Cybercrime: Legal Overlap Explained 2026

The digital landscape in Morocco has transformed at a staggering pace. Imagine a scenario where a local business owner discovers that their private database has been breached, or a social media user finds themselves the target of a coordinated defamation campaign. In 2026, the question is no longer just "Is this a crime?" but rather "Which law applies?"

In the Moroccan legal system, a single digital act—such as posting a leaked document or accessing a private server—can trigger a complex overlap of different statutes. You might find yourself at the intersection of the Penal Code, the Press and Publication Law, and the Personal Data Protection Law. Navigating this "legal overlap" is critical for victims seeking justice and for professionals aiming to remain compliant with the law.

This article provides an exhaustive analysis of how Moroccan law treats الجريمة الإلكترونية (Cybercrime) in 2026. We will explore the primary legislative foundations, the hierarchy of liability, and the practical procedures for handling digital disputes in the Kingdom’s courts.

1. The Legal Foundation of Cybercrime in Morocco

Morocco has built a robust "legal arsenal" to combat digital threats while attempting to balance the constitutional right to حرية التعبير (Freedom of Expression). The framework is not found in a single "Cyber Law" but is distributed across several key codes.

Law No. 07-03: The Penal Code Amendment

The bedrock of cybercrime prosecution remains Law No. 07-03, which integrated a specific chapter into the Moroccan Penal Code (قانون العقوبات) regarding the "automated processing of data."

• Article 607-3: Criminalizes the unauthorized access to all or part of an automated data processing system.
• Article 607-6: Prescribes penalties for those who intentionally obstruct or distort the functioning of such systems.

Law No. 88-13: The Press and Publication Code

When cybercrime involves content—such as defamation, fake news, or the incitement of violence—the Press and Publication Law (Law 88-13) often takes precedence over the general Penal Code for professional journalists and digital media outlets.

• Article 95 of this law establishes a strict "hierarchy of liability" for digital content, placing the Director of Publication (مدير النشر) at the top of the responsibility chain.
• Article 37 regulates the suspension of electronic newspapers, stating that a digital news site cannot be blocked except by a judicial order, and generally for a period not exceeding one month.

Law No. 09-08: Personal Data Protection

Any digital crime involving the "processing" of names, addresses, or private details of individuals triggers Law No. 09-08. As noted in Reference 7, electronic newspapers are explicitly bound by the provisions of Law 09-08, ensuring that the right to inform does not infringe upon the right to digital privacy.

Law No. 22.01: Criminal Procedure

The Code of Criminal Procedure, recently updated as of September 8, 2025 (as seen in Reference 8), dictates how digital evidence is collected. Under the reforms of Law 03.23, the Moroccan judiciary has modernized the way it handles electronic signatures, intercepted communications, and digital forensics.

2. Practical Guide: Navigating a Cybercrime Case in 2026

If you are a victim of a digital offense or a business facing a compliance audit, the following procedures and timelines are essential to understand.

Step 1: Evidence Preservation

In the digital realm, evidence is volatile. In Morocco, for a digital screenshot or log file to hold weight in court, it is highly recommended to involve a Judicial Officer (Huissier de Justice).

• Procedure: The officer views the content (e.g., a defamatory post or a hacked interface) and drafts a formal report (Procès-verbal).
• Cost: Fees vary but usually range from 500 to 1,500 MAD depending on the complexity of the digital findings. You can find more details on judicial officer enforcement powers here.

Step 2: Filing the Complaint

Complaints can be filed directly with the Public Prosecutor (Procureur du Roi) at the First Instance Court or through the National Police (DGSN) or Royal Gendarmerie's specialized cybercrime units.

• Required Documents: The Huissier’s report, copies of the digital evidence, and proof of identity.
• Digital Filing: Under Law 43-20, many of these filings can now be initiated through the mahakim.ma portal.

Step 3: Judicial Intervention and "Urgent Orders"

In cases of ongoing harm (e.g., an intimate photo being shared or a site actively spreading hate speech), the law allows for rapid intervention.

• Article 37 (Press Law): The President of the Court can issue an "urgent order" (أمر استعجالي) based on a request from the Public Prosecution to temporarily block access to specific content or a site if it involves direct incitement to crimes or terrorism.

Timelines and Penalties

• Blocking Duration: Judicial blocking of a site under the Press Law is typically limited to one month unless a final judgment is rendered.
• Fines and Prison: Penalties for unauthorized system access (hacking) can range from 1 month to 3 years in prison, with fines reaching 100,000 MAD, depending on whether data was merely "viewed" or "deleted/modified."

3. Key Provisions Explained: Content vs. System Crimes

Understanding the "Overlap" means knowing which legal "hat" the judge will wear. Moroccan courts distinguish between System Crimes (Hacking/DDoS) and Content Crimes (Defamation/Fake News).

The Hierarchy of Responsibility (Article 95)

One of the most critical aspects of Moroccan digital law is who gets blamed when a crime is committed online. According to Article 95 of the Press Law, the liability follows this order:

1. Directors of Publication: They are the primary "authors" in the eyes of the law.
2. The Content Creator: If no director exists.
3. The Printer/Service Provider: If the above cannot be identified.
4. The Host (Hébergeur): The entity providing the server space.

This hierarchy is designed to ensure that victims can always find a legal person to hold accountable, even if the original poster used a pseudonym. For more on how this affects social media, see our guide on social media risks in Morocco.

Prohibited Content under Articles 73, 75, and 76

The law is particularly strict regarding certain types of digital content. Reference 5 highlights that it is strictly forbidden to:

• Article 75: Violate the "secrecy of investigation" or the "presumption of innocence" before a verdict is reached.
• Article 76: Publish internal deliberations of the judiciary or details of cases involving minors.
• Incitement: Direct incitement to murder, terrorism, or discrimination allows the court to order the immediate withdrawal of the digital material.

Corporate Governance in Emergencies

Interestingly, Moroccan law also adapts digital rules for corporate survival. Reference 1 (Law 27.20) demonstrates that during states of emergency, companies are legally permitted to hold board meetings and "calculate accounts" via video conferencing (وسائل االتصال بالصوت والصورة). This shows that the "digital" is not just a space for crime, but a legally recognized space for administrative and commercial validity.

4. Common Mistakes & How to Avoid Them

Mistake 1: Assuming "Freedom of Expression" is Absolute

Many users believe that حرية التعبير protects all online speech. However, under Article 75, if you post photos or drawings that "defame by depicting the circumstances of a crime" (such as a murder or assault) in a way that harms public morals, you face criminal liability.

• Solution: Avoid sharing graphic details of ongoing criminal cases or private photos of individuals without explicit consent.

Mistake 2: Deleting Evidence Too Quickly

If you are a victim of a cyber-attack, your first instinct might be to wipe the server and start over.

• Solution: In Morocco, digital evidence must be "authenticated." If you delete the logs before a Huissier or the police can verify them, your case in court will likely fail.

Mistake 3: Ignoring CNDP Obligations

If you run an e-commerce site or a blog in Morocco, you are likely collecting personal data. Failing to register your database with the CNDP (National Commission for the Protection of Personal Data) is itself a violation that can be compounded if a data breach occurs. For a step-by-step on this, read about CNDP authorization.

Mistake 4: Misunderstanding "Authorized Access"

Some believe that if a website has a "vulnerability," it is legal to enter and explore. Under Article 607-3 of the Penal Code, the mere act of staying in a system after realizing you are not authorized is a crime.

• Solution: Implement strict "Terms of Use" on your digital platforms to clearly define what constitutes "authorized access."

5. Conclusion and Key Takeaways

As we move through 2026, the intersection of technology and the law in المغرب continues to evolve. The Moroccan legislator has moved away from a "wild west" digital environment toward a structured framework where the Penal Code, Press Law, and Data Protection Law work in tandem.

Whether you are a journalist navigating the responsibilities of Article 95, or a citizen protecting your digital identity, understanding these overlaps is the only way to ensure full legal protection. The modernization of the Code of Criminal Procedure (Reference 8) ensures that our courts are now better equipped than ever to handle digital evidence, making the "virtual" world just as legally consequential as the physical one.

---

Related Search Terms

9anoun ai, 9anon ai, kanon ai, kanoun ai, qanon ai, qanoun ai