Privacy Map

Maryland. Breach notification. Act

MD breach lawMaryland data breach notification law (Md. Code Com. Law § 14-3501 et seq. (Personal Information Protection Act))

In force
Partly verifiedMedium confidence. Penalty figures from the Maryland Consumer Protection Act general provision.

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Maryland residents to notify affected individuals after a security breach. Core timing rule: Individuals within 45 days of discovery. Covered data: name plus SSN/ITIN/passport, driver's licence, financial account with codes, health and mental health information, health insurance data, biometric and genetic data; email credentials.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

AG must be notified before consumers; vendors themselves bound to 45-day clock to the owner; private action via Consumer Protection Act.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Maryland requires the maintaining third party to notify the owner as soon as practicable and no later than 45 days after discovering the breach. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals within 45 days of discovery; AG before individual notice (any breach); CRAs if >=1,000
DPO
No
Cross-border transfers
None
Maximum penalty
Consumer Protection Act penalties up to $10,000 per violation ($25,000 repeat)

§3Dates

Key dates
  • Adopted
  • In force
  • HB 962 (2022, eff. 2022-10-01) set 45 days from discovery and added genetic data

§4Text and authority

Text
Authority
Maryland Attorney General (Identity Theft Unit)

§5Where it applies

Domestic law of
Maryland

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Penalty figures from the Maryland Consumer Protection Act general provision.