1. Home
  2. State breach laws
  3. Maryland

Maryland data breach notification law

What Maryland requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Md. Code Ann., Com. Law §§ 14-3501 to 14-3508 (Maryland Personal Information Protection Act).

45 days
Notification deadline
Required
AG notification
Limited
Private right of action
None
Liability protection

What this means if you sell security services

Maryland's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. Private-action exposure is limited, so the pressure is mostly regulatory and the pitch is about penalties, remediation, and not being on the list twice.

See recent Maryland breach filings →

Requirements in detail

Statute
Md. Code Ann., Com. Law §§ 14-3501 to 14-3508 (Maryland Personal Information Protection Act)
Deadline to notify residents
As soon as reasonably practicable, but no later than 45 days after the business discovers or is notified of the breach. If law enforcement delays notice, it is due by the end of the original 45-day period or within seven days after law enforcement lifts the delay, whichever is later.
Attorney General notification
Yes, for every breach that requires notice to individuals, and before individuals are notified. The notice must state the number of affected Maryland residents, describe the breach and the steps taken, and include a sample of the individual notice. Consumer reporting agencies must be notified when 1,000 or more people are notified.
Penalties
A violation is an unfair or deceptive trade practice under the Maryland Consumer Protection Act. It can bring civil penalties of up to $10,000 per violation and up to $25,000 for each repeat violation, enforced by the Attorney General's Consumer Protection Division.
Private right of action
Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.
Encryption exemption
Maryland's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Maryland has no law limiting breach lawsuits for organizations that maintain a security program.

Maryland breach notification FAQ

What is the data breach notification deadline in Maryland?

As soon as reasonably practicable, but no later than 45 days after the business discovers or is notified of the breach. If law enforcement delays notice, it is due by the end of the original 45-day period or within seven days after law enforcement lifts the delay, whichever is later. The governing law is Md. Code Ann., Com. Law §§ 14-3501 to 14-3508 (Maryland Personal Information Protection Act).

Does Maryland require notifying the Attorney General of a data breach?

Yes, for every breach that requires notice to individuals, and before individuals are notified. The notice must state the number of affected Maryland residents, describe the breach and the steps taken, and include a sample of the individual notice. Consumer reporting agencies must be notified when 1,000 or more people are notified.

What are the penalties for failing to report a data breach in Maryland?

A violation is an unfair or deceptive trade practice under the Maryland Consumer Protection Act. It can bring civil penalties of up to $10,000 per violation and up to $25,000 for each repeat violation, enforced by the Attorney General's Consumer Protection Division.

Can individuals sue over a data breach in Maryland?

Limited. The breach notification law allows private lawsuits only in narrow circumstances. People can still bring other claims, such as negligence.

Does encrypted data need to be reported in Maryland?

Maryland's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Maryland limit breach lawsuits for companies with a cybersecurity program?

No. Maryland has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Maryland Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →