F211, F112, F118, F214, F113 — filing and follow-up up to receipt
Mapping of your processing activities, qualification of the right form, complete case preparation, filing with the CNDP and follow-up of the review until the receipt is issued. You receive a case file that cannot be rejected on form.
Main forms
Every processing activity has its form — you still need to pick the right one
Law 09-08 organises filings according to the nature of the processing. The choice of form drives the review timeline and the exposure to subsequent inspections.
F211Standard declaration
Prior declaration for ordinary processing activities not subject to authorisation. Covers most HR, customer, supplier and non-sensitive video surveillance processing. CNDP receipt issued after review.
Typical cases
E-commerce sites, CRM, HR management, prospect database, premises video surveillance.
F112Prior authorisation
Authorisation request for processing presenting specific risks: sensitive data (health, offences, biometrics), file interconnection, high-risk purposes. In-depth review mandatory.
Typical cases
Health data, credit scoring, access biometrics, litigation files, sensitive interconnections.
F118International transfer
Authorisation required to transfer data outside Morocco to a country that does not offer an adequate level of protection. Justification of the transfer, contractual safeguards (SCC), assessment of the destination country.
Typical cases
Use of US SaaS (Google Workspace, Microsoft 365, Salesforce), hosting outside Morocco, IT outsourcing.
F214Simplified declaration
Simplified declaration for processing covered by a framework decision published by the CNDP (template video surveillance, template HR). Lighter procedure, faster review than an F211.
Typical cases
Template video surveillance framed by a CNDP decision, HR processing aligned with the CNDP template, cases covered by a framework deliberation.
Our process
Six steps from mapping to receipt
- 1
Preliminary mapping
Inventory of the processing activities to declare. Many organisations underestimate the count: websites, HR, accounting, marketing, support, video surveillance, internal user accounts. Each distinct purpose is the subject of its own declaration or sheet.
- 2
Form qualification
For each processing activity, determination of the relevant form (F211, F112, F118, F214, F113). Sensitive processing often falls under F112 even when the organisation assumed F211. This qualification is the most common mistake in DIY filings.
- 3
Case preparation
Drafting of the CNDP form, annexes (processing sheets, security measures, transfer sheets) and supporting documents (articles of association, mandate of the declarant, DPO org chart where applicable). Everything is internally reviewed before filing.
- 4
Filing and acknowledgement
Filing through the current CNDP channels (online service, mail, physical filing). Retention of the acknowledgement of receipt, which becomes proof of diligence in case of an inspection during review.
- 5
Review follow-up
Interface with the CNDP in case of requests for additional information. Review timeline varies with the Commission's workload and case complexity. We keep track of every exchange and update you every two weeks.
- 6
Receipt and publication
Receipt of the CNDP receipt and notification to the declarant. Recommended publication in the website footer and privacy policy, a strong transparency signal. Archival for future renewal or substantial change.
Recurring mistakes
The traps of DIY filings
Drawn from observation of the Moroccan market — strictly anonymised by sector, never named.
Under-declaration
Wrong F211/F112 qualification
F118 forgotten for US SaaS
No amending filing after evolution
Frequently asked questions
What we are asked about filings
How long to obtain a receipt?
The law sets a theoretical timeline but in practice, review takes between 6 weeks and 6 months depending on the Commission's workload and case complexity. An F112 (prior authorisation) is always longer than an F211. We follow up the review and chase at the useful deadlines.
What happens during the review?
The filing acknowledgement is proof of good faith. You may continue to operate the processing activity, provided it complies with the principles of Law 09-08. If the CNDP requests additions or refuses, we adjust the case and refile at no extra cost.
Can I file by myself?
Yes, it is legally possible. The CNDP makes the forms available. The difficulty is not administrative but qualifying: choosing the right form, calibrating the purposes, anticipating the reviewer's questions, documenting processors. A poorly qualified filing can be refused or expose you to an unfavourable subsequent inspection.
What does a filing cost?
Flat-fee pricing per form. As a guide: a simple F211 from 6,000 MAD, an F112 (prior authorisation) from 12,000 MAD, an F118 (international transfer) from 8,000 MAD, an F214 (simplified declaration) from 5,000 MAD. For organisations with 5 processing activities or more, bundled flat fee.
Do you work with a lawyer?
For litigation files or sensitive authorisations, we coordinate with a specialised law firm. For most declaratory cases, our intervention is sufficient: a CNDP filing is a documented administrative act, not litigation.
What is the risk if I do not file?
Failure to file exposes you to administrative and criminal sanctions provided by Law 09-08. Beyond regulatory risk, lack of a filing is increasingly a blocking criterion in public tenders, M&A due diligence, and partnerships with EU groups subject to the GDPR.
How many activities should you file?
In a 30-minute free scoping call, we estimate the number of filings required and the associated flat fee. No automated commercial follow-up. Reply within 48 business hours.