Cybersecurity Compliance & CNDP Law 09-08 for Moroccan & Global Firms
Specification Matrix
Core Engineering Requirements
- ›Automated telephony recording and AI transcription legally constitute personal data processing under Moroccan Law 09-08 (Dahir n° 1-09-15).
- ›Transferring citizen audio or customer records to foreign cloud servers without formal CNDP authorization is a criminal misdemeanor under Article 60.
- ›All production databases must enforce AES-256-GCM encryption with tenant-segregated keys and local Moroccan data residency (Tier-III Datacenter).
- ›A formal prior declaration (Déclaration Préalable) and explicit caller consent prompt are mandatory before activating automated conversational systems.
1. What CNDP Law 09-08 Mandates for Automated Voice & Telephony Systems
Under Moroccan Law 09-08 (promulgated by Dahir No. 1-09-15 of 22 Safar 1430), any voice telephony agent or conversational AI system collecting citizen names, phone numbers, addresses, commercial orders, or medical details is legally classified as an automated personal data processing operation. Articles 23 and 24 mandate that data controllers implement rigorous physical and logical security measures ensuring data integrity and confidentiality. Furthermore, Articles 53 through 65 establish severe fines (up to 300,000 MAD) and personal criminal liability (3 months to 2 years imprisonment) for corporate officers who unlawfully process data or transmit sensitive records across international borders without formal prior authorization from the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP).
2. Cryptographic Architecture, Key Management & Sovereign Hosting
To satisfy DGSSI (Direction Générale de la Sécurité des Systèmes d'Information) national guidelines and CNDP storage compliance, all audio recordings, streaming transcripts, and customer records must be encrypted at rest using AES-256-GCM. Telephony SIP signaling must enforce TLS 1.3 with Curve25519 or P-384 key exchange, while real-time media streams must mandate SRTP (RFC 3711) with AES-CM-128 or AES-GCM-256 ciphers. Unencrypted RTP over UDP is prohibited. Master encryption keys must be managed through hardware security modules (HSM) or tenant-segregated KMS keystores hosted on Moroccan soil—such as Tier-III datacenters in Casablanca (Maroc Telecom DC3, Inwi Datacenter) or Rabat Technopolis.
# Production SIP TLS 1.3 & SRTP Cipher Suite Verification (Kamailio / Asterisk)
kamailio -c -f /etc/kamailio/tls.cfg
# Ensure strict TLS 1.3 and forward-secret cipher suites
tls_method = TLSv1_3
cipher_list = "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
server_name = "sip.vext.ma"
require_certificate = yes
verify_certificate = yes
private_key = /etc/ssl/sovereign/sip_private.key
certificate = /etc/ssl/sovereign/sip_cert.crt
ca_list = /etc/ssl/sovereign/ca_root.crt3. Mandatory Caller Notification, Right of Opposition & Consent Protocols
Article 14 of Law 09-08 strictly requires that data subjects be informed prior to data capture of: (1) the explicit identity of the data controller, (2) the exact operational purpose of the automated call, (3) whether the conversation is being recorded or analyzed by AI, and (4) specific instructions on how to exercise legal rights of access, rectification, and opposition. Vext systems enforce this deterministically: upon SIP pick-up, an auditory notification is played in the caller's language (Darija, French, Arabic, or English). If the caller presses "9" or vocally states opposition, audio streaming to persistent storage is terminated instantly, switching the system to an ephemeral, zero-disk transaction loop.
| Law 09-08 Requirement | Technical Architecture Implementation | Verification Method |
|---|---|---|
| Art. 14: Prior Disclosure | Pre-roll IVR audio disclosure before transactional intent | Automated audio trace audit |
| Art. 23: Data Confidentiality | AES-256-GCM database encryption + TLS 1.3 SIP signaling | Penetration test & TLS scan |
| Art. 43: Prior Declaration | Formal dossier registration with CNDP registry before production | Receipt of CNDP Récépissé |
| Art. 53: Opposition Right | DTMF 9 / Voice intent trigger switching to ephemeral memory | Synthetic test call verification |
4. Immutable Audit Trails & Cryptographic Hash Chaining
In the event of a CNDP compliance inspection or legal inquiry, the burden of proof rests on the enterprise to demonstrate that access to customer data was restricted and that transcripts have not been tampered with. Vext systems incorporate forward-secure hash chaining (SHA-256) into all event logs. Each new telephony audit record includes the cryptographic digest of the preceding record, making retroactive log alteration mathematically impossible. Furthermore, automated retention schedules execute zero-trace deletion scripts at the end of the legally registered retention period (typically 30 to 90 days).
Specification FAQ
Need technical guidance on this specification?
Speak directly with our systems engineers in Casablanca.