The National Commission for the Control of Personal Data Protection. This commission is established under the Prime Minister and tasked with ensuring compliance with the law (art. 27).
It receives and investigates complaints. The Commission is competent to receive complaints from any person who considers themselves harmed by a data-processing operation, to investigate them and act on them, by ordering the publication of corrections and/or referral to the Crown Prosecutor for the purpose of prosecution (art. 28).
Its powers are extensive. It has powers of investigation and inquiry enabling its commissioned agents to access the processed data and the premises and to seize the necessary documents (art. 30). It can order the necessary rectifications, as well as the blocking, erasure or destruction of data, and provisionally or definitively prohibit a processing operation (art. 30).
The special case of rectification. If the controller refuses to rectify your data or does not respond within the ten-day period, you can submit a rectification request directly to the Commission, which carries out the relevant investigations (art. 8). The Commission can also have justified rectifications carried out where the controller refuses (art. 28).
This is general legal information, not legal advice. For advice on your specific situation, consult a lawyer admitted to the Bar in Morocco.