Recording job interviews in Morocco: Penal Code Article 447-1, Law 09-08 and the CNDP

Recording a job interview with a candidate in Morocco requires the candidate's consent. Article 447-1 of the Penal Code punishes anyone who knowingly records or intercepts "words or information spoken in a private or confidential setting, without the consent of their authors," with six months to three years in prison and a fine of 2,000 to 20,000 dirhams. Law 09-08 on personal data then requires the candidate's unambiguous consent or a listed exception, notice before collection, a prior declaration or authorization with the National Commission for the Control of Personal Data Protection (CNDP), and a legal basis before recordings go abroad. This is the position as of November 2026.

This page adds Morocco to our country series alongside France, whose data protection law Law 09-08 closely resembles, and Egypt. It is for recruiters, agency consultants and hiring managers who interview candidates located in Morocco by video or phone, including from the US and Europe, and for agencies that hire Moroccan candidates for employers abroad. What sets Morocco apart is a filing system: the CNDP's model authorization for HR files covers interviews, and its list of adequate countries does not include the US.

Morocco's rules at a glance

Is it legal to record a job interview in Morocco?

Yes, with the consent of the people speaking. Article 447-1 of the Penal Code, added by Law No. 103-13 on combating violence against women (2018), punishes with six months to three years in prison and a fine of 2,000 to 20,000 dirhams anyone who "knowingly and by any means, including computer systems," intercepts, records, broadcasts or distributes "words or information spoken in a private or confidential setting, without the consent of their authors" (our translation). The second paragraph applies the same penalty to capturing or distributing the photograph of a person in a private place without consent, which matters for video recordings and screenshots.

The text does not carve out a person who records a conversation they take part in, and we found no official guidance saying that a participant may record without consent. A job interview is a confidential exchange, so ask before you record, and never record covertly.

What does Law 09-08 require before you record?

Law 09-08 of February 18, 2009 defines personal data as any information about an identifiable person "including sound and image" (Article 1), so the audio, the video and the transcript are all covered. Three rules apply before the interview starts (our translations):

• Consent or an exception (Article 4). Processing may take place only if the person "has unambiguously given consent," unless it is necessary for a legal obligation, for a contract or "pre-contractual measures taken at their request," or for "the legitimate interest pursued by the controller," provided it does not disregard the person's interests or fundamental rights. Given Article 447-1, consent is the practical basis for the recording itself.
• Notice (Article 5). The candidate must be informed beforehand, "in an express, precise and unambiguous manner," of the controller's identity, the purposes, the recipients, whether answers are compulsory and the consequences of not answering, the rights of access and rectification, and "the characteristics of the receipt of the declaration" with the CNDP or of the authorization it issued.
• Quality of data (Article 3). Data must be collected fairly for specified, explicit and legitimate purposes and kept no longer than needed for them.

Disclosing the recording to a third party, such as a client, also needs the candidate's prior consent under Article 4, second paragraph, unless an exception applies. Name the client in the notice.

Do you need to file with the CNDP?

Yes, if Law 09-08 applies to you. Article 12 requires a prior authorization for processing sensitive data, using data for purposes other than those collected for, criminal records, data that includes "the number of the national identity card," and some interconnections, and a prior declaration in all other cases. For employers, the CNDP has adopted a model: Deliberation 298-AU-2014 of April 11, 2014 on HR management. In summary:

• It covers employees, apprentices, interns and "candidates for employment," and recruitment purposes including "organizing job interviews and means of assessment."
• Its list of candidate data is identity, CV, signature and photo, diplomas and languages, military status, hobbies and emergency contacts, plus criminal records "only when the nature of the post presents risks." It does not mention audio or video recordings of interviews.
• The candidate must be told, among other things, of any planned transfers abroad and "the reference of the receipt of the authorization issued by the CNDP," and the HR processing may not start "without the free and informed prior consent" of the person or a justified exception.
• If candidates' data is checked against outside sources and discrepancies appear, the candidate must have the chance to explain them.
• Processing that does not meet the model's conditions needs a full authorization request under Articles 12 and 21 of the law.

The CNDP's notification procedures page lists the documents for an HR filing under the model (form F-113), including "a copy of the consent document for interns and job candidates" with the data protection clauses Article 5 requires. Because recordings are not in the model's data list, an employer or agency that records interviews should check with the CNDP or local counsel whether its filing covers them, or file a specific request.

What about health, religion and criminal records?

Article 1 defines sensitive data as data revealing "racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership" or relating to health, including genetic data. Article 21 makes their processing subject to a law or a CNDP authorization, granted on the person's express consent or where processing is essential to the controller's legal duties. Article 57 punishes processing them without express consent, and processing data on offenses and convictions, with three months to one year in prison and a fine of 50,000 to 300,000 dirhams. Do not ask about these subjects, keep anything volunteered out of notes and scorecards, and ask about criminal records only where the post presents risks, as Deliberation 298-AU-2014 puts it.

What if you interview a candidate in Morocco from the US?

Article 2 applies Law 09-08 to a controller established in Morocco, including one that operates there through any form of installation, and to a controller not established there that uses means of processing located in Morocco; the second kind must notify the CNDP of a representative in Morocco. A Moroccan agency or employer is clearly covered. The law does not say whether a candidate's own laptop counts as a "means" for a US recruiter with no Moroccan entity, so take advice before relying on being outside it. Article 447-1 protects the candidate's side of the call in any case, and your own state's law governs your side; see two-party consent states.

For transfers, Article 43 allows sending personal data only to a state that ensures "a sufficient level of protection," on a list the CNDP keeps. The list in Deliberation 236-2015, which the CNDP still links on its transfer page, names most EU member states, Iceland, Liechtenstein, Norway, Switzerland, the United Kingdom and Canada, and not the United States. For the US, Article 44 allows a transfer where the candidate "has expressly consented to their transfer," for steps toward a contract requested by the candidate, or "on the express and reasoned authorization" of the CNDP, for example on the basis of contract clauses. Deliberation 298-AU-2014 adds that any transfer abroad "must be notified in advance" to the CNDP, "notably in the case of hosting or storing data on servers located outside the national territory." The CNDP's transfer page says it gives its opinion within two months, extendable once, and only where the underlying processing has itself been declared or authorized.

Can candidates get the recording, and how long can you keep it?

Yes. Article 7 gives the person the right to obtain from the controller, "without delay and free of charge," confirmation that their data is processed, the purposes, the categories of data and the recipients, and "the communication, in an intelligible form," of the data itself, which includes the candidate's recorded answers, as well as "knowledge of the logic underlying any automated processing." Article 53 fines a controller that refuses access, rectification or objection 20,000 to 200,000 dirhams per offense. Our candidate data access requests guide has a workflow.

On retention, Deliberation 298-AU-2014 says HR data may not be kept "beyond the period necessary" for its purposes, and Article 55 of the law punishes keeping data beyond the period stated in the declaration or authorization. State a short period for audio in your filing and your notice, and keep to it. Our retention policy template gives the structure.

Can you use AI note takers or transcription?

Yes, with consent that names the tool, a contract with the vendor, and a transfer basis if the vendor is abroad. Deliberation 298-AU-2014 requires the employer to impose on any service provider, by contract, appropriate security measures, use of the data only for the agreed purposes, confidentiality, and destruction or return of the data at the end of the service. A US-hosted tool is a transfer under Articles 43 and 44, so get the candidate's express consent to it or a CNDP authorization, and notify the CNDP. Ask the vendor where it stores audio and transcripts and whether it trains models on them. Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Morocco

Avant de commencer : je souhaite [enregistrer cet entretien / utiliser
un logiciel qui transcrit notre conversation] afin de noter vos réponses
avec exactitude. L'enregistrement sera utilisé uniquement pour ce
recrutement, partagé seulement avec [le client / le responsable du
recrutement], hébergé par [prestataire] en [pays], et supprimé [délai]
après la décision. Acceptez-vous, y compris ce transfert vers [pays] ?
Vous pouvez refuser ou me demander d'arrêter à tout moment ; nous
continuerons alors avec des notes écrites, sans aucune conséquence sur
votre candidature. Notre traitement est déclaré à la CNDP sous le
numéro [référence].

(Before we start: I'd like to [record this interview / use software that
transcribes our conversation] so I note your answers accurately. The
recording will be used only for this recruitment, shared only with
[the client / the hiring manager], hosted by [vendor] in [country], and
deleted [period] after the decision. Do you agree, including to this
transfer to [country]? You can refuse or ask me to stop at any time;
we'll then continue with written notes, with no consequence for your
application. Our processing is registered with the CNDP under number
[reference].)

The line covers Article 447-1 consent, the Article 5 notice including the CNDP reference, and the express consent to a transfer that Article 44 accepts. Offer it in Arabic if the candidate prefers, and put the same details in the invitation. More wording is in the interview recording consent script.

Checklist before you record interviews in Morocco

• Candidate's consent asked for and noted before any recording or live transcription; no covert recording.
• Article 5 notice in the invitation, with recipients, the CNDP receipt or authorization reference and any transfer abroad.
• CNDP filing in place, and checked to cover interview recordings, not just CVs and HR files.
• No questions on ethnicity, religion, politics, union membership or health; criminal records only where the post presents risks.
• Express consent or a CNDP authorization for any vendor or client outside the CNDP's list, and the transfer notified.
• Written contract with every vendor covering security, purpose and deletion.
• Access requests answered without delay; audio deleted on the stated schedule.

Interviewing elsewhere in North Africa and the Middle East? Compare Egypt, Saudi Arabia and Qatar.