Managed IT and Cybersecurity in Maryland

Md. Code, Com. Law § 14-3501 and following. Notice to affected people: within 45 days.

Maryland's Personal Information Protection Act starts at Commercial Law § 14-3501. Under § 14-3504, a business that discovers or is notified of a breach of a system holding personal information must notify affected Maryland residents no later than 45 days after it discovers or is notified of the breach. A delay is allowed in limited cases, such as a law enforcement request.

Before it notifies residents, the business must notify the Maryland Attorney General's office. That order matters: the regulator hears first.

Maryland also passed the Maryland Online Data Privacy Act of 2024, in effect since October 1, 2025. It applies to businesses that control or process the personal data of at least 35,000 Maryland consumers, or at least 10,000 consumers while earning over 20 percent of gross revenue from selling personal data. The Maryland Attorney General enforces it and there is no private right of action. The thresholds are low compared with other states, so a business with a busy consumer website should check where it stands.

This is a plain language summary for orientation, reviewed in October 2026. It is not legal advice. Ask counsel about your own facts.