Maryland Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Maryland's Personal Information Protection Act requires businesses to notify affected residents of a data breach within 45 days of discovery, under Md. Code Com. Law 14-3504. Before sending individual notices, businesses must first notify the Maryland Attorney General, making Maryland one of the few states to require AG notification ahead of consumer outreach.

Maryland takes data breach notification seriously. Under the Maryland Personal Information Protection Act (MPIPA), businesses that experience a security breach must act fast, notifying both the Attorney General and affected individuals within a tight 45-day window. This is one of the shorter deadlines among U.S. states, and the requirement to notify the AG first adds an extra layer of accountability.

The law, codified at Md. Code, Com. Law § 14-3504, applies to any business that owns, licenses, or maintains computerized data containing personal information of Maryland residents. A separate statute, Md. Code, State Govt. § 10-1305, imposes parallel obligations on state and local government agencies.

This guide breaks down who must comply, what triggers the notification obligation, the AG-first reporting process, enforcement mechanisms, and how the new Maryland Online Data Privacy Act (MODPA) adds to the picture.

What Qualifies as a Breach of Security

Under § 14-3504(a)(1), a "breach of the security of a system" means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a business.

The definition focuses on actual acquisition, not mere access. If someone accesses a system without authorization but does not acquire personal information, the notification requirement may not apply.

Maryland includes a good faith exception at § 14-3504(a)(2). An employee or agent who acquires personal information in the normal course of business does not trigger breach notification, as long as the information is not used for an unauthorized purpose or disclosed further.

The Encryption Safe Harbor

Maryland provides a clear safe harbor for encrypted data. If the compromised personal information was encrypted, redacted, or otherwise rendered unreadable or unusable, the notification obligation does not apply, regardless of whether an encryption key was later compromised.

A compromised-encryption-key carve-back does exist in Maryland law, but only for state and local government agencies under a separate statute, Md. Code, State Govt. § 10-1305: a government unit is not required to notify unless it knows the encryption key has been broken. That carve-back does not apply to businesses under § 14-3504. Businesses should still document their encryption practices to demonstrate that the safe harbor applies.

Personal Information That Triggers Notification

Maryland has one of the broader definitions of protected personal information among state breach notification laws. Under § 14-3501(e), personal information means an individual's first name or first initial and last name combined with any one or more of the following data elements (when not encrypted, redacted, or otherwise protected):

• Social Security number, individual taxpayer identification number (ITIN), or passport number, or other federal government-issued identification number
• Driver's license number or Maryland state identification card number
• Financial account number, credit card number, or debit card number, combined with any required security code, access code, or password that permits access to the account
• Health information, including information about mental or physical health conditions, medical history, or treatment by a healthcare professional
• Health insurance policy number, subscriber identification number, or other unique identifier used by a health insurer, combined with a unique identifier used by the insurer or employer
• Biometric data, including fingerprints, voice prints, genetic prints, retinal or iris images, and other unique biological characteristics used for authentication
• Genetic information, including data from DNA analysis, chromosomes, alleles, genomes, and genetic sequence polymorphisms
• Username or email address combined with a password or security question and answer that would permit access to an online account

This list is notably comprehensive. Maryland was among the early states to include biometric data, genetic information, and health insurance identifiers as protected categories.

What Does Not Count as Personal Information

Publicly available information lawfully obtained from federal, state, or local government records is excluded from the definition. Also excluded is information an individual has consented to have publicly disseminated or listed, and information disseminated or listed in accordance with the federal Health Insurance Portability and Accountability Act (HIPAA).

The 45-Day Notification Deadline

Maryland imposes a firm 45-day deadline for notifying affected individuals. Under § 14-3504, businesses must provide notice no later than 45 days after discovering or being notified of the breach.

The clock starts at discovery, not at the conclusion of an investigation. This is a meaningful distinction. Some states start the clock only after the business has confirmed the breach through investigation. Maryland's approach puts more pressure on businesses to move quickly.

Investigation Requirement

Before sending notifications, a business must conduct a good-faith, reasonable, and prompt investigation to determine whether personal information has been or will be misused as a result of the breach. If the investigation determines that misuse of personal information has not occurred and is not reasonably likely to occur, notification may not be required.

However, the business must document that determination and maintain records for three years. This documentation requirement gives the Attorney General a basis for reviewing whether the decision not to notify was justified.

Law Enforcement Delay

Notification may be delayed if a law enforcement agency determines that it would impede a criminal investigation or jeopardize homeland or national security. Once law enforcement clears the delay, § 14-3504(d)(2)(i) sets the deadline by where the 45-day clock stands: if the original 45-day period has already elapsed, the business has 7 days from the clearance determination; if it has not, notice is still due by the end of that original 45-day period. The delay does not extend the deadline past 45 days by default.

The separate notice a third-party data handler owes the data owner under subsection (c) works differently: there the deadline is always 7 days after law enforcement clears the delay.

Attorney General Notification: The AG-First Rule

Maryland stands out among state breach notification laws for its AG-first notification requirement. Under § 14-3504, businesses must notify the Office of the Attorney General before sending notifications to affected individuals.

The AG notification must include:

• The number of Maryland residents affected by the breach
• A description of the breach, including when and how it occurred
• The steps the business has taken or plans to take in response to the breach
• The timeline for when individual notifications will be sent
• A sample copy of the notice that will go to affected individuals

This AG-first approach gives the Attorney General's office an opportunity to review the breach and the planned notification before consumers receive it. It also allows the AG to coordinate with the business if the notification is inadequate or if the breach raises broader consumer protection concerns.

Breach notifications should be directed to the Identity Theft Unit of the Consumer Protection Division at 200 St. Paul Place, Baltimore, MD 21202, or by email to idtheft@oag.state.md.us.

Methods of Individual Notification

Maryland permits several methods for notifying affected individuals:

• Written notice mailed to the most recent address on file
• Email notice, if the individual has previously consented to electronic communications or if the business conducts its business primarily through online transactions
• Telephonic notice to the most recent phone number on file
• Substitute notice, available when specific conditions are met

Substitute Notice

A business may use substitute notice only if it does not have sufficient contact information to provide direct notice. Unlike the parallel rule for government agencies, Maryland's business substitute-notice provision does not include a cost or affected-individual-count threshold.

Substitute notice requires all three of the following: sending email to affected individuals whose addresses are available, posting a conspicuous notice on the company's website, and notifying major print or broadcast media outlets in the geographic areas where the affected individuals likely reside.

Required Content of Individual Notices

Individual breach notifications must include:

• A description of the categories of personal information compromised
• Contact information for the business
• Contact information for consumer reporting agencies
• Contact details for the Federal Trade Commission and the Maryland Attorney General, along with information about identity theft prevention

Special Rule for Email-Only Breaches

When a breach involves only access to an email account without other personal information, the business may provide a simplified notification directing the affected individual to change their password and security questions.

Third-Party Data Handlers

Businesses that maintain personal information on behalf of another entity (such as cloud providers, payment processors, or IT vendors) have separate obligations. A third-party data handler must notify the data owner within 10 days of discovering a breach.

The third-party handler cannot charge the data owner any fees for providing information about the breach. This provision prevents vendors from monetizing breach information at the expense of timely notification.

Government Agency Obligations

State and local government agencies in Maryland are subject to parallel breach notification requirements under Md. Code, State Govt. § 10-1305. The obligations are similar to those for private businesses, with a few differences.

Government agencies must notify affected individuals "as soon as reasonably practicable" after investigation. They must also notify the Attorney General before individual notification. Certain state agencies are additionally required to notify the Department of Information Technology.

The substitute notice thresholds differ for government agencies: the cost threshold is $100,000 and the affected individuals threshold is 175,000.

Enforcement and Penalties

AG Enforcement Through Consumer Protection Act

Under § 14-3508, violations of Maryland's breach notification law constitute unfair or deceptive trade practices under Title 13 of the Commercial Law article, which is Maryland's Consumer Protection Act.

This means the Attorney General's Consumer Protection Division has full enforcement authority, including the power to:

• Bring civil actions against violating businesses
• Issue cease and desist orders
• Seek restitution for affected consumers
• Impose civil penalties

Penalty Amounts

Under § 13-410, a business that violates the law faces fines of up to $10,000 per violation. A business that repeats the same violation after a prior finding faces fines of up to $25,000 per repeat violation.

When calculating penalties, the Consumer Protection Division considers the severity of the violation, the business's good faith efforts, its prior violation history, and the deterrent effect of the penalty amount.

Private Right of Action Through the Consumer Protection Act

§ 14-3504 does not itself create a standalone private right of action, and day-to-day enforcement of the breach notification requirements falls primarily to the Attorney General. But § 14-3508 makes a violation of the breach notification law an unfair or deceptive trade practice under Title 13 of the Commercial Law article, Maryland's Consumer Protection Act. Title 13's own private-action provision, § 13-408, lets any person who suffers injury or loss from a practice prohibited by Title 13 bring a civil action, and a prevailing plaintiff may recover reasonable attorney's fees.

Because a breach notification violation is deemed a Title 13 violation, Maryland residents harmed by noncompliance may have a private right of action through this Consumer Protection Act route, not only the Attorney General's enforcement power. Individuals may also still pursue claims under common law theories such as negligence, breach of contract, or other applicable statutes.

How MODPA Affects Data Breach Obligations

The Maryland Online Data Privacy Act (MODPA), which took effect on October 1, 2025, adds a comprehensive privacy framework that operates alongside the existing breach notification law. While MODPA does not replace or directly amend § 14-3504, it has significant implications for breach prevention and response.

Data Minimization Reduces Breach Risk

MODPA requires businesses to limit personal data collection to what is "reasonably necessary and proportionate" to provide a specific product or service requested by the consumer. This strict data minimization standard means businesses should be holding less personal data overall, which reduces both the likelihood and the potential impact of a data breach.

Sensitive Data Protections

MODPA defines sensitive data at § 14-4701(gg) to include genetic and biometric data, consumer health data, precise geolocation data, data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as transgender or nonbinary, national origin, or citizenship or immigration status, and the personal data of a consumer the controller knows or has reason to know is a child. "Child" carries its COPPA meaning here, which is a person under 13, not under 18.

Maryland deliberately did not adopt the consent standard other state privacy laws use for sensitive data. Under § 14-4707(a)(1), a controller may not collect, process, or share sensitive data at all except where the collection or processing is strictly necessary to provide or maintain a specific product or service the consumer requested. A consumer cannot consent past that limit. Section 14-4707(a)(2) separately prohibits selling sensitive data outright.

Consumers under 18 are covered by a different pair of rules rather than the sensitive-data definition: § 14-4707(a)(4) and (a)(5) bar targeted advertising to, and the sale of the personal data of, a consumer the controller knew or should have known is under 18.

A breach involving sensitive data could trigger enforcement under both MODPA and the breach notification statute.

Additional Enforcement Layer

MODPA violations are also classified as unfair or deceptive trade practices, giving the Attorney General parallel enforcement authority. Before bringing an action, the AG may issue a notice of violation and provide at least 60 days for the business to cure the violation if a cure is possible. This 60-day cure period does not apply to the separate breach notification obligations under § 14-3504.

Data Protection Assessments

MODPA requires businesses to conduct data protection assessments for high-risk processing activities. If a business fails to conduct required assessments and then suffers a breach, that failure could strengthen the AG's enforcement case under both MODPA and the breach notification law.

How Maryland Compares

Maryland's 45-day notification deadline is among the shorter windows nationally. Florida requires notification within 30 days, while many states use a vaguer "most expedient time possible" standard without a fixed deadline. Maryland's AG-first notification requirement is also distinctive. Most states require AG notification at the same time as individual notification, or only above certain thresholds. Maryland's approach of requiring AG notice before individual notice gives the state more oversight of the process.

The breadth of Maryland's personal information definition, covering eight categories including biometric and genetic data, places it in the upper tier of state protections.

For a broader view of Maryland's data privacy landscape, including the MODPA framework, see our Maryland Data Privacy Laws overview.

This article provides general legal information about Maryland data breach notification requirements. It is not legal advice, and it does not create an attorney-client relationship. Data breach response involves time-sensitive obligations. Consult a qualified attorney licensed in Maryland for guidance specific to your situation.

More Maryland Laws

• Maryland Deepfake Laws
• Maryland Employee Monitoring Laws
• Maryland GPS Tracking Laws
• Maryland Recording Laws

Frequently Asked Questions

How quickly must a business notify Maryland residents of a data breach?

Maryland law requires notification within 45 days after the business discovers or is notified of the breach. This is one of the shorter fixed deadlines among U.S. states. The timeline may be extended if law enforcement determines that notification would impede a criminal investigation or jeopardize homeland or national security. Once law enforcement clears the delay, notice is due by the end of the original 45-day period, or within 7 days of the clearance determination if that 45-day period has already elapsed.

Does Maryland require notification to the Attorney General before notifying individuals?

Yes. Maryland is one of the few states that requires businesses to notify the Attorney General before sending individual notifications. The AG notice must include the number of affected Maryland residents, a description of the breach, steps taken in response, the notification timeline, and a sample of the notice to be sent to individuals.

Is encrypted data exempt from Maryland's breach notification law?

Encrypted data qualifies for a safe harbor under Maryland law. If personal information was encrypted, redacted, or otherwise rendered unreadable, notification is not required for businesses under § 14-3504, regardless of whether an encryption key was later compromised. A separate rule for state and local government agencies under § 10-1305 does remove the safe harbor if the government unit knows the encryption key was broken.

Can individuals sue for a breach notification violation in Maryland?

Not directly under § 14-3504 itself, but § 14-3508 deems a breach notification violation an unfair or deceptive trade practice under Maryland's Consumer Protection Act (Title 13), and Title 13's § 13-408 lets any person injured by such a violation bring a civil action and recover attorney's fees. So affected individuals may have a private right of action through that route, in addition to the Attorney General's enforcement authority. Individuals may also still pursue claims under common law theories such as negligence, breach of contract, or other applicable statutes.

How does MODPA affect data breach obligations in Maryland?

The Maryland Online Data Privacy Act (MODPA), effective October 1, 2025, adds a comprehensive privacy framework on top of the existing breach notification law. MODPA requires strict data minimization, bars collecting or processing sensitive data except where strictly necessary to provide or maintain a specific product or service the consumer requested, and requires data protection assessments. While it does not directly amend the breach notification statute, a breach involving MODPA-regulated data could trigger enforcement under both laws, with penalties up to $10,000 per violation under each.