Processes personal data, in Montana

Mont. Code Ann. § 33-19-306(10), (14) · Read the law's page

• If you are a licensee disclosing personal or privileged information for an actuarial or research study, limit the disclosure to what is reasonably necessary, make sure no individual is identified in any actuarial or research report, return or destroy the materials that allow an individual to be identified as soon as they are no longer needed, and get the actuarial or research organization to agree not to further disclose the information without the individual's separate, written authorization (section 33-19-306(10)(a)).
• If you are a licensee disclosing for health research, make sure the research is subject to institutional review board approval and the federal requirements for biomedical research, and if you disclose for epidemiological or drug therapy outcomes research, disclose only information that has been made anonymous to protect the identity of the patient through coding or encryption (section 33-19-306(10)(b)).
• If you are a licensee disclosing to a group policyholder for reporting claims experience or auditing your operations or services, disclose only what the group policyholder reasonably needs, get its agreement not to further disclose the information without the individual's separate, written authorization, and edit any medical record information disclosed to prevent the identification of the applicant, policyholder or certificate holder (section 33-19-306(14)).

Mont. Code Ann. §§ 33-18-901 to 33-18-904 · Read the law's page

• If you are an insurer, health service corporation, health maintenance organization, fraternal benefit society or other issuer of an individual or group policy or certificate of insurance, do not require an individual to obtain a genetic test unless the test is otherwise required by law, for example to establish parentage, for newborn screening, in a criminal investigation or for remains identification.
• Do not, on the basis of a person's genetic traits, refuse an application, refuse to issue, cancel or refuse to renew a policy or certificate, charge a higher rate or premium, or offer different terms, conditions or benefits or limit coverage.
• Do not underwrite or condition coverage on a requirement or agreement that the individual undergo genetic testing, or on genetic information about a member of the individual's family, and do not discriminate in agents' or brokers' fees or commissions on the basis of an individual's genetic traits.
• Do not seek genetic information about an individual for a purpose unrelated to assessing or managing the individual's current health, inappropriate in an asymptomatic individual, or unrelated to research in which a subject is not personally identifiable.

Mont. Code Ann. § 30-14-1703 · Read the law's page

• This binds any business holding a customer's records containing personal information within its custody or control, a business being any sole proprietorship, partnership, corporation, association, or other group, whether or not organized to operate at a profit, including an entity that destroys records, but not an industry regulated under Title 33 of the Montana Code.
• Take all reasonable steps to destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer necessary to be retained, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable.

Mont. Code Ann. § 30-14-1704 · Read the law's page

• Notify affected Montana residents of a breach of security without unreasonable delay, and simultaneously submit an electronic copy of the notification to the Attorney General's consumer protection office.

Mont. Code Ann. § 30-14-2808 · Read the law's page

• Give a Montana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.

Mont. Code Ann. § 30-14-2814 · Read the law's page

• Conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, and the processing of sensitive data.
• Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
• Make an assessment available to the attorney general when the attorney general requires disclosure of one that is relevant to an investigation.
• Apply the assessment duty to processing activities created or generated after January 1, 2025, and not to earlier ones.

Mont. Code Ann. § 30-14-2815 · Read the law's page

• To hold data as de-identified under the MCDPA, take reasonable measures to ensure that the data cannot be associated with an individual (Mont. Code Ann. section 30-14-2815(1)(a)).
• Publicly commit to maintaining and using de-identified data without attempting to re-identify it (Mont. Code Ann. section 30-14-2815(1)(b)).
• Contractually obligate every recipient of de-identified data to comply with all provisions of the MCDPA (Mont. Code Ann. section 30-14-2815(1)(c)).
• When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments that bind it and take appropriate steps to address any breach of those commitments (Mont. Code Ann. section 30-14-2815(5)).

Mont. Code Ann. §§ 30-14-2803, 30-14-2811, 30-14-2813 · Read the law's page

• Confirm you meet MCDPA's applicability thresholds under the current, S.B. 297-amended text rather than the original 2023 thresholds; the 2025 amendment lowered them.
• Apply MCDPA's minors' privacy provisions, added by S.B. 297, to any known child's personal data you process for a Montana consumer.

Mont. Code Ann. §§ 30-14-2817, 30-14-2820 · Read the law's page

• Expect MCDPA violations to be enforced exclusively by the Montana Attorney General, never by a private plaintiff.
• Do not assume a notice-and-cure opportunity before an enforcement action. As of October 1, 2025, the Attorney General may proceed directly to a civil penalty without a mandatory cure step.

Mont. Code Ann. § 45-6-311(5)(b) and (c) · Read the law's page

• Do not restrict access to personal data by any means (Mont. Code Ann. § 45-6-311(5)(b)).
• Do not restrict a consumer's access to a product or service because the consumer did not authorize the use or collection of data (Mont. Code Ann. § 45-6-311(5)(c)).

Mont. Code Ann. § 50-16-529(6), (7) · Read the law's page

• If you are a health care provider not subject to the HIPAA privacy provisions and you disclose health care information without the patient's authorization for use in a research project, disclose it only for a project that an institutional review board has determined contains reasonable safeguards to protect against directly or indirectly identifying any patient in any report of the project, and procedures to remove or destroy at the earliest opportunity, consistent with the purposes of the project, information that would enable the patient to be identified, unless an institutional review board authorizes retention for another research project (section 50-16-529(6)(d) and (e)).
• If you are a health care provider not subject to the HIPAA privacy provisions and you disclose health care information to a person who obtains it for an audit, disclose it only to a person who agrees in writing to remove or destroy, at the earliest opportunity consistent with the purpose of the audit, information that would enable the patient to be identified, and not to disclose the information further except to accomplish the audit or to report unlawful or improper conduct involving fraud in payment for health care or other unlawful conduct by a health care provider (section 50-16-529(7)).

Mont. Code Ann. §§ 30-23-101 to 30-23-106 · Read the law's page

• If you are an entity that offers consumer genetic testing products or services directly to a consumer, or that collects, uses or analyzes genetic data, make available a high-level privacy policy overview and a prominent, publicly available privacy notice covering your collection, consent, use, access, disclosure, transfer, security, retention and deletion practices for genetic or neurotechnology data.
• Obtain initial express consent from a consumer, parent, guardian or power of attorney for the collection, use or disclosure of the consumer's genetic or neurotechnology data, describing your uses of the data, the categories of individuals within the entity with access to test results, and how you may share the data.
• Obtain separate express consent, naming the third party, for each transfer or disclosure to a third party other than your processors; separate express consent for each use beyond the primary purpose and for retaining a biological sample after the initial testing; informed express consent for transfer to third parties for research; and express consent for marketing based on the data and for sale or other valuable consideration of the data.
• Comply with section 44-6-104, which requires a valid legal process for disclosing genetic or neurotechnology data to law enforcement or any other government agency without the consumer's express consent.
• Develop, implement and maintain a comprehensive security program to protect a consumer's genetic or neurotechnology data against unauthorized access, use or disclosure.
• Provide a process for a consumer to access and delete the consumer's genetic or neurotechnology data, revoke any consent, and request and obtain destruction of the consumer's biological sample, subject to the clinical research and laboratory waivers in section 30-23-104(7) and (8).
• Do not disclose a consumer's genetic or neurotechnology data to any entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's express consent.
• Do not store genetic or neurotechnology data or biometric samples of Montana residents collected in the state within a country sanctioned by the United States Office of Foreign Assets Control or designated a foreign adversary, and transfer or store such data outside the United States only with the resident's consent.