Using ChatGPT at work in Morocco: Law 09-08 and professional secrecy

Using ChatGPT, Claude, Gemini or Copilot at work is not forbidden in Morocco. The problem is what you paste into them. As soon as a prompt holds a client's name, CIN number, phone number or file, you are processing personal data under Law 09-08, and handing it to a provider that is usually based outside Morocco. The good news: most office tasks work perfectly well without that data.

This guide is for small businesses, accounting firms, law practices, HR teams and sales staff who already use AI, sometimes without any written rule.

Law 09-08 and the CNDP in two minutes

Law No. 09-08 on the protection of individuals with regard to the processing of personal data was enacted by Dahir No. 1-09-15 of 18 February 2009, and its implementing decree is Decree No. 2-09-165 of 21 May 2009. It set up the National Commission for the Control of Personal Data Protection, the CNDP, which informs the public, receives declarations and authorisation requests, inspects processing and can refer cases to the courts or impose sanctions.

On AI, the CNDP published a press release on 18 March 2025 (in French) stating that AI processing using personal data falls under Law 09-08, and announcing work to clarify that framework. The rules keep moving, so check cndp.ma for anything published since.

Three ideas are enough to follow the rest:

• Personal data: any information, in any form (text, sound, image), about a natural person who is identified or identifiable, directly or by combining details.
• Processing: almost any operation on that data, from collecting and storing to consulting, using and disclosing it. Pasting a client file into a chatbot counts.
• Data controller: whoever decides why and how the data is processed. For your clients' data, that is your business or firm, not the AI tool.

What counts as personal data in practice?

The idea is broader than most people think. A name is enough, but so is a combination of harmless-looking details.

The law protects natural persons. A limited company's name or ICE number is therefore not personal data, but a company's contracts, margins or unpublished figures are still confidential. In a small town like Tiznit, "the woman who runs the travel agency near the square" identifies someone as surely as a name does.

Why pasting client data into a consumer AI tool is a problem

Copy, paste, get an answer: it feels harmless. Legally, it raises five questions.

1. The data leaves your control. It goes to the provider's servers, usually outside Morocco, and is kept under the provider's own rules.
2. It may be used for training. On many consumer plans, your conversations can be used to improve the models, depending on your settings. Some providers also say that conversations may be reviewed by people.
3. The law regulates transfers abroad. As a rule, transferring personal data to another country requires that country to offer an adequate level of protection. Otherwise you need CNDP authorisation or one of the exceptions in the law. The CNDP website explains the procedures.
4. You remain responsible. The law requires the data controller to protect the data it holds and to choose service providers that offer sufficient guarantees. It provides for sanctions, including criminal ones.
5. Professional secrecy comes on top. Article 446 of the Moroccan Penal Code punishes the disclosure of secrets by people entrusted with them through their status or profession. A file covered by secrecy has no place in a consumer tool.

What never to paste into an AI assistant

Keep this list next to your screen:

• CIN, passport and CNSS registration numbers.
• Phone numbers, addresses, personal emails.
• RIB, card numbers, bank statements.
• Health data: medical certificates, sick notes, insurance claims.
• Salaries, payslips, disciplinary records.
• Candidate data: full CVs, interview notes, assessments.
• Logins, passwords, access codes, API keys.
• Documents covered by professional secrecy or a confidentiality agreement.
• Data about children and pupils.

Anonymising in practice: three moves

1. Swap names for roles: "the client", "employee A", "supplier B", "the other party".
2. Remove or round the numbers: CIN, phone and RIB disappear; amounts and dates become approximate when the exact value does not change the task.
3. Keep the structure: the type of document, the problem, the steps, the tone you want. That is all the AI needs.

Example: an overdue invoice reminder, before and after

The final prompt becomes: "Write a polite but firm reminder to a client who runs a small business and has an invoice unpaid for two months. Offer to split the payment into three instalments. French, 120 words maximum, no threats." You then add the name, the amount and the invoice number yourself in your email client. The tool never saw the file.

Watch out for combined details: removing the name is not enough if the rest of the text points to one person. Reread your prompt and ask whether a colleague would recognise the client.

Account settings: training, history, temporary chats

Menus change often, so there are no click paths here. Look in the settings for a section called something like Privacy, Data or Data controls, and read the provider's privacy page.

• ChatGPT: a setting lets you stop your conversations being used to improve the models, and there is a temporary chat mode.
• Claude: the privacy settings show whether your conversations may be used to improve the models.
• Gemini: Gemini Apps activity is managed from your Google account; a Google Workspace business account follows different rules.
• Copilot: the consumer version has its own privacy settings; Microsoft 365 Copilot used with a work account falls under the commitments made to the client organisation.

Two important caveats. Turning off training does not mean nothing is stored: providers often keep conversations for a while, for instance to detect abuse. And a temporary chat skips your history, not the trip to the provider's servers.

Personal account or business account?

When every employee uses a free personal account, the company does not know what is pasted, where, or what remains after someone leaves.

A paid individual subscription is not a business plan: it usually stays under consumer terms. And even a business plan does not settle everything: the data still goes to a foreign provider, so the questions of transfer and of informing the people concerned remain. Before processing personal data with an AI tool, have the setup checked by a lawyer or ask the CNDP.

The 6-point checklist before anything leaves the office

1. Do I need all this text? Paste only the relevant extract, never the whole file.
2. Names and numbers removed? Roles instead of names, no CIN, phone, RIB or address.
3. No sensitive data, no secrets? No health, no salaries, nothing covered by professional secrecy.
4. Nobody recognisable by combined details? Job, place and date do not point to a single person.
5. Right account, right settings? An approved business account, training off where the option exists.
6. Does a person check the answer? Figures, names and legal references verified before anything is sent.

A one-page AI policy for a small business or firm

A five-person company does not need a thirty-page document. One clear page, signed by everyone, is enough to start:

• Approved tools: which assistants are allowed, and with which account.
• Red list: the data categories that are never pasted (reuse the list above).
• Anonymisation rule: roles instead of names, no numbers, extracts rather than whole documents.
• Required settings: training off, history managed, accounts tied to the company.
• Human approval: AI drafts; it does not send, sign or decide anything.
• A point person: someone who answers questions and keeps the policy up to date.
• Pasted by mistake: delete the conversation, tell the point person, write down what happened and check with a lawyer whether more is needed.
• Review: reread the policy every six months, because the tools and their terms change.

For professions bound by secrecy, add one simple line: no client document goes into an AI tool without the written approval of the partner in charge.

Going further, by profession

Each profession has its own useful tasks and traps. For accounting firms, see AI for accountants in Morocco. For lawyers and in-house counsel, where professional secrecy weighs most, see AI for lawyers and legal professionals in Morocco. And for ready-made instructions already designed without personal data, see our AI prompts for everyday office work.

If you are just starting, our guide to learning AI as a beginner covers the basics of prompting. For account and password security, see getting started in cybersecurity in Morocco.

This article is general information, not legal advice: for a specific situation, consult a lawyer or the CNDP.

In Tiznit, the ApexTiz course AI at work opens with these rules: confidentiality, Law 09-08 and source control, before moving on to the browser, connectors and agents. Connectors are practised on demo accounts prepared by the centre, with no real data. Participants leave with, among other things, a rules sheet and their final project.

Frequently asked questions

Is it illegal to use ChatGPT at work in Morocco?

No. No law bans these tools. What is regulated is the processing of the personal data you put into them: Law 09-08 applies as soon as a person can be identified.

Can I paste a contract into ChatGPT to summarise it?

Only after removing names, numbers and anything that identifies the parties. If the document is covered by professional secrecy or a confidentiality agreement, do not paste it into a consumer tool.

Is turning off training enough?

No. The data is still sent to the provider and may be kept for a while. The setting reduces one risk; it does not replace anonymisation.

Does a paid subscription protect my data better?

Not necessarily. A paid individual subscription usually follows consumer terms. Team or enterprise plans, with a contract, are what bring written commitments on data.

What should I do if I pasted client data by mistake?

Delete the conversation, tell the person in charge at your business and note what was pasted. Depending on how serious it is, ask a lawyer for advice.