F113 — CNDP simplified authorisation: the form that gets filed too early
The F113 is the shortest of the CNDP forms and the one least often admissible. Four pages, no description of the processing — because the Commission has already written it for you, in a framework decision. Without that decision, you fall under the F112.
Every so often a ready-to-sign F113 lands on my desk, carefully filled in, with the words "framework decision: to be completed". That is the sign the form was chosen for its length — four pages against twelve for the F112 — and not for what it is. The F113 is not a lighter F112. It is a form by which you adhere to a model authorisation the Commission has already published. If no such model exists for your case, the file stands no chance.
What a framework decision is, and what it changes
Law 09-08 knows only two regimes. Article 12 subjects to prior authorisation any processing that involves sensitive data within the meaning of Article 1, genetic data, offences and convictions, the national identity card number, as well as the use of data for purposes other than those for which it was collected and the interconnection of files with different purposes. Everything else falls under prior declaration. The text never mentions a "simplified authorisation". The expression comes from the Commission's practice.
What the law does provide for is the Commission's power to define, by decision, categories of processing subject to reduced formalities — Articles 16 and 17 do so for declarations, subject to government approval. The CNDP has extended that logic by publishing framework decisions: deliberations that describe a standard processing operation, its permitted purposes, its data, its retention periods, its recipients and its safeguards. When a sensitive processing operation fits that mould exactly, the Commission has no need to reassess the substance: it has already ruled on proportionality. All that remains is to check that you are within the framework, and to identify yourself.
That is where the F113 comes in. The official form — four pages, 38 substantive fields — asks you neither for the list of data, nor for retention periods, nor for security measures. It asks for the number and year of the framework decision, the identity of the controller and its representatives, the category of activity, the model authorisation relied on, the name of the processing operation, and a signed undertaking. Everything missing compared with the F112 is deemed to comply with the framework decision. Filing an F113 is telling the Commission: "my processing is the one you described, no more, no less". If that is only approximately true, you have just signed an undertaking you are not keeping.
The decision tree: F211, F214, F112, F113
Two questions are enough to find the right form.
The first: is the processing sensitive within the meaning of Article 12? Health data, biometrics, offences, national identity card number, scoring that diverts data from its original purpose, interconnection of files. No → you are in declaration territory. Yes → you are in authorisation territory.
The second: is there a Commission framework decision that describes exactly this processing? No → full form. Yes → simplified form.
Cross the two answers and you get the grid of the 2025 nomenclature:
| Without a framework decision | With an applicable framework decision | |
|---|---|---|
| Ordinary processing (declaration) | F211 — standard declaration | F214 — simplified declaration |
| Sensitive processing (authorisation) | F112 — prior authorisation | F113 — simplified authorisation |
The F113 sits at the intersection of "sensitive" and "existing framework decision". It is mechanically the least populated cell: sensitive processing operations are a minority, and those the Commission has judged standardised enough to deserve a model are a smaller minority still. A controller who files three F211s a year may never see an F113 in an entire career. The F118, for its part, does not appear in the grid: it is filed on top of any cell as soon as a transfer outside Morocco comes into play.
The classic trap: an F113 with no framework decision
I see it several times a year, always for the same reason. A team discovers that its processing is sensitive, opens the catalogue of CNDP forms, reads "simplified authorisation", and takes the short route. Nobody has looked for the framework decision. The "decision number" field stays empty or, worse, is filled with the number of a general deliberation that is not a framework decision in the sense the form intends.
An industrial site in Tangier filed an F113 for biometric clocking in exactly this way, citing a deliberation of principle by the Commission on biometric devices. The file came back: the deliberation set out doctrine, it was not a model to adhere to. Everything had to be redone as an F112 — this time with the full description of the device, the non-biometric alternative for employees who refuse, and the proportionality justification. Months lost, for a device that was already running.
The mechanism is simple. The F113 contains nothing that would let the Commission assess the processing on its own; everything rests on the reference to the framework decision. If that reference points at nothing, the file is empty. Hence my rule: when in doubt, F112. It covers everything the F113 covers; the reverse is not true. An F112 filed for processing that could have gone through an F113 will take a little longer to review, but it will get through. An F113 outside the framework will not.
Checking on cndp.ma that the decision covers your case
The check has three stages, and none of them can be skipped.
Start with the decisions and deliberations published on the Commission's website. Look for those that define a model processing operation to which controllers may adhere. Note the number and the year: these are the two fields that open the F113, and you will find them again in the signature paragraph on page 4.
Then read the decision in full — the operative part, not the title. It generally sets the category of activity, the permitted purposes and those alone, the categories of data, the maximum retention periods, the recipients and the required safeguards. Compare each element against your actual processing, not against its description in the project slide deck.
Finally, decide without indulgence. A mutual insurer in Rabat handled its healthcare reimbursements according to a model the Commission had framed, but kept its files several years longer than the maximum period allowed, for its statistics. That single gap took it outside the framework. Two options: bring retention back to the model's period and file an F113, or keep those extra years and justify the entire processing in an F112. It chose the first, which was also the better governance decision. A framework decision often acts as a revealer: what you cannot fit into it is frequently what you should not have been doing.
Check the date too. A framework decision may be replaced by a more recent one; quoting the number of a repealed version costs you a round trip.
The form, section by section
The official F113 fits in four pages. Here is what it expects, in the order of the document.
The applicable framework decision. Number and year. This is the keystone: the two values appear on page 1 and are repeated in the signature paragraph. If you cannot fill them in, close the PDF and open the F112.
The controller. The entity that determines the purposes and means, whether a natural or legal person: corporate name as entered in the commercial register, acronym, legal form, RC number, activity code and sector, head office address, institutional email and telephone numbers. The Commission cross-checks this information against your other filings; a corporate name abbreviated differently from one form to the next creates friction for nothing.
The legal representative and the main contact. The former binds the organisation — managing director, chief executive, chairman — and will sign; identity document, nationality, contact details. The latter is the person the Commission will call: often the DPO, in-house counsel or the compliance officer. Put down someone who will answer within the week.
Where the controller is established. One question, two paths. If the controller is established in Morocco, section II is skipped. If it is not, Article 2 of Law 09-08 requires the identity of a representative established in Morocco to be notified to the Commission; that representative steps into the controller's rights and obligations. You then have to fill in the Moroccan representative entity, its own legal representative and its main contact. Subsidiaries and liaison offices of foreign groups are directly concerned. A practical point: the official PDF exposes no tick box for several of the choices in this section; they are completed by hand after printing.
The description of the processing. The shortest section of the form, and the one with the heaviest consequences. Four items: the category of activity, as the framework decision names it; the model authorisation relied on, as the framework decision provides for it; the name of the processing operation, which will appear as such on the national register; and the question of transfer to a foreign country — a positive answer calls for an F118 in addition, and the Commission's express agreement before any actual transfer. Be literal in the first two fields: use the decision's vocabulary, not your own.
The department in charge of data subjects' rights. Name, position, identity document and above all the contact email through which data subjects exercise their rights of access, rectification and objection. That email must exist, be read, and match the one in your privacy policy.
The signature. Place, date, identity and position of the signatory. The paragraph restates the framework decision relied on: it is the formal undertaking to comply with it. Handwritten signature and company stamp after printing.
Note what the F113 does not contain: no section on categories of data, retention periods, recipients or security measures — where the F112 devotes most of its twelve pages to them. That silence is not an exemption. The security obligations of Article 23, and those of Article 24 specific to sensitive and health data — control of access to facilities, of media, of data entry, use and transmission — apply in full. The Commission does not ask you to describe them because the framework decision presupposes them.
After filing
The F113 is an application for authorisation. The principle is therefore the same as for the F112: the acknowledgement of receipt attests to the filing and to your diligence; it authorises nothing. Sensitive processing is not put into operation before the Commission's decision. On that point, do not be misled by the word "simplified" — it lightens the review, not the obligation to wait.
The review bears essentially on admissibility: is the reference to the framework decision relevant, is the controller correctly identified, does the processing as named genuinely fall within the model. The Commission may request additional information, typically a clarification of the name or a missing document. On timing, stick to what we document in the receipt guide: shorter than an F112 in the normal scenario, longer as soon as the file shows any ambiguity. The factor that weighs most is the one entirely within your control — how well your processing matches the decision you rely on.
At the end, the Commission issues a simplified authorisation, possibly subject to conditions, as for an F112 — most often by restating a condition of the framework decision that the file had left vague. Those conditions are enforceable. Keep the authorisation, display its number wherever you display your other receipts, and align your privacy policy with the exact name of the authorised processing. If the Commission instead considers that the processing does not fall within the framework, it will refer you to the F112. That is not a refusal on the merits, it is a requalification: your processing has a particularity the model does not absorb, and it is that particularity you will have to justify in the full file.
Going forward, an authorised processing operation that evolves — new purpose, new processor, longer retention — potentially steps outside the framework and calls for a new filing, where applicable as an F112. Article 51 of the law allows the Commission to withdraw an authorisation if the processing proves contrary to public order or morality, and Article 52 penalises the operation of a file without the required authorisation. An F113 signed on a false basis is not an approximate F113; it is processing without authorisation.
The free assistant and the companion guides
DataSouv provides an F113 completion assistant, free and with no account required. It follows the official form section by section, fills in the fields of the CNDP's PDF in your browser — nothing passes through our servers — and flags the items to complete by hand after printing. Its first step is deliberately blocking: without a framework decision number, it points you to the F112.
To place the F113 among the other formalities:
- F112 — prior authorisation, in practice: the full form, to read first if you are not certain a framework decision covers you.
- F211 — user manual for the standard declaration: the ordinary route, for everything that is not sensitive.
- CNDP receipt — timelines and procedure: what happens between filing and decision, form by form.
- Pillar guide — CNDP compliance in Morocco 2026: the overview.
If the qualification escapes you, our CNDP formalities service always starts with that very question, before opening a single form.
Sources
- Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) — official forms, published deliberations and decisions.
- Law 09-08 on the protection of individuals with regard to the processing of personal data, promulgated by Dahir No. 1-09-15 of 18 February 2009 — Bulletin Officiel No. 5714 of 5 March 2009. Articles cited: 2, 12, 16, 17, 21, 23, 24, 51, 52.
- Decree 2-09-165 implementing Law 09-08 — Bulletin Officiel, General Secretariat of the Government.
Karim B. — CNDP compliance consultant, DataSouv contributor. Article reviewed and validated by Amine Rais, founder.
Frequently asked questions
What is the difference between the F112 and the F113?
Both concern sensitive processing subject to prior authorisation (Article 12 of Law 09-08). The F112 is the full application for authorisation: twelve pages in which you yourself describe the data, purposes, retention periods, recipients and security measures. The F113 is the simplified version, four pages, reserved for processing that matches, point for point, a framework decision already published by the Commission. You do not describe the processing: you declare that you adhere to the model the CNDP has set. Without an applicable framework decision, the F113 is not admissible and an F112 must be filed.
How do I know whether a framework decision covers my processing?
By consulting the deliberations and decisions published on cndp.ma, then comparing your processing point by point with the model described: category of activity, purpose, data collected, retention period, recipients. The match must be complete. One extra purpose, a longer retention period, a recipient not provided for, and you are outside the framework. When in doubt, the safe route remains the F112: it covers everything the F113 covers, and the reverse is not true.
Can I operate the processing while the F113 is under review?
No. The F113 remains an application for authorisation, not a declaration. Until the Commission has issued the simplified authorisation, the sensitive processing must not be put into operation. The acknowledgement of receipt attests to the filing; it authorises nothing. The logic is the same as for the F112, the only difference being that the review is in principle shorter, since the substance has already been settled in the framework decision.
My processing involves a provider outside Morocco — is the F113 enough?
No. The form contains an explicit question on the transfer of data to a foreign country. If the answer is yes, an F118 (international transfer) must be filed in addition, and the CNDP's agreement obtained before any actual transfer. The F113 authorises the processing in Morocco; it says nothing about the transfer.