CNDP filing receipt — 2026 timeline and procedure

The CNDP receipt is the official document issued by the Commission Nationale de contrôle de la Protection des Données à caractère Personnel (CNDP, the Moroccan data protection authority) at the end of the review of a declaration or authorisation request. It materialises the administrative compliance of a processing activity and bears a unique registration number which becomes the public reference of your compliance.

This guide covers everything you need to know about obtaining, displaying, and maintaining the receipt.

1. What is a CNDP receipt?

It is the official acknowledgement by which the CNDP certifies that it has registered your processing after review. It typically carries:

• A registration number in the format XXX-AAAA (alphanumeric)
• The date of issuance
• The declared and accepted purpose
• The identity of the data controller
• Where applicable, reservations or operating conditions

There are several types of receipts depending on the originating form:

Note on the 2025 CNDP nomenclature. Some earlier preparatory documents used F212 (now F112) for prior authorisation and F214 (now F118) for transfers. This guide reflects the current nomenclature in force on cndp.ma.

2. Time to obtain — the reality on the ground

2.1 Statutory deadlines vs. practical timelines

Law 09-08 and its implementing decree provide statutory review deadlines, but in practice, observed durations vary significantly:

Several factors extend the review:

• Commission workload at the time of filing (peaks at year-end and in September)
• Filings requiring additional information poorly qualified from the outset
• Sensitive processing or complex interconnection
• Processors outside Morocco insufficiently documented

2.2 During the review — the acknowledgement of receipt is sufficient

The acknowledgement of receipt of the filing allows you to continue operating the processing, subject to compliance with the principles of Law 09-08. It serves as proof of diligence in the event of an inspection during this period.

Its preservation is therefore essential:

• Paper format or scanned digital copy
• Storage in a durable location (backed-up cloud, legal archives)
• Reference accessible to teams in case of external requests

3. What to do while waiting?

3.1 Communicate transparently

During the review, you can publicly indicate that the declaration is in progress, which is more credible than silence or a premature claim of compliance.

Recommended wording in the footer or privacy policy:

CNDP declaration no. [acknowledgement of receipt number] — under review. The receipt number will be published upon receipt.

This is what DataSouv applies itself: operational transparency is a signal of seriousness, not a weakness.

3.2 Anticipate operational compliance

While waiting, finalise all operational workstreams:

• Privacy policy published
• Cookie banner with effective runtime blocking
• Security headers (HSTS, CSP, etc.)
• Internal rights-handling procedure
• DPAs signed with processors

Many organisations file their F211 and then passively wait for the receipt — that is precisely the time to accelerate everything else.

3.3 Follow up proactively

• Courteous follow-up at 8 weeks if no response, recalling the acknowledgement number
• Status update requested at 4 months if no answer
• Preservation of all correspondence with the CNDP (emails, letters, requests for further information)

4. Displaying and using the receipt

4.1 Where to display it publicly

The receipt must be visible in order to materialise compliance:

• Website footer: CNDP number consistently displayed
• Privacy policy: full mention with the purpose covered
• Legal notice: systematic mention
• Public register of processing activities (if published — a hallmark of exemplary practice)
• Internal documentation: easily accessible to teams in case of requests

4.2 How to word it

Standard footer wording:

Processing declared to the CNDP — receipt no. [number]

Standard wording in the privacy policy:

The processing described in this policy has been declared to the Commission Nationale de contrôle de la Protection des Données à caractère Personnel (CNDP), registered under number [number] issued on [date].

4.3 In the event of a CNDP inspection

During an inspection, the receipt is one of the first documents requested. Without a receipt, the organisation must prove that it has at least filed a dossier (acknowledgement of receipt). Without any filing at all, the inspection drifts towards a finding of formal non-compliance, with a near-systematic formal notice.

5. What to do in the event of a refusal or reservations?

5.1 Reasoned refusal

A refusal is always reasoned by the Commission. Typical grounds:

• Incorrect qualification: processing declared as F211 but falling under F112 (prior authorisation)
• Purpose insufficiently precise or incompatible with the law
• Sub-processing outside the EU/Morocco not documented
• Disproportionate retention period
• Inadequate security measures

5.2 Reservations attached to the receipt

More frequent than an outright refusal: the receipt issued with reservations. This means that the processing is accepted subject to certain corrections (e.g. limiting the duration, adding consent, tightening a security measure). These reservations are enforceable against the organisation and must be applied.

5.3 Appeals

A refusal may be the subject of an administrative appeal before the CNDP itself, and where appropriate an appeal before the competent administrative court. This is rare in practice for F211 filings — the usual route is to resubmit a corrected dossier rather than to challenge.

6. Maintaining the receipt over time

A receipt is not a "lifetime passport". It covers the declared scope. With each substantial change, the appropriate form must be resubmitted to notify the CNDP of the modification:

• Change of purpose or addition of a new purpose
• New major processor (host, SaaS)
• New category of data collected
• Change of data controller
• Substantial extension of the retention period
• New international transfer

Otherwise, the receipt becomes void for the modified scope — the CNDP may consider the processing to be undeclared.

7. Resources

• Pillar guide — CNDP compliance in Morocco 2026
• F211 — how to file a standard declaration
• Service — Turnkey CNDP formalities
• Our public register of processing activities
• Official CNDP website

The CNDP receipt is not just an administrative slip. It is the public materialisation of your data-management rigour — a strong signal to your clients, your EU partners, your auditors. An organisation that displays a receipt in its footer and publishes its register is perceived, at virtually zero cost, as structurally more serious than one that displays nothing. It is one of the most accessible differentiation levers in the Moroccan market in 2026.

Nadia T. — compliance consultant, DataSouv contributor. Article reviewed and validated by Amine Rais, founder.