Data Privacy Interactive Map - Maryland

Highlights

Covered Entities: A sole proprietorship, partnership, corporation, association, or any other business entity, whether or not organized or not organized to operate at a profit, including a financial institution organized, chartered, licensed, or otherwise authorized under the laws of Maryland, any other state, the United States, or any other country, and the parent or subsidiary of a financial institution that owns, licenses, or maintains computerized data that includes personal information of an individual residing in Maryland.

Consumer Notification: When there is a breach of personal information.

Regulatory Notification: To the Maryland Office of the Attorney General.

Notification Timeline: As soon as reasonably practicable but no later than 45 days after discovery or notification of the breach of the security of a system.

Data Format: Computerized data.

Citations: Md. Code Ann., Com. Law § 14-3501 et seq.

More Details

Definitions:

• Breach: Breach of the security of a system means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a business.
• Personal Information (PI): 
  • An individual’s first name or first initial and last name in combination with any one or more of the following data elements, when the data elements are not encrypted, redacted, or otherwise protected by another method that renders the information unreadable or unusable:
    • A Social Security number, an Individual Taxpayer Identification Number, a passport number, or other identification number used by the federal government;
    • A driver’s license number or State identification card number;
    • An account number, a credit card number, or a debit card number, in combination with any required security code, access code, or password, that permits access to an individual’s financial account;
    • Health information, including information about an individual’s mental health;
    • A health insurance policy or certificate number or health insurance subscriber identification number, in combination with a unique identifier used by an insurer or an employer that is self-insured that permits access to an individual’s health information;
    • Biometric data of an individual generated by automatic measurements of an individual’s biological characteristics such as fingerprint, voice print, genetic print, retina or iris image, or other unique biological characteristic, that can be used to uniquely authenticate the individual’s identity when the individual accesses a system or account; or
    • Genetic information with respect to an individual for purposes of notifications required under § 14-3504(b)(2), (c), (d), (e), (f), and (g).
  • A username or e-mail address in combination with a password or security question and answer that permits access to an individual’s e-mail account.
• Medical Information: ”Health Information” means any information regarding an individual’s medical history, medical condition, or medical treatment or diagnosis

Safe Harbors:

• Encryption: Does not apply to information that is encrypted, redacted, or otherwise protected by another method that renders it unreadable or unusable.
• Good Faith: A breach of the security of a system does not include the good faith acquisition of personal information by an employee or agent of a business for the purposes of the business, provided that the personal information is not used or subject to further acquisition.
• Risk of Harm: Notification is not required if the entity, as soon as a potential breach is discovered or made known, conducts a reasonable, prompt, and good faith investigation, and determines that the breach of the security of the system does not create a likelihood that personal information of the individual has been or will be misused. The entity must maintain records of the determination in writing for three (3) years.
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation or jeopardize homeland or national security.

Direct Notice:

• Timing: As soon as reasonably practicable to determine the scope of the breach of the security of a system, identify the individuals affected, or restore the integrity of the system, but no later than fort-five (45) days after discovery or notification of the breach of the security of a system.
• Format: N/A
• Content: The notification shall include:
  • To the extent possible, a description of the categories of information that were, or are reasonably believed to have been, acquired by an unauthorized person, including which of the elements of personal information were, or are reasonably believed to have been, acquired;
  • Contact information for the business, including address, telephone number, and toll-free telephone number if one is maintained;
  • The toll-free telephone numbers and addresses for major consumer reporting agencies; and
  • The toll-free telephone numbers, addresses, and website addresses for the Federal Trade Commission and the Maryland Office of the Attorney General.
• Method: By written notice sent to the most recent address of the individual in the records of the entity. By electronic mail to the most recent electronic email address of the individual in the records of the entity, if: (i) the individual has expressly consented to receive electronic notice; or (ii) the business conducts its business primarily through Internet account transactions or the Internet. By telephonic notice, to the most recent telephone number of the individual in the records of the business.

Substitute Notice:

Substitute Notice may be given if the business does not have sufficient contact information to give written, electronic mail or telephonic notice. Substitute notice must consist of: electronically mailing the notice if the entity has an electronic mail address for the individual to be notified; conspicuous posting of the notice on the website of the entity; and notification to a major print or broadcast media in the geographic areas where the individuals affected by the breach likely reside.

Remediation Services:

N/A

Regulatory Notice:

Prior to giving the notification required to consumers, a business shall provide notice of a breach of the security of a system to the Maryland Office of the Attorney General, which shall include, at a minimum, (i) the number of affected individuals residing in Maryland; (ii) a description of the breach of the security of a system, including when and how it occurred; (iii) any steps the business has taken or plans to take relating to the breach of the security of a system; and (iv) the form of notice that will be sent to affected individuals and a sample notice.

Credit Reporting Agencies Notice:

If a business is required to give notice of a breach of a security of system to 1,000 or more individuals, the business also shall notify, without unreasonable delay, each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis of the timing, distribution, and content of the notices.

Third-Party Notice:

A business that maintains computerized data that includes personal information of an individual residing in Maryland that the business does not own or license, when it discovers or is notified of a breach of the security of a system, shall notify, as soon as practicable, but not later than 10 days after discovery or notification of the breach of the security of a system, the owner or licensee of the personal information of the breach of the security of a system, and shall share information relative to the breach to allow the owner or licensee to provide notification of the breach, protect or secure personal information or provide notification to national information security organizations, to alert and avert new or expanded breaches.

HIPAA:

N/A

Private Action:

A violation of the statute is an unfair or deceptive trade practice within the meaning of Maryland’s Consumer Protection Act (Md. Code Ann., Com. Law § 13-101 et seq.), and is subject to the enforcement and penalty provisions of Title 13. A consumer who is subjected to a violation may file a complaint with the Division of Consumer Protection of the Maryland Office of the Attorney General.

Associated Regulations:

• Insurance Data Security (Md. Code Ann., Ins. §§ 33-101 - 33-109)
• Information Security Standard (Md. Com. Law Code §§ 14-3501 to 3503, 3507, 3508)
• Md. Code Ann., Com. Law § 13-101 et seq.

Highlights

Covered Entities: As defined, "carrier" includes": an authorized insurer, a nonprofit health service plan, a health maintenance organization, a dental organization, a managed general agent, or a third-party administrator; not including a purchasing group or a risk retention group chartered and licensed in a state other than Maryland or a person that is acting as an assuming insurer that is domiciled in another state or jurisdiction.

Security Standard: A carrier must develop, implement, and maintain a comprehensive written information security program based on the licensee’s risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee’s information systems.

Consumer Notification: A carrier shall comply with the Maryland Personal Information Protection Act, Subtitle 35 of Title 14, as applicable.

Regulatory Notification: A carrier shall notify the Maryland Insurance Commissioner as promptly as possible but in no event later than 3 business days from a determination that a cybersecurity event involving nonpublic information that is in the possession of a carrier has occurred, when either of the criteria referenced below has been met.

Notification Timeline: As promptly as possible but in no event later than 3 business days from a determination that a cybersecurity event involving nonpublic information that is in the possession of a carrier has occurred.

Citations: Md. Code Ann., Ins. §§33-101 – 33-109.

More Details

Definitions:

• Consumer: An individual, including an applicant, a policyholder, an insured, a beneficiary, a claimant, and a certificate holder, who is a resident of Maryland and whose nonpublic information is in a carrier’s possession, custody, or control.
• Cybersecurity Event: An event resulting in unauthorized access to, or disruption or misuse of, an information system or nonpublic information stored on an information system, not including an event resulting in the unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization; or an event with regard to which the licensee has reasonably determined that the nonpublic information accessed by an unauthorized person has not been and will not be used or released and has been returned or destroyed.
• Licensee: An authorized insurer; a nonprofit health service plan; a health maintenance organization; a dental organization; a managed general agent; or a third-party administrator, not including a purchasing group or a risk retention group chartered and licensed in a state other than Maryland or a person that is acting as an assuming insurer that is domiciled in another state or jurisdiction.
• Nonpublic Information: Electronic information that is not publicly available information and is any of the following:
  
  • Business-related information of a licensee the tampering with which, or unauthorized disclosure, access, or use of which, would cause a material adverse impact to the business, operations, or security of the licensee.
  • Information concerning a consumer that, because of name, number, personal mark, or other identifier, can be used to identify the consumer, in combination with one (1) or more of the following data elements:
    
    • Social Security number;
    • driver's license number or nondriver identification card number;
    • account, credit, or debit card number;
    • a security code, an access code, or a password that would allow access to a consumer's financial account; or
    • biometric records; or
  • Information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify a particular consumer and that relates to:
    
    • the past, present, or future physical, mental, or behavioral health or condition of a consumer or a member of the consumer's family;
    • the provision of health care to a consumer; or
    • payment for the provision of health care to a consumer.

Regulatory Notice:

A carrier shall notify the Maryland Insurance Commissioner as promptly as possible but in no event later than 3 business days from a determination that a cybersecurity event involving nonpublic information has occurred, when either of the following criteria has been met:

• Maryland is the state of domicile of the carrier, and the cybersecurity event has a reasonable likelihood of harming a consumer residing in the State or any material part of the normal operations of the licensee; or
• The carrier reasonably believes that the nonpublic information involved is of 250 or more consumers residing in Maryland and either of the following circumstances is present:
  
  • A cybersecurity event impacting the carrier has occurred for which notice must be provided to a government body, self-regulatory agency, or any other supervisory body under state or federal law; or
  • A cybersecurity event that has a reasonable likelihood of materially harming either a consumer residing in Maryland or a material part of licensee’s operations.

Content Requirements:

When notifying the Maryland Insurance Commissioner of a cybersecurity event, a carrier shall provide as much of the following information as reasonably possible:

• The date of the cybersecurity event.
• A description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of third-party service providers, if any.
• How the cybersecurity event was discovered.
• Whether any lost, stolen, or breached information has been recovered and, if so, how this was done.
• The identity of the source of the cybersecurity event.
• Whether the carrier has filed a police report or has notified a regulatory, government, or law enforcement agency and, if so, when the notification was provided.
• A description of the specific types of information acquired without authorization and, more specifically, particular data elements, such as types of medical information, types of financial information, or types of information allowing identification of the consumer.
• The period during which the information system was compromised by the cybersecurity event.
• The number of total consumers in Maryland affected by the cybersecurity event, with the licensee providing: the best estimate of this number in its initial report to the Commissioner; and an updated estimate of this number in each subsequent report to the Commissioner in accordance with this section.
• The results of any internal review identifying a lapse in either automated controls or internal procedures were or confirming that all automated controls or internal procedures were followed.
• A description of efforts being undertaken to remediate the situation which permitted the cybersecurity event to occur.
• A copy of the carrier’s privacy policy and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event.
• The name of a contact person who is both familiar with the cybersecurity event and authorized to act for the carrier.

Third-Party Notice Requirements:

In addition to any other sanction to which a carrier may be subject, a carrier that violates a provision of this title is subject to a penalty of not less than $100 but not more than $125,000 for each violation of this title.

Penalties:

In addition to any other sanction to which a licensee may be subject, a licensee that violates a provision of this title is subject to a penalty of not less than $100 but not more than $125,000 for each violation of this title.

Associated Regulations:

• Md. Code Ann., Com. Law § 14-3501 et seq.

Highlights

Covered Entities: Any entity that conducts business in the state or that owns or licenses computerized data that includes personal information, or any agency that owns or licenses computerized data that includes personal information.

First Party Security Standard: To protect personal information from unauthorized access, use, modification, or disclosure, a business that owns, maintains, or licenses personal information of an individual residing in the State shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information owned, maintained, or licensed and the nature and size of the business and its operations. Separately, a controller subject to the Maryland Online Data Privacy Act (MODPA) must establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data, appropriate to the volume and nature of the personal data at issue. MODPA took effect October 1, 2025 and applies to processing activities occurring on or after April 1, 2026.

Third Party Security Standard: A business that uses a non-affiliated third party as a service provider to perform services for the business and discloses personal information about an individual residing in the State under a written contract with the third party shall require by contract that the third party implement and maintain reasonable security procedures and practices that: are appropriate to the nature of the personal information disclosed to the nonaffiliated third party, and are reasonably designed to help protect the personal information from unauthorized access, use, modification, disclosure, or destruction.

Disposal/Destruction Standard: When a business is destroying a customer’s, an employee’s, or a former employee’s records that contain personal information of the customer, employee, or former employee, the business shall take reasonable steps to protect against unauthorized access to or use of the personal information, taking into account: the sensitivity of the records; the nature and size of the business and its operations; the costs and benefits of different destruction methods; and available technology.

Data Format: Electronic and Paper.

Citations: Md. Com. Law Code §§ 14-3501 to 3503, 3507, 3508; Md. Com. Law Code §§ 14-4601 to 4615 (Maryland Online Data Privacy Act), in particular § 14-4607

More Details

Definitions:

• Personal Information (PI): An individual’s first name / first initial and last name in combination with one (1) or more of the following unencrypted data elements:
  
  • Social Security number, individual taxpayer identification number, passport number, or other identification number issued by the federal government;
  • Driver’s license number or state identification card number;
  • Account number, credit or debit card number, in combination with any required security code, access code, or password to permit access to an individual’s financial account;
  • Health information, including information about an individual’s mental health;
  • Health insurance policy or certificate number or health insurance subscriber identification number, in combination with a unique identifier used by an insurer or an employer that is self-insured, that permits access to an individual’s health information;
  • Biometric data of an individual generated by automatic measurements of an individual’s biological characteristics such as a fingerprint, voice print, genetic print, retina or iris image, or other unique biological characteristic, that can be used to uniquely authenticate the individual’s identity when the individual accesses a system or account; or
  • For purposes of the notifications required under § 14–3504(b)(2), (c), (d), (e), (f), and (g) of this subtitle, genetic information with respect to an individual.

PI also includes a user name or e–mail address in combination with a password or security question and answer that permits access to an individual’s e–mail account or For the purposes of the requirements of this title other than the notifications required under § 14–3504(b)(2), (c), (d), (e), (f), and (g) of this subtitle, genetic information with respect to an individual when the genetic information is not encrypted, redacted, or otherwise protected by another method that renders the information unreadable or unusable.

PI does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records, information that an individual has contended to have publicly disseminated or listed, or information that is disseminated or listed in accordance with the federal Health Insurance Portability and Accountability Act.

• Affiliate: A company that controls, is controlled by, or is under common control with a business described in subsection (c)(1) or (d)(1) of this section.

Methods of Compliance:

The statute does not define what constitutes reasonable security procedures and practices.

Exclusions:

A business that is subject to and in compliance with, or an affiliate that complies with:

• Requirements for notification procedures, the protection or security of personal information, or the destruction of personal information under the rules, regulations, procedures, or guidelines established by the primary or functional federal or State regulator of the business shall be deemed to be in compliance with this subtitle.
• § 501(b) of the federal Gramm–Leach–Bliley Act, 15 U.S.C. § 6801, § 216 of the federal Fair and Accurate Credit Transactions Act, 15 U.S.C. § 1681w, the federal Interagency Guidelines Establishing Information Security Standards, and the federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, and any revisions, additions, or substitutions, shall be deemed to be in compliance with this subtitle.
• The federal Health Insurance Portability and Accountability Act of 1996 shall be deemed to be in compliance with this subtitle.

Enforcement/Penalties:

Any person may bring an action to recover for injury or loss sustained by him/her as the result of a practice prohibited by this title. Any person who brings an action to recover for injury or loss under this section and who is awarded damages may also seek, and the court may award, reasonable attorney's fees.

Associated Regulations:

• Md. Code Com. § 13-408.

Md. Code Ann., Com. Law §§ 14-4701, et seq.

Highlights

Applicability:

The MODPA applies to a person that conducts business in Maryland or provides products or services that are targeted to residents of Maryland, and that during the preceding calendar year, either:

• Controlled or Processed Personal Data of at least 35,000 Consumers, excluding Personal Data controlled or Processed solely for the purpose of completing a payment transaction; or
• Controlled or Processed the Personal Data of at least 10,000 Consumers and derived more than 20 percent of gross revenue from the Sale of Personal Data.

Among other exclusions, the MODPA does not apply to the following entities: State government agencies; entities regulated by the Federal Securities Exchange Act or the Federal Commodity Exchange Act; financial institutions subject to the Gramm-Leach-Bliley Act; or nonprofit organizations that Process or share Personal Data to assist law enforcement in investigating insurance fraud or first responders in responding to catastrophic events.

In addition, the MODPA does not apply to the following types of information and data: protected health information under the Health Insurance Portability and Accountability Act; information related to consumer credit worthiness under the Fair Credit Reporting Act; financial data regulated by the Gramm-Leach-Bliley Act; data subject to the Drivers' Privacy Protection Act, the Family Educational Rights and Privacy Act, or the Farm Credit Act; data covered by HIPAA and related health care statutes; certain employment-related data; de-identified data; data maintained for emergency contact purposes; and/or certain data in the furtherance of the insurance business.

Controller and Processors that comply with verifiable parental consent requirements of COPPA are considered compliant with respect to obtaining consent from a Consumer who is a Child.

The MODPA applies only prospectively and may not be applied or interpreted to have any effect on or application to personal data processing activities before April 1, 2026.

Controller Obligations:

Among other obligations, the MODPA requires that Controllers:

• Limit the collection of Personal Data to what is reasonably necessary and proportionate to provide or maintain a specific product or service request by the Consumer to whom the information pertains.
• Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of Personal Data appropriate to the volume and nature of the Personal Data at issue.
• Provide an effective mechanism for a Consumer to revoke the Consumer’s consent that is as least as easy as the mechanism by which the Consumer provided consent.
• Stop Processing a Consumer’s Personal Data as soon as practicable, but not later than 30 days of receiving a Consumer’s revocation of consent.
• Provide a reasonably accessible, clear, and meaningful privacy notice that includes: categories of Personal Data Processed by the Controller, including Sensitive Data; purpose for Processing Personal Data; how a Consumer may exercise Consumer’s rights; categories of third parties with which the Controller shares Personal Data; categories of Personal Data the Controller shares with third parties, including Sensitive Data; and an active electronic mail address or other online mechanism the Consumer may use to contact the Controller.
• Provide clear and conspicuous disclosure within the privacy policy, along with a method for Consumers to opt-out ofthe Sale of Personal Data or Processing of Personal Data for Targeted Advertising, if Personal Data is Processed and/or sold for Targeted Advertising or Profiling.
• Establish a secure and reliable method for a Consumer to exercise a Consumer right.
• Respond to a Consumer request not later than 45 days after receipt of the Consumer request. A Controller may extend the completion period by 45 additional days if it is reasonably necessary to complete the request, based on the complexity and number of the Consumer’s requests, and the Controller informs the Consumer of the extension and the reason for the extension within the initial 45-day response period.
• If declining to act regarding a Consumer’s request, inform the Consumer without undue delay, but not later than 45 days after receiving the request, of the justifications for declining to act, and provide instructions for how the Consumer may appeal the decision. The appeal process must be conspicuously available and similar to the process for submitting a request to initiate an action.
• Inform a Consumer, in writing, within 60 days of receiving an appeal, of any action taken or not taken in response to the Consumer’s request, and the Controller’s reasons.
• If denying an appeal, provide the Consumer an online mechanism, if available, through which the Consumer may submit a complaint to the Attorney General.
• Provide information in response to a Consumer’s request, free of charge, once during any 12-month period.
• In response to Consumer requests that are manifestly unfounded, excessive, technically infeasible, or repetitive, charge the Consumer a reasonable fee to cover administrative costs or decline to act on the request. A Controller has the burden of demonstrating the manifestly unfounded, excessive, technically infeasible, or repetitive nature of the request.
• If a Consumer request cannot be authenticated, using commercially reasonable efforts, the Controller may not be required to comply with a request to initiate an action but must provide notice to the Consumer that the Controller is unable to authenticate the request until the Consumer provides additional information.
• A Controller may not be required to authenticate an opt out request.
• In the event Personal Data about a Consumer was obtained from a source other than the Consumer, a Controller will be considered compliant with the Consumer’s request to delete the Consumer’s Personal Data by retaining a record of the deletion request and the minimum data for the purpose of ensuring the Consumer’s Personal Data remains deleted from Controller’s records and is not used for any other purpose or by opting the Consumer out of the Processing of that Personal Data for any purpose other than an exempt purpose under the MODPA.
• In accordance with specific requirements, conduct and document, on a regular basis, a data protection assessment of each of the Controller’s Processing activities that present a heightened risk of harm to a Consumer, including the following: Targeted Advertising; the Sale of Personal Data; Processing Sensitive Data; Processing Personal Data for purposes of Profiling where the Profiling presents a reasonably foreseeable risk of unfair, abusive, or deceptive treatment, unlawful disparate impact, financial, physical, or reputational injury, intrusion on solitude or seclusion or private affairs or concerns offensive to a reasonable person, or other substantial injury; and Processing Personal Data that otherwise presents a heightened risk of harm to a Consumer.

A Controller may not:

• Collect, Process, or share Consumer Sensitive Data, unless strictly necessary to provide a product or service requested by a Consumer.
• Sell Sensitive Data.
• Process Personal Data in violation of State or federal laws that prohibit unlawful discrimination;
• Process Personal Data of a Consumer for the purposes of Targeted Advertising or sell the Personal Data of a Consumer, if the Controller knew or should have known that the Consumer is under the age of 18 years.
  • Sell the Personal Data of a Consumer if the Controller knew or should have known that the Consumer is under the age of 18 years.
• Collect, process, or transfer Personal Data or publicly available data in a manner that unlawfully discriminates in or otherwise unlawfully makes unavailable the equal enjoyment of goods or services on the basis of race, color, religion, national origin, sex, sexual orientation, gender identity, or disability, except in limited circumstances.
• Discriminate against a Consumer for exercising a Consumer right, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the Consumer.
• Process Personal Data for a purpose that is neither necessary to, nor compatible with, the disclosed purposes for which the Personal Data is processed, as disclosed to the Consumer, without the Consumer’s consent.

In addition, the MODPA prohibits a person from:

• Except in limited circumstances, providing an employee or contractor access to Consumer Health Data, except in limited circumstances.
• Except in limited circumstances, providing a Processor access to Consumer Health Data.
• Using a geofence to establish a virtual boundary that is within 1,750 feet of any mental health facility or reproductive or sexual health facility for the purpose of identifying, tracking, or collecting data from, or sending any notification to, a Consumer, regarding the Consumer’s Consumer Health Data.

Processor Obligations:

Among other obligations, the MODPA requires Processors to:

• Adhere to the instructions of, and assist the Controller in, complying with obligations, including: by appropriate technical and organizational measures reasonably practicable to fulfill the Controller's obligation to respond to Consumer requests; by assisting the Controller's in fulfilling its obligations in relation to the security of processing Personal Data and in relation to notification of a breach of the security of a system; and provide necessary information to enable the Controller to conduct and document any data protection assessments.
• Enter into a binding contract with the Controller that sets forth instructions for the Processor, including instructions for Processing data, the nature and purpose of Processing, the type of data subject to Processing, the duration of Processing, and the rights and obligations of both parties.
• Ensure that each person Processing Personal Data is subject to a duty of confidentiality with respect to the Personal Data.
• Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of Personal Data, considering the volume and nature of the Personal Data.
• Stop Processing data on the request of the Controller, made in accordance with a Consumer’s authenticated request.
• At the Controller’s direction, delete or return all Personal Data to the Controller at the end of provision of service, unless retention is required by law. Upon reasonable request, make available to the Controller, upon reasonable request, information demonstrating Processor’s compliance with its obligations.
• After providing the Controller an opportunity to object, engage a subcontractor, in accordance with a written contract that requires the subcontractor to meet the obligations of the Processor with respect to Personal Data.
• Allow and cooperate with reasonable assessments by the Controller, the Controller’s designated assessor, or a qualified and independent assessor arranged for by the Processor to assess the Processor’s policies and technical and organizational measures in support of the Processor’s obligations. Note: Compliance with Processor instructions, contracts, or assessments does not relieve a Controller or Processor from the liabilities imposed on the Controller or Processor under the MODPA.

Consumer Rights:

Under the MODPA, a Consumer has a right to the following:

• Confirm whether a Controller is Processing the Consumer’s Personal Data;
• Access the Consumer’s Personal Data;
• Correct inaccuracies in the Personal Data, considering the nature of the Personal Data and Processing Purposes;
• Require a Controller to delete Personal Data provided by, or obtained about, the Consumer (unless the retention of the Personal Data is required by law);
• Obtain a copy of the Consumer’s Personal Data Processed by the Controller, if the Processing is done by automatic means, in a portable and, to the extent technically feasible, readily usable format that allows the Consumer to transmit the data to another Controller without hindrance;
• Obtain a list of categories of third parties to which the Controller has disclosed the Consumer’s Personal Data or a list of categories of third parties to which the Controller has disclosed any Consumer’s Personal Data, if the Controller does not maintain the information in a format specific to the Consumer; and
• Opt out of the Processing of Personal Data for the purpose of Targeted Advertising, Sale of Personal Data, or Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the Consumer.
• Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the Consumer, opt out and also question the result of the Profiling, be informed of the reason the Profiling resulted in the decision, review the Consumer’s Personal Data used in the Profiling, and, if the decision was based on inaccurate Personal Data, correct the data and request reevaluation.
• A Consumer may designate an authorized agent to opt out of Processing for Targeted Advertising, Sale of Personal Data, or Profiling. The designation may be made through an internet link, browser setting, browser extension, global device setting, or similar technology indicating the Consumer’s intent to opt out.
• A Controller must comply with an opt-out request received from an authorized agent if, using commercially reasonable efforts, the Controller can authenticate the Consumer’s identity and the authorized agent’s authority to act on the Consumer’s behalf.

More Details

Definitions:

• Biometric Data: Data generated by automatic measurements of biological characteristics of a Consumer that can be used to uniquely authenticate a Consumer’s identity. Biometric Data includes a fingerprint, voice print, eye retina or iris image, and any other unique biological characteristics that can be used to uniquely authenticate a Consumer’s identity. Biometric Data does not include a digital or physical photograph, an audio or video recording, or any data generated from a digital or physical photograph or audio or video recording, unless the data is generated to identify a specific Consumer.
• Child: Has the meaning as stated in COPPA.
• Consumer: An individual who is a resident of Maryland. Consumer does not include an individual acting in a commercial or employment context, or an individual acting as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency (whose communications or transactions with the Controller occur solely within the context of the individual's role with the company, partnership, sole proprietorship, nonprofit or government unit).
• Consumer Health Data: Personal Data that a Controller uses to identify a Consumer’s physical or mental health status. Consumer Health Data includes data related to gender-affirming treatment or reproductive or sexual health care.
• Controller: A person that, alone or jointly with others, determines the purpose and means of Processing Personal Data.
• Decision that Produces a Legal or Similarly Significant Effect Concerning the Consumer: A decision made by a Controller that results in the provision or denial of financial or lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, or health care services.
• Personal Data: Any information that is linked or can be reasonably linked to an identified or identifiable Consumer. Personal Data does not include de-identified data or publicly available information.
• Precise Geolocation Data: Information derived from technology that can precisely and accurately identify the specific location of a Consumer within a radius of 1,750 feet. Precise geolocation does not include the content of communications or data generated by or connected to an advanced utility metering infrastructure system or equipment for use by a utility.
• Process: An operation or set of operations performed by manual or automated means on Personal Data. Process includes collecting, using, storing, disclosing, analyzing, deleting, or modifying Personal Data.
• Processor: A person that Processes Personal Data on behalf of a Controller.
• Profiling: Any form of automated Processing performed on Personal Data to evaluate, analyze, or predict personal aspects related to an identified or identifiable Consumer’s economic situation, health, demographic characteristics, personal preferences, interests, reliability, behavior, location, or movements.
• Publicly Available Information: Information that a person lawfully obtains from a governmental entity record, reasonably believes a Consumer or widely distributed media have lawfully made available to the general public, or obtains from a person to whom the Consumer disclosed the information if the Consumer has not restricted the information to a specific audience. Publicly available information does not include Biometric Data collected by a business about a Consumer without the Consumer’s knowledge.
• Sale of Personal Data: The exchange of Personal Data by a Controller, a Processor, or an affiliate of a Controller or Processor to a third party for monetary or other valuable consideration. Sale of Personal Data does not include: disclosure of Personal Data to a Processor that Processes Personal Data on behalf of a Controller if limited to the purposes of the Processing; disclosure of Personal Data to a third party for purposes of providing a product or service affirmatively requested by the Consumer; disclosure or transfer of Personal Data to an affiliate of the Controller; disclosure of Personal Data where the Consumer directs the Controller to disclose the Personal Data or intentionally uses the Controller to interact with a third party; disclosure of Personal data that the Consumer intentionally made available to the general public through a channel of mass media and did not restrict to a specific audience; or disclosure or transfer of Personal Data to a third party as an asset that is part of an actual or proposed merger, acquisition, bankruptcy, or other transaction where the third party assumes control of all or part of the Controller’s assets.
• Sensitive Data:​ Personal Data that includes data revealing racial or ethnic origin, religious beliefs, Consumer health data, sex life, sexual orientation, status as a transgender or nonbinary, national origin, citizenship or immigration status, genetic data or Biometric Data, Personal Data of a Consumer that the Controller knows or has reason to know is a child, or precise geolocation data.
• Targeted Advertising: Displaying advertisements to a Consumer or on a device identified by a unique identifier, where the advertisement is selected based on Personal Data obtained or inferred from the Consumer’s activities over time and across nonaffiliated websites or online applications that are unaffiliated with each other, to predict the Consumer’s preferences or interests. Targeted Advertising does not include advertisements based on the context of a Consumer’s current search query, visit to a website, or online application; advertisements based on a Consumer’s activities within a Controller’s websites or online applications; advertisements directed to a Consumer in response to the Consumer’s request for information or feedback; or Processing Personal Data solely to measure or report advertising frequency, performance, or reach.
• Third Party: An individual or legal entity other than the Consumer, Controller, Processor, or affiliate of the Controller or Processor.

Penalties:

The Maryland Attorney General (Consumer Protection Division) may issue to a Controller or Processor a notice of violation, prior to initiating an enforcement action, after which the Controller or Processor has 60 days to “cure” the alleged violation. If not cured, the Maryland Attorney General may bring an enforcement action, seeking various forms of relief, including injunctive relief, civil penalties, and attorney's fees. A court may impose civil penalties of up to $10,000 for each violation and $25,000 per violation for repeated violations.

Note: Regarding Personal Data Processing, the MDOPA does not apply to Personal Data Processing activities until April 1, 2026.

Private Action:

No

Enforcement Action:

For alleged violations occurring on or before April 1, 2027, the Consumer Protection Division may issue a notice of violation before initiating an enforcement action if the Division determines that a cure is possible. If the Division issues a notice, the Controller or Processor must be given at least 60 days to cure the violation after receipt of the notice.

Associated Regulations & Rulemaking: 

• Senate Bill 541
• House Bill 567

Notes on AI Related Regulations:

The MODPA is not a standalone AI law, but it regulates AI-adjacent processing through consumer opt-out rights for Profiling in furtherance of decisions that produce legal or similarly significant effects, additional rights to question certain Profiling decisions and request reevaluation, restrictions on Processing Sensitive Data, and data protection assessment requirements for high-risk Processing, including certain Profiling activities.

Effective Date:

October 1, 2025

April 1, 2026 (for Personal Data Processing)