Using generative AI and personal data in Morocco requires strict governance to avoid the risk of data leaks. Pasting personally identifiable information into a public chatbot violates CNDP Law 09-08, as this data is stored abroad and reused to train models. To address this, companies must deploy private AI instances, use anonymization filters, and train employees on secure practices.
The customer file pasted into a chatbot
This scene plays out every day in offices across Casablanca, from Sidi Maârouf to the Marina. A marketing employee, pressed for time, needs to segment a prospecting file containing email addresses, phone numbers, and purchase histories. To speed things up, they copy this entire Excel sheet and paste it directly into the free version of a consumer artificial intelligence chatbot. Within seconds, the magic prompt generates a perfect segmentation. From an individual productivity standpoint, the operation is a total success. From an information security and regulatory compliance standpoint, this action has just created a major security breach for the company.
This use case perfectly illustrates the current paradox of technology adoption in Morocco. Enthusiasm for generative AI is driving teams to bypass the traditional validation processes of the IT Department. The risk of data leaks no longer comes solely from external cyberattacks, but from the daily, well-intentioned use of external tools by employees. When personal data of Moroccan citizens ends up hosted on third-party servers without any contractual framework, the company exposes itself to financial penalties and a critical loss of trust from its customers and partners.
Where the data goes and who can read it
To understand the impact of this action, we must lift the veil on how consumer language models operate. Unlike traditional business software that stores information in a secure, isolated database, free versions of generative AI tools use prompt data to train their future models. This means that the customer file submitted by your employee is analyzed, memorized, and potentially reused to generate responses for other users worldwide.
Corporate AI confidentiality is then completely compromised. Once the data is submitted to a foreign publisher's cloud, the company loses intellectual property and access control over this information. If a competitor writes a similar prompt or queries the tool about a targeted business sector, fragments of your strategic data or customer lists could theoretically reappear in their results. Furthermore, these servers are mostly located outside national territory, often in the United States or Europe, which poses an immediate problem for digital sovereignty and uncontrolled cross-border data transfers.
What Law 09-08 requires in this context
In Morocco, the processing of personal data is strictly regulated by Law 09-08 on the protection of individuals with regard to the processing of personal data. The National Commission for the Control of Personal Data Protection (CNDP) rigorously enforces this text. The alignment between CNDP and AI is now at the heart of concerns for legal departments and CIOs. Under Law 09-08, any transfer of personal data abroad requires prior authorization from the CNDP, and the destination country must provide an adequate level of protection.
Companies in key sectors like retail or real estate, such as Marjane Holding or Chaabane Immobilier, manage massive volumes of customer data and must exercise absolute vigilance. Sending a file containing names, addresses, or banking details to an unapproved AI tool constitutes an illegal transfer of data outside national borders. In the event of an audit or a user complaint, the company faces heavy administrative and criminal penalties, not to mention the devastating impact on its brand reputation in the Moroccan market.
Concrete solutions, from governance to tooling
Faced with this challenge, outright banning generative AI is a false solution that would penalize the company's competitiveness. The answer lies in implementing rigorous technical and organizational governance. The first step consists of deploying private instances of generative AI within the company's cloud or through specific professional subscriptions. These enterprise contracts guarantee in writing that submitted data will never be used to train public models and remains strictly confidential.
On the technical side, integrating security gateways like API firewalls helps filter queries sent by employees. These tools analyze the text before it is sent and automatically block the query if it contains regular expressions matching phone numbers, email addresses, or financial data. For custom projects, setting up RAG (Retrieval-Augmented Generation) architectures allows companies to leverage the power of AI on internal documents without ever exposing these resources to the outside, ensuring a perfect seal around your informational assets.
Training teams without paralyzing them
Technology alone cannot solve a problem that is primarily human and behavioral. Employees are generally unaware of the risk of data leaks when using these new automation tools. It is therefore essential to conduct targeted and regular awareness campaigns. Creating a simple, visual generative AI usage charter, describing precisely what is allowed and what is strictly forbidden, is the starting point for this cultural shift.
The goal is not to paralyze innovation but to make users responsible. For example, they can be taught to systematically anonymize datasets before submitting them to an external tool, replacing real names with dummy identifiers. By turning every employee into a data-security-conscious actor, companies can confidently harness the potential of artificial intelligence to accelerate growth while remaining in full compliance with CNDP requirements. Data Scale Business supports organizations through this transition by designing secure AI architectures tailored to the Moroccan legal framework.
