Data Breach Notice to Residents and State Authorities in Maryland
At a glance
| Covered entity and service provider | Owner/licensee notifies residents; nonowner computerized-data holder notifies owner/licensee as soon as practicable, within 10 days (§ 14-3504(b)-(c)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized PI; name plus listed IDs, financial-access, health, insurance, biometric or genetic data, or email credentials (§§ 14-3501(e), 14-3504(a)) |
| Risk screen or notice exception | Prompt good-faith misuse investigation; no resident notice on reasonable no-likelihood finding; retain determination records 3 years (§ 14-3504(b)(1)-(4)) |
| Individuals who receive notice | MD resident whose PI was involved, unless reasonable investigation finds no likelihood of misuse (§ 14-3504(b)(1)-(2)) |
| Individual notice deadline and clock | As soon as reasonably practicable, no later than 45 days after business discovers or is notified of breach, subject to statutory delay (§ 14-3504(b)(3),(d)) |
| Regulator threshold and deadline | AG office before resident notice, with MD count, incident account, response steps, form and sample notice; no person threshold (§ 14-3504(h)) |
| Consumer-reporting-agency notice | At 1,000 or more individual notices: notify each nationwide consumer reporting agency without unreasonable delay of timing, distribution and content (§ 14-3506) |
| Individual delivery and content | Mail, qualifying email, or telephone; describe acquired data categories and provide business, credit-agency, FTC and AG contacts (§ 14-3504(e),(g)) |
| Substitute notice conditions and channels | Insufficient direct contact: email if available AND website posting if maintained AND major local print/broadcast media (§ 14-3504(e)(4),(f)) |
| Delays and alternate compliance | Law-enforcement or scope/identity/system-restoration delay; police clearance starts specified 7-day clocks; qualifying regulator, financial or HIPAA compliance routes (§§ 14-3504(d), 14-3507) |
Requirements one by one
Covered data and the investigation
Md. Code, Commercial Law § 14-3504(a) defines a breach by unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information. Good-faith employee or agent acquisition for business purposes is excluded if there is no further unauthorized use or disclosure. Section 14-3501(e) covers a name paired with specified identifiers, financial access data, health or insurance information, biometrics, or genetic information; email-account credentials also qualify on their own. Publicly available and certain consented or lawfully disseminated information is excluded.
Under § 14-3504(b)(1)-(4), a business must promptly investigate likely misuse. The owner or licensee may forgo individual notice if it reasonably determines there is no likelihood of misuse, but must retain records reflecting that decision for three years after making it.
Who gets notice and when
The owner or licensee gives affected Maryland residents notice as soon as reasonably practicable and generally within 45 days after the business discovers or is told of the breach. A business holding another's data must tell the owner or licensee as soon as practicable, generally within 10 days after discovery or notification; it shares relevant breach information and cannot charge for information the owner needs to notify residents. See § 14-3504(b)-(c).
Section 14-3504(h) requires notice to the Office of the Attorney General before resident notice, with the Maryland affected-person count, when and how the breach occurred, response steps, and the form and sample of the resident notice. The provision sets no separate population threshold. If the business must notify 1,000 or more individuals, § 14-3506 additionally requires notice without unreasonable delay to each nationwide consumer reporting agency about the timing, distribution, and content of the individual notices; recipients' names need not be included.
Delivery and contents
Section 14-3504(e) permits notice by mail to the latest recorded address, email with express consent or for a primarily internet-based business, or telephone to the latest recorded number. Subsection (g) requires, to the extent possible, the categories of acquired information, business contact details, major consumer reporting agency contacts, and FTC and Attorney General contacts with an identity-theft information statement.
When direct contact information is insufficient, § 14-3504(e)(4) and (f) require substitute notice through all applicable channels: email if available, a conspicuous website post if the business has a site, and major print or broadcast media in areas where affected people likely live.
What trips people up
The police delay has a short restart clock. Under § 14-3504(d), both owner-to-resident and holder-to-owner notice may be delayed if law enforcement finds notice would impede a criminal investigation or jeopardize security; scope, identification, and system restoration also permit delay. After police clearance, resident notice is due as soon as reasonably practicable and no later than seven days if the original 45 days have elapsed, or by the original deadline otherwise. A holder's notice is due within seven days of clearance.
Email-account-only breaches have a special message. Section 14-3504(i) permits a direction to change credentials or take other protective steps when only email-account credentials are involved. The business cannot send that message to the compromised account, except through the specified conspicuous online notice at a customary access location.
Some regulated businesses have an alternate route. Section 14-3507 deems compliance with qualifying primary-regulator notification procedures, specified financial-sector rules, or HIPAA compliance to satisfy this subtitle. Section 14-3504(j) makes a waiver of its requirements void.
Common questions
Does every breach require a resident letter?
No. Section 14-3504(b)(2)-(4) permits a documented no-notice decision after a reasonable finding that misuse is unlikely; the record must be kept for three years.
Does the Attorney General report wait until 1,000 residents are affected?
No. Section 14-3504(h) requires the Attorney General report before required resident notice without stating a population threshold. The 1,000-person threshold in § 14-3506 concerns nationwide consumer reporting agencies.
Statutes and sources
- Md. Code, Commercial Law § 14-3501 — definitions and covered information.
- Md. Code, Commercial Law § 14-3504 — breach, investigation, notices, delivery, and delays.
- Md. Code, Commercial Law § 14-3506 — nationwide consumer reporting agencies.
- Md. Code, Commercial Law § 14-3507 — qualifying regulated-business routes.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Maryland law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Maryland law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace