CNDP F214 form — the simplified declaration under a framework decision

The F214 is the form that many Moroccan organisations ought to be filing and few have heard of. Five pages, against eleven for the F211. No section on categories of data, retention periods or security measures. A decision number at the top, contact details, a purpose, a signature.

It is also the form most often misqualified. Its brevity hides a precise mechanism: by signing it, you are not describing your processing, you are declaring that it matches a model the Commission has already framed. If that is not true, the brevity turns against you.

What a framework decision is, and why the F214 exists

Law 09-08 organises compliance around two regimes: prior authorisation for processing that presents risks (article 12, paragraph 1), and prior declaration for everything else (paragraph 2). The F211 is the ordinary form of that declaration and reproduces, section by section, the elements required by article 15: identity of the controller, purposes, categories of data subjects and data, recipients, transfers, retention period, department handling data subject rights, security measures.

Article 16 opens a shorter route. The Commission draws up the list of categories of processing which, given the data involved, are not likely to infringe the rights and freedoms of individuals, and for which the declaration is limited to only some of those elements. That decision is subject to government approval. Article 28 confirms the power: "to draw up the list of categories of processing eligible for a simplified declaration".

Those lists take the form of framework decisions. Each one describes a standard processing activity — video-surveillance of access points, administrative management of personnel, other recurring types — with its permitted purposes, its categories of data, its recipients, its retention periods. The F214, whose header refers to a "Decision No. … / …", is the form by which you attach yourself to one of them.

That attachment is an undertaking, not a formality. Article 13 specifies that the declaration includes an undertaking that the processing will be carried out in accordance with the law; with an F214, that undertaking also extends to the content of the framework decision. The retention period is not on the form: the decision has written it for you, and you have signed underneath.

F214 or F211: the question people ask the wrong way round

The question I am asked most often is: "Can I switch to an F214?" The subtext being: it is shorter, let's go. The right question is: "Is there a framework decision that describes exactly what I do?"

Exactly, not roughly. A Casablanca retailer wanted to declare the video-surveillance of its shops on an F214, which seemed obvious. Except that the cameras were also used to count visitors and measure queuing time at the tills — a commercial performance purpose that standard video-surveillance does not cover. Outcome: an F211, with purposes, recipients (analytics provider included) and retention periods described in full. An F214 would have been a false undertaking from the moment it was signed.

Conversely, a Rabat clinic was about to file a fifteen-page F211 for its car park and entrance cameras. An F214 was enough: access to the premises, no other purpose, retention periods in line with the model. Three hours of drafting saved, and a shorter review.

The practical rule fits in three lines. If the processing matches a published framework decision point by point, it is an F214. If it departs from it on a single point — longer retention, an additional purpose, an extra recipient, one more category of data — it is an F211. If the processing involves sensitive data, biometrics, offences, scoring or file interconnection, it is neither: it is an F112 prior authorisation, or its simplified counterpart the F113 where a framework decision exists for that sensitive category.

Getting it wrong costs more than people imagine. An F214 filed for processing that exceeds the model produces a receipt (récépissé) that does not cover what actually happens. The day an employee, a customer or an inspection notices the gap, you are a controller who declared something other than what they do. Article 20 also gives the Commission the power, when examining a declaration, to move the processing under the authorisation regime if it identifies manifest dangers. Rare, but provided for.

Finding the number of the applicable framework decision

The F214 opens with a decision number and a year. Without those two elements, the form has no object.

They are on the Commission's official website (cndp.ma), in the section devoted to decisions and deliberations, together with the full text of each framework decision. Read that text in full before filling in anything — it is the decision, not the form, that defines your obligations. Note the permitted purposes, the categories of data, the retention periods, the recipients. Compare them with your actual practice, not with the idea you have of it: ask the person who administers the system how long recordings are really kept.

Then enter the number and the year exactly as they appear on cndp.ma. No rewording, no title in place of the number. In our assistant, both fields are mandatory; the indicative category (framework decision I to IV) is only there to help you find your bearings and does not appear on the PDF. Archive a dated copy of the decision with the file: if the Commission revises it, that is your point of comparison.

The form, page by page

The official PDF (July 2025 version) runs to five pages and a little over a hundred fields, organised as follows.

Page 1 — the decision header

The number and year of the framework decision, nothing else. It is the page the reviewer looks at first, and the one that decides whether the rest of the file makes sense.

Page 2 — Part A, the summary reproduced on the receipt

This page condenses the identity of the controller and the description of the processing. Its fields are reproduced on the receipt issued by the Commission; hence the importance of getting them right.

For the controller: legal nature (legal entity or natural person), corporate name as entered in the commercial register, abbreviation, legal form, RC number, activity code and description, head office address, city, country, institutional email, landline, mobile and fax. The mobile number is mandatory, which always comes as a surprise; plan for a number belonging to the organisation, not the manager's personal phone.

For the processing itself, only three elements. The name — precise and operational: "Video-surveillance of access to head office premises", not "Security". The purpose, in a few lines consistent with those the framework decision permits. And a decisive tick box: does the processing involve a transfer of data abroad? If you tick "Yes", an F118 must accompany the filing. A video recorder whose streams go to a US vendor's cloud is a transfer.

Page 3 — Part B-I, detailed identification

This is where page 2's summary is spelled out. The legal representative first: surname, first name, position (manager, chief executive, chairman), nationality, type and number of identity document, email, telephone numbers. This is the person who will sign. Then the main contact, the day-to-day owner of the file — in-house counsel, DPO, administrative manager. It can be the same person as the legal representative; beyond a dozen employees, that is rarely a good idea, as the reviewer needs to be able to reach someone who knows the file.

The page also asks the question that determines what follows: is the controller established in Morocco? If yes, page 4 stays blank; if not, it becomes mandatory.

Page 4 — Part B-II, the representative in Morocco

Reserved for controllers established outside Morocco. Law 09-08 expressly provides for it: the Commission is notified of the identity of the representative established in Morocco who stands in for a controller residing abroad (article 28), and it is the controller "or, where applicable, its representative" who submits the declaration (article 14).

For that representative, the form asks for the same identification block as for the controller — corporate name, legal form, RC, activity, address, contact details — then its own legal representative, then its operational contact. Three sub-sections, around thirty fields. The typical case: a foreign company operating premises in Morocco through a local structure.

Page 5 — Part B-III, the department handling data subject rights, and the signature

Article 15 g) requires you to indicate the department to which data subjects apply to exercise their rights. The F214 keeps that requirement: the name of the department ("Data protection department", "DPO", "Legal department"), then a named individual with their position, their identity document, a contact email for requests and a telephone number.

That contact email deserves a minute's thought: it is the address a person caught on camera or an employee will use to request access to their data. A generic mailbox that someone actually checks, not the inbox of an executive who will be gone in eighteen months.

Finally comes the signature: place, date, name and position of the legal representative (carried over automatically from the previous pages), handwritten signature and company stamp applied after printing.

What the Commission sends back

On the F214 files I have seen come back, the reasons repeat themselves.

A decision number that is missing, wrong or replaced by an approximate title comes top of the list. The file has no basis, so it goes back.

Next comes the gap between the purpose described and the scope of the framework decision. The reviewer compares your purpose with the model; if they find an addition — commercial analytics, productivity monitoring, sharing with a third party not provided for — they refer you to an F211, or to an F112 if the gap involves sensitive data. It is the most expensive request for additional information there is: it sends you back to square one with a heavier file.

Third reason: the "transfer abroad" box ticked with no F118 attached, or worse, ticked "No" when the purpose mentions cloud hosting outside Morocco. The contradiction leaps off the page on first reading.

Fourth: a controller declared as established outside Morocco with no local representative on page 4. The form is incomplete in the strict sense.

And finally the material defects — missing signature, forgotten stamp, corporate name that differs from the commercial register, empty mobile field. Trivial on the face of it. They cost weeks.

After filing

Filing is free. Keep the acknowledgement of receipt: during the review, it is what evidences your diligence and allows you to keep operating the processing in good faith.

On timelines, the text and practice diverge. Article 19 provides for a receipt within twenty-four hours of filing. On the ground, allow four to eight weeks for a clean F214, up to three months in slow cases — markedly less than an F211, which is one of the genuine arguments for the F214 when it applies. Follow-ups, conditions and refusal scenarios are covered in the guide on the CNDP receipt.

Once the receipt arrives, its details must appear in your collection operations (articles 5 and 19). For video-surveillance: the signage at the entrance to the premises, stating the controller, the purpose, the department handling rights and the receipt reference. For HR administration: the information notice given to staff. In every case, the privacy policy and the website footer if the processing is visible there.

One last point, often overlooked: each F214 covers one processing activity. Cameras at head office and an administrative personnel file are two F214s, each attached to its own framework decision. And if the processing evolves beyond the model — a new purpose, a new provider, a longer retention period — the simplified receipt no longer covers it: article 15 requires any change to be brought to the Commission's attention, which in practice means a new filing, often as an F211.

Filling in the F214 with our assistant

We have built a free assistant for the F214, modelled on the official PDF: the sections above in the same order, mandatory fields flagged, page 4 appearing only if you answer "No" to the question about establishment in Morocco. The PDF is generated in your browser; nothing you enter leaves your machine. You print, sign and apply the stamp.

What the assistant does not do is decide for you whether your processing really falls under a framework decision. That reading is done with the text of the decision in front of you. When in doubt, the F211 guide describes the ordinary route, and our turnkey formalities service covers the qualification when you would rather delegate it.

Sources

• CNDP — official website, forms and decisions
• Law No. 09-08 on the protection of individuals with regard to the processing of personal data, promulgated by Dahir No. 1-09-15 of 18 February 2009, Official Bulletin No. 5714 of 5 March 2009 — Official Bulletin, General Secretariat of the Government
• Decree No. 2-09-165 implementing Law 09-08 — Official Bulletin, General Secretariat of the Government
• Pillar guide — CNDP compliance in Morocco 2026

Karim B. — CNDP compliance consultant, DataSouv contributor. Article reviewed and validated by Amine Rais, founder.