What Is Maryland’s Personal Information Protection Act?

Maryland’s Personal Information Protection Act, codified at Commercial Law Article Title 14, Subtitle 35, requires any business that handles the personal information of Maryland residents to keep that data reasonably secure, dispose of it safely, and notify both the Attorney General and the affected individuals when a breach occurs. Violations are treated as unfair or deceptive trade practices under Maryland’s Consumer Protection Act, which carries civil penalties up to $10,000 per incident and up to $25,000 for repeat offenses.

What Data the Law Covers

PIPA only applies when the data at stake meets its definition of “personal information.” That definition has two tracks.

The main track is a Maryland resident’s first name or first initial and last name combined with at least one unencrypted data element from the following list:

Social Security number, Individual Taxpayer Identification Number, passport number, or other federal identification number
Driver’s license number or state identification card number
A financial account, credit card, or debit card number combined with any security code, access code, or password that would permit access to the account
Information about an individual’s medical history, condition, treatment, or diagnosis, including mental health
A health insurance policy or subscriber identification number combined with a unique identifier that permits access to the individual’s health information
Biometric data such as fingerprints, voice prints, retina or iris images, genetic prints, or other unique biological characteristics used to authenticate identity
Genetic information drawn from biological sample analysis, including DNA, RNA, and chromosomal material

The second track doesn’t require a name at all. A username or email address combined with a password or security question and answer that permits access to the individual’s email account is itself personal information under PIPA.¹

One qualifier runs through both tracks: data that is encrypted, redacted, or otherwise rendered unreadable or unusable is not personal information under the statute. A breach involving only properly encrypted records does not trigger PIPA’s notification obligations, which is a strong practical reason to encrypt sensitive data at rest and in transit.

Who Has to Comply

The law applies to any “business,” defined broadly to cover sole proprietorships, partnerships, corporations, associations, and any other business entity, whether for profit or not. Financial institutions organized or chartered under Maryland, federal, or foreign law are specifically included, along with their parent companies and subsidiaries.¹

There is no size threshold. A one-person consulting firm with a spreadsheet of client Social Security numbers carries the same baseline obligations as a Fortune 500 company. What scales is the standard itself: security must be “appropriate to the nature of the personal information” and “the nature and size of the business and its operations.” A small operation isn’t expected to run enterprise infrastructure, but it does need something proportionate.

Format doesn’t matter either. A filing cabinet of paper applications containing Social Security numbers is covered the same way a database server is.

Security Obligations

Every business that owns, maintains, or licenses personal information of Maryland residents must implement and maintain reasonable security procedures and practices. The statute deliberately avoids prescribing specific technologies, setting a flexible standard tied to the sensitivity of the data and the size of the operation.²

In practice, “reasonable” tends to track what peers in the same industry treat as standard. If comparable companies use multi-factor authentication, encrypted storage, and access controls, a business relying on a single shared password will have a hard time arguing its security was reasonable after an incident.

Vendor and Service Provider Contracts

When a business shares personal information with a nonaffiliated third-party service provider, PIPA requires a written contract obligating that provider to implement and maintain reasonable security procedures appropriate to the data being shared. The requirement has applied to any contract entered into on or after January 1, 2009.²

This catches a common blind spot. Many businesses secure their own systems carefully and then hand off customer data to a payroll vendor, cloud provider, or marketing platform without any contractual security obligation. If your vendor agreement doesn’t include data security requirements, that’s a compliance gap you own.

Secure Disposal

When destroying records that contain personal information, a business must take reasonable steps to protect against unauthorized access. The obligation applies regardless of format: shredding paper, securely wiping hard drives, and degaussing magnetic media all fall within what the law expects.³

What to Do After a Breach

The notification rules are where PIPA gets prescriptive. Timing and content both matter.

Investigate First

When a business discovers or is notified of a breach, it must investigate. If the business reasonably determines that the breach has not created a likelihood that personal information has been or will be misused, notification is not required. That determination has to be genuinely reasonable. If there is any real possibility of harm, the notification clock starts.⁴

Notify the Attorney General Before Anyone Else

Before sending any notice to consumers, a business must notify the Maryland Office of the Attorney General. The AG notification must include, at minimum:

The number of Maryland residents affected
A description of what happened, including when and how
The actions the business has taken or plans to take in response
The form of notice that will go to affected individuals, along with a sample copy

This step is easy to skip in the scramble of an active breach. Sending consumer notices before the AG is notified puts you out of compliance from the first communication.⁴

Notify Affected Individuals Within 45 Days

Notice to affected individuals must go out as soon as reasonably practicable and no later than 45 days after the business discovers or is notified of the breach. The notice must include:

A description of the categories of information that were, or are reasonably believed to have been, acquired by an unauthorized person
Contact information for the business, including address, telephone number, and toll-free number if one is maintained
Toll-free telephone numbers and addresses for the major consumer reporting agencies

Delivery can be by written notice, telephone, or electronic notice depending on the circumstances, with substitute notice allowed when the business lacks sufficient contact information to reach affected individuals through those methods.⁴

Notify the Credit Bureaus If More Than 1,000 Are Affected

A breach affecting more than 1,000 individuals triggers an additional obligation to notify the consumer reporting agencies. That notice helps the bureaus flag potentially affected accounts for broader fraud prevention.⁴

When PIPA Doesn’t Apply

Some businesses are deemed in compliance with PIPA when they follow federal data protection and notification rules imposed by their primary regulator. The two most common examples:

Financial institutions subject to the Gramm-Leach-Bliley Act satisfy PIPA when they comply with GLBA’s Safeguards Rule and breach notification requirements.
Entities covered by HIPAA satisfy PIPA for protected health information when they follow HIPAA’s own breach notification rule.

The compliance-through-federal-regulation approach is broader than just GLBA and HIPAA. If a business’s primary regulator has adopted data protection rules and the business follows them, that compliance counts under PIPA.³

Encrypted data sits in a related but distinct category. It’s not an exemption so much as a definitional exclusion: if the compromised data was properly encrypted at the time of the breach, PIPA’s notification and security rules simply don’t apply to that data.¹

Penalties and Enforcement

PIPA doesn’t create its own penalty structure. A violation is treated as an unfair or deceptive trade practice under Title 13 of the Commercial Law Article, Maryland’s Consumer Protection Act.⁵

Under the Consumer Protection Act, a business can face civil penalties of up to $10,000 for each violation. A business previously found to have violated the Act and committing the same violation again faces up to $25,000 for each subsequent offense. The penalties are civil and recoverable by the State through a civil action or administrative proceeding.⁶

The Attorney General leads enforcement, with access to the full Consumer Protection Act toolkit: investigations, subpoenas, cease and desist orders, and civil actions seeking injunctions, restitution, and penalties. Affected individuals can also pursue private claims under the Consumer Protection Act framework, which is how class actions following a Maryland data breach generally proceed.³

How PIPA Relates to the Maryland Online Data Privacy Act

Maryland enacted the Online Data Privacy Act (MODPA) in 2024, with provisions taking effect October 1, 2025, and certain sections applying from April 1, 2026. MODPA is a separate statute that creates broader privacy obligations for businesses that control or process consumer personal data, including data minimization, consumer rights to access and delete data, and data protection assessments.⁷

MODPA does not replace PIPA. The two laws operate together: PIPA continues to govern breach notification and baseline security, while MODPA layers on consumer privacy rights and controller obligations. MODPA’s enforcement also runs through the Consumer Protection Act. Businesses operating in Maryland now need to meet both sets of requirements, and a single data breach can trigger obligations under each.

1
Maryland General Assembly. Maryland Code Commercial Law 14-3501
2
Maryland General Assembly. Maryland Code Commercial Law 14-3503
3
Attorney General of Maryland. Guidelines for Businesses to Comply with the Maryland Personal Information Protection Act
4
Maryland General Assembly. Maryland Code Commercial Law 14-3504 – Breach of the Security of a System
5
Maryland General Assembly. Maryland Code Commercial Law 14-3508
6
Maryland General Assembly. Maryland Code Commercial Law 13-410
7
Maryland General Assembly. Senate Bill 541 – Maryland Online Data Privacy Act of 2024