Maryland data breach notification law

Who must notify and when

not later than 45 days after discovering or being notified of a breach. 33

Attorney general notice

Yes Maryland requires AG notification prior to notifying affected individuals, with no threshold, all

What counts as a breach

In Maryland 'breach of the security of a system' means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the personal information maintained by a business, excluding good faith acquisitions by employees or agents for business purposes where the information is not further used or disclosed.1

What counts as personal information

In Maryland 'personal information' means an individual's first name or first initial and last name combined with unencrypted SSN, ITIN, passport number, federal ID, driver's license, state ID, financial account credentials, health information (including mental health), health insurance credentials, biometric data, or genetic information; additionally, username/email combined with password or security question that permits email access qualifies as personal information.2

Coverage and remedies

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Maryland

172 reports to HHS OCR affecting 19,570,764 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Maryland.

Frequently asked questions