each purpose (consent, performance of a contract or legitimate interest), the notice played at the start of the call and the right to object, a proportionate retention period (quality, training, proof of a sale), restricted access to recordings, and the suspension of recording when payment card details are captured.

Outbound telemarketing campaigns are calibrated to the rules of the consumer's country and to CNDP requirements, so that no call becomes the source of a penalty.

IT outsourcing contracts, online reputation and digital disputes: see our digital law page.

Frequently asked questions

Is a call centre based in Morocco subject to the GDPR?

Yes, where it processes the data of people located in the European Union on behalf of a European client, or targets those people itself. It also remains subject to Moroccan Law No. 09-08 and to CNDP oversight.

How can personal data be transferred from the EU to Morocco?

Morocco has no adequacy decision. Transfers therefore rely on the European Commission's Standard Contractual Clauses, supplemented by a transfer impact assessment and appropriate security measures.

Is consent required to record calls?

Not always. The lawful basis depends on the purpose: consent, performance of a contract or legitimate interest. Informing the caller at the start of the call and honouring the right to object are, however, always required.