Protecting city data and the people behind it
A connected city handles two kinds of data that call for care: personal data (staff, citizens, people in public space) and infrastructure data that is essential to the continuity of public services. UrbiSense applications are designed to protect both.
Two kinds of sensitive data
Most street lighting data is technical: energy use, faults, operating hours. But a connected city platform also handles personal data — user accounts, field technicians, citizen complaints, images of public space — and infrastructure data: maps of the electrical network, cabinet locations and remote commands. The first is governed by Law No. 09-08; the second falls under the cybersecurity framework (Law No. 05-20) when the municipality or its infrastructure is covered by it.
Classification of data hosted for municipalities
| Level | Data | Examples |
|---|---|---|
| 1 · Low | Public information | Aggregated inventory, number of luminaires, overall energy savings |
| 2 · Moderate | Operating data | Consumption, faults, schedules, maintenance history |
| 3 · High | Infrastructure data | Electrical network maps, cabinet locations, remote commands |
| 4 · High | Personal data | User accounts, technicians, citizen complaints (name, phone, address) |
| 5 · Very high | Images of public space | Survey photos and AI analysis that may show faces or number plates |
Risk analysis and security measures
Each deployment is preceded by a risk analysis carried out with the customer. It takes into account the sensitivity of the data, the services concerned and the local context, and determines proportionate measures. Our applications rely in particular on:
- encryption of data in transit and at rest;
- strong authentication and access rights by role;
- logging and traceability of actions;
- backups and continuity plans, with hosting in Morocco;
- data export in open formats (reversibility).
The detailed analysis is presented to each customer as part of the project.
CNDP compliance, application by application
Under Law No. 09-08, personal data processing must be declared to the CNDP before it starts (art. 12 et seq.), and some processing requires prior authorisation (art. 21-22), in particular sensitive data and transfers abroad (art. 43-44). Each UrbiSense application is designed to meet these formalities, and we provide our customers with the documentation they need.
| Application | Personal data processed | CNDP formality |
|---|---|---|
| Cabinet and segment controllers | Operator accounts and command logs only | Declaration |
| City digital twin | User accounts, action logs | Declaration |
| GIS and mobile mapping | Field agents, survey geolocation, photos | Declaration |
| AI asset recognition | Images of public space | Declaration or authorisation, depending on the case |
| Street lighting CMMS | Technicians, interventions, citizen complaints | Declaration |
Rights of the people concerned
Citizens, staff and users can exercise their rights of access, rectification and objection (Law No. 09-08, art. 7-9). Contact: contact@urbisense.com.
Open to international frameworks
To deploy UrbiSense applications outside Morocco or with international partners, our practices draw on recognised frameworks:
GDPR (EU Regulation 2016/679)
Processor agreements, records of processing, impact assessments and data subject rights are built into our processes; transfers from the EU rely on the European Commission's standard contractual clauses.
ISO/IEC 27001
The international reference standard for information security management.
Local data protection laws
For projects abroad, hosting can be placed in the customer's country when local law requires it.
Frequently asked questions
What personal data do UrbiSense applications process?
Depending on the application: user accounts and action logs, field staff and their interventions, citizen complaints, and images of public space used for asset inventory.
Do UrbiSense applications comply with Law 09-08?
UrbiSense applications are designed in line with CNDP guidelines and the formalities set by Law 09-08, and we provide our customers with the documentation they need.
Does municipal data leave Morocco?
No. Platforms and customer data are hosted in Morocco, with certified national infrastructure operators.
Can UrbiSense applications be used outside Morocco?
Yes. Our practices draw on the GDPR and ISO/IEC 27001, and hosting can be placed in the customer's country when local law requires it.
A question about your data?
We can provide the documentation needed for your CNDP formalities and your security audits.