Law / United States / 
Maryland
Maryland Online Data Privacy Act (MODPA), general applicability and controller/processor duties
Md. Code Ann., Com. Law §§ 14-4701, 14-4702 (Title 14, Subtitle 47)
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Determine whether you conduct business in Maryland or target products or services to Maryland residents, and controlled or processed at least 35,000 consumers' personal data (excluding data processed solely to complete a payment transaction) or at least 10,000 consumers' personal data while deriving more than 20% of gross revenue from selling personal data, before treating MODPA as out of scope.
- Treat Maryland's 35,000-consumer applicability floor as materially lower than many peer states' 100,000-consumer floor when deciding whether MODPA reaches your Maryland-facing processing.
- Allocate controller duties (determining the purpose and means of processing) and processor duties (processing on a controller's behalf) correctly before assigning any of MODPA's other duties.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Maryland (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.BE-P1The organization’s role(s) in the data processing ecosystem are identified and communicated.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx
- Guidance body
- Office of the Attorney General of Maryland
- Open questions
- Is a business that offers a nationwide online product or service, not aimed at Maryland in particular, one that 'provides products or services that are targeted to residents of the State' under Md. Code Ann., Com. Law § 14-4702?
- Does a person count the consumers whose personal data its affiliates control or process toward the 35,000-consumer threshold in § 14-4702, or is the count made for each legal entity separately?
What it makes you log
Logging duty
The cited sections define terms and set the subtitle's scope: it applies to a person that conducts business in the State or provides products or services targeted to residents of the State and that, in the preceding calendar year, controlled or processed the personal data of at least 35,000 consumers (excluding payment-only data) or of at least 10,000 consumers while deriving more than 20% of gross revenue from selling personal data. Neither section requires a log or record. The documented data protection assessment for processing that presents a heightened risk of harm sits in section 14-4710(b), which this row does not cite and which a separate row carries. Section 14-4701(h) defines a consumer as an individual who is a resident of the State, which adds the residence hook beside the two prongs of section 14-4702.
- Kind
- None
- As of
What this law does
MODPA governs private-sector processing of Maryland residents' personal data.
It applies to a person that conducts business in Maryland or targets products or services to Maryland residents and, in the preceding calendar year, either controlled or processed at least 35,000 consumers' personal data (excluding data processed solely to complete a payment transaction) or controlled or processed at least 10,000 consumers' personal data while deriving more than 20% of gross revenue from selling personal data.
MODPA carries no independent revenue threshold, and its 35,000-consumer floor is materially lower than many peer states' 100,000-consumer floor. A controller determines the purpose and means of processing; a processor processes on a controller's behalf.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .