Morocco's Data Watchdog Sets Rules on AI and Voter Data for 2026 Elections
Morocco's data protection authority CNDP has set strict rules for parties and candidates to protect voter data and disclose AI-generated campaign content ahead of the September 23, 2026 legislative elections.
Morocco's National Commission for the Control of Personal Data Protection (CNDP) has set a binding set of rules for political parties and candidates ahead of the legislative elections scheduled for September 23, 2026, including strict conditions on processing voters' personal data, a ban on exploiting their political opinions without explicit consent, and a mandatory disclosure requirement for any AI-generated campaign content.
What the CNDP requires from parties and candidates
As part of its oversight of the electoral process, the Commission recalled a set of legal obligations based on Law No. 09-08 on the protection of individuals with regard to the processing of personal data: prior notification before collecting voters' data, strict adherence to the stated purpose, and a ban on exploiting political opinions or conducting direct political prospecting without the explicit consent of the person concerned.
| Requirement | Legal basis |
|---|---|
| Prior notification before processing voters' data | Article 12 of Law 09-08 |
| Respecting the stated purpose and retention period of data | Article 3 of Law 09-08 |
| Ban on exploiting political opinions without explicit consent | Article 21 (paragraphs 1 and 2) |
| Ban on direct political prospecting without prior consent | Article 10 of Law 09-08 |
| Guaranteeing the rights of data subjects | Chapter II (articles 5 to 9) |
| Rules on subcontracting and data transfers | Articles 23-25, 15, 18 and Chapter V (43-44) |
| Disclosure of AI-generated content | Article 447-2 of the Penal Code and articles 39, 51 and 53 of organic law 53.25 |
Artificial intelligence under watch
In a move reflecting the growing use of artificial intelligence tools in election campaigns, the Commission asked parties and candidates to disclose any promotional or communication content generated or altered by AI, citing Article 447-2 of the 2018 Penal Code and articles 39, 51 and 53 of organic law No. 53.25 on the Chamber of Representatives.
Why it matters
This regulatory framework comes at a sensitive point in the electoral process, as candidacy registration for the legislative elections opens on August 31, 2026, ahead of voting day on September 23, 2026. With the growing use of voter databases in digital campaigns and direct political prospecting via phone, email and social media, the Commission is seeking to protect citizens from misuse of their personal data, particularly data tied to their political affiliations or preferences, which Law 09-08 classifies as "sensitive data".
To facilitate contact with citizens and parties, the Commission has set up a direct hotline, 3020, to receive questions and complaints throughout the electoral process.