Act 2020 status not recorded
Loi n° 05-20 relative à la cybersécurité (Law No. 05-20 on cybersecurity)
Plain-English summary
Promulgated by Dahir n° 1-20-69 of 25 July 2020 (BO 6906 of 6 August 2020). It provides for a national cybersecurity authority (Arts. 1, 38), incident declaration (Arts. 8, 30, 33), critical infrastructure and sensitive systems (Arts. 14-19), audits (Arts. 4, 20-24, 34) and penalties (Arts. 49-52). Decree 2-21-406 of 15 July 2021 implements it and designates the DGSSI as the authority.
Who it applies to
All industries
Topics
Cybersecurity & IT Risk
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Cybersecurity incident declaration to the national authority | Deadline As soon as the entity becomes aware (Art. 8); without delay (Art. 30) | — | source | |
Art. 8 of Law 05-20 requires entities to report incidents affecting security to the national authority as soon as they become aware of them. Art. 30 requires telecom operators, internet service providers, cybersecurity providers, digital service providers and platform publishers to alert the authority without delay when they detect events that could affect their clients' systems. Art. 33 requires digital service providers to report incidents with a significant impact on service delivery. No fixed hour or day limit was found in the text read. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.