Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Maryland |
|---|---|
| Statute citation | Md. Code Ann., Com. Law §§ 14-3501 to 14-3508 (Personal Information Protection) (amended |
| Individual notice timing | not later than 45 days after discovering or being notified of a breach. 33 |
| Attorney general notice | Yes Maryland requires AG notification prior to notifying affected individuals, with no threshold, all |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Maryland 'breach of the security of a system' means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the personal information maintained by a business, excluding good faith acquisitions by employees or agents for business purposes where the information is not further used or disclosed.1 |