The Maryland rule in full 45 days
Md. Code Ann., Com. Law §§ 14-3501 to 14-3508
- Notify residents
- As soon as reasonably practicable, but no later than 45 days after the business discovers or is notified of the breach.
- Notify the state
- Notify the Office of the Attorney General before notifying individuals, including the number of affected Maryland residents. No minimum number of residents applies.
- Credit bureaus
- 1,000 or more residents notified.
- No-harm exception
- No notice is needed if a good faith, reasonable and prompt investigation leads the business to reasonably determine the breach does not create a likelihood that personal information has been or will be misused. It must keep records of that determination for 3 years.
- Encryption
- Data elements are covered only when not encrypted, redacted, or otherwise protected by a method that makes them unreadable or unusable. The statute does not address a stolen encryption key.
- Data covered beyond the basic set
- Taxpayer ID, passport number, other federal government ID number, medical information, health insurance information, biometric data, genetic data, online account credentials.
- Enforcement
- A violation is an unfair or deceptive trade practice under the Maryland Consumer Protection Act, with civil penalties up to $10,000 per violation and $25,000 per repeat violation.
- Also know
- A vendor that only maintains the data must notify the owner no later than 10 days after discovering the breach. Online account credentials means a user name or email address with a password or security question that permits access to an email account. Individuals can sue through the Consumer Protection Act (Com. Law § 13-408), which § 14-3508 makes applicable. The law also requires reasonable security procedures.
Law: Md. Code Ann., Com. Law §§ 14-3501 to 14-3508 | Com. Law § 14-3506 | Com. Law § 14-3501 (definitions). Read from the statute and checked by a second reviewer on October 13, 2026. Compare all states.
Neighboring states: Pennsylvania, Delaware, Virginia, West Virginia, District of Columbia. A breach that reaches their residents brings in their rules too.
Dealing with a breach right now? Two short steps. A security provider follows up by email within one business day.
Get a quote for my businessThe Maryland data breach notification law puts the Attorney General first
Under the Personal Information Protection Act (Commercial Law §§ 14-3501 to 14-3508), residents must hear within 45 days 1. Day one is the day of discovery or outside notice, and the governing words are "as soon as reasonably practicable," which makes day 45 the latest acceptable date, not the plan.
The sequence is fixed: the Office of the Attorney General first, with a count of affected Maryland residents, then the residents 1. Size does not matter, so one Marylander's record and ten thousand trigger the same filing. Draft the AG notice in week one so it never becomes the bottleneck as day 45 approaches.
Maryland's long list of covered data
Maryland protects much more than the name-plus-SSN, license or account-and-code combinations found everywhere 3:
- Individual Taxpayer Identification Numbers, passport numbers and other federal government ID numbers
- Medical information and health insurance information
- Biometric data and genetic data
- A user name or email address with a password or security question and answer that permits access to an email account
That last entry reaches every office running Microsoft 365 or Google Workspace: a phished email login is reportable by itself, whatever is or is not in the mailbox.
Encrypted, redacted or otherwise unreadable or unusable data is outside the law 3. A stolen key is not addressed, so get counsel's view before relying on encryption if the attacker had both.
Want a second opinion on your setup? Send a short request and one provider follows up by email within one business day. How it works.
Get a quote for my businessWhen a Maryland business may decide not to notify
A good faith, reasonable and prompt investigation that leads the business to reasonably conclude there is no likelihood of misuse removes the duty to notify 1. Maryland requires keeping the records of that decision for 3 years.
Base the decision on forensic evidence, not on a first-hour guess. When the investigation cannot rule misuse out, notify.
A company that only maintains data for a client, such as a hosted software vendor, must tell that client within 10 days of discovering a breach 1. Your managed IT and software contracts should say the same.
Penalties and the right to sue in Maryland
Breaking the breach law counts as an unfair or deceptive trade practice under the Maryland Consumer Protection Act 4, with civil penalties of up to $10,000 per violation and $25,000 per repeat violation. Older charts show smaller figures; go by the current statute.
People can sue as well, because the breach law borrows the Consumer Protection Act's enforcement provisions, private damages action included 4. A late or missing letter can bring claims from customers as well as the state.
Two more duties apply. Any business holding Marylanders' personal information must keep reasonable security procedures fitted to the data and its size 5. And the Maryland Online Data Privacy Act, in effect since October 1, 2025, applies to businesses that handle data of at least 35,000 Maryland consumers, or 10,000 while earning more than 20% of gross revenue from selling personal data, with no small-business exemption 6.
A first-week plan for Maryland businesses
While the attack is live, an insured company's sequence is carrier first, then an FBI complaint at ic3.gov, with every affected system left untouched until evidence is copied 789.
After that:
- Have a forensics and containment firm or the people who run your network end the intrusion.
- Work out what was taken and where each person lives. Virginia and the District of Columbia residents bring their own laws; the state-by-state chart has the others.
- File with the Attorney General, then mail residents, well before day 45.
- Clinics also answer to HIPAA's 60-calendar-day limit and its bar on unreasonable delay 10; Maryland's 45 days comes first. Our HIPAA notice summary covers the federal side.
- Measure your safeguards against the controls carriers ask about.
Local support costs are in our Baltimore managed IT guide. IC3 received 19,430 complaints from Marylanders in 2025 11.
The Commercial Law article was last set against this page on October 13, 2026. For legal advice fitted to your breach, a Maryland lawyer is the right call.
Common questions
What is the outer deadline under the Maryland data breach notification law?
Forty-five days from discovery or outside notice at most, and as soon as reasonably practicable 1. The Attorney General hears first.
When does the Maryland Attorney General need to hear about a breach?
Ahead of the residents, every time resident letters are required, with the count of affected Marylanders 1. One person is enough.
When do you notify the credit bureaus after a Maryland breach?
At 1,000 or more individuals notified, each agency must be told without unreasonable delay 2.
Is an email password a breach of personal information in Maryland?
Yes. A login (user name or email address plus password or security answer) that opens an email account is covered on its own 3.
Can individuals sue under Maryland's breach notification law?
Yes, through the Consumer Protection Act's private damages action, which the breach law adopts 4. The state's civil penalties reach $10,000 per violation and $25,000 per repeat.
What if the stolen Maryland data was encrypted?
It falls outside the law if it stayed unreadable or unusable 3. The statute is silent on a stolen key.
Sources
- Maryland General Assembly, Com. Law § 14-3504, 2026.
- Maryland General Assembly, Com. Law § 14-3506, 2026.
- Maryland General Assembly, Com. Law § 14-3501 (definitions), 2026.
- Maryland General Assembly, Com. Law §§ 14-3508, 13-408, 13-410, 2026.
- Justia, 2025 Maryland Code, Commercial Law § 14-3503, 2025.
- Maryland Office of the Attorney General, Data Privacy in Maryland, 2026.
- Federal Trade Commission, Cyber Insurance, 2021-11-09.
- FBI, Ransomware, 2026-04-08.
- Federal Trade Commission, Data Breach Response: A Guide for Business, 2025-06-20.
- eCFR, 45 CFR Part 164, Subpart D: Notification in the Case of Breach of Unsecured Protected Health Information, 2026-10-08.
- FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report (States by Complaint Count, p.28; States by Complaint Loss, p.29), 2026-04.
Updated October 13, 2026.