Maryland Personal Information Protection Act (MPIPA), safeguards and secure-disposal duty

Md. Code Ann. Com. Law sections 14-3502, 14-3503 (Maryland Personal Information Protection Act, Title 14, Subtitle 35, added by 2007 Md. Laws ch. 531 (S.B. 194))

In force since 1 Jan 2008.

A security baseline statutes rule binding private bodies.

Obligation class: Security, Retention

What it requires

This binds any business that owns, maintains, or licenses the personal information of a Maryland resident; a business already complying with the security, notification, or destruction rules set by its own primary or functional federal or State regulator, or already subject to and in compliance with the Gramm-Leach-Bliley Act, the Fair and Accurate Credit Transactions Act's Red Flags Rule, the federal Interagency Guidelines Establishing Information Security Standards, or Health Insurance Portability and Accountability Act (HIPAA), is deemed to comply with this duty.
Absent that safe harbor, implement and maintain reasonable security procedures and practices, appropriate to the nature of the personal information held and the size of the business, to protect it from unauthorized access, use, modification, or disclosure.NIST CSF 2.0PR.DS-01
When destroying a customer's, an employee's, or a former employee's records containing personal information, take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.NIST CSF 2.0ID.AM-08
Where a nonaffiliated third-party service provider will receive personal information under a written contract entered into on or after January 1, 2009, require by that contract that the provider also implement and maintain reasonable security procedures and practices appropriate to the information disclosed.NIST CSF 2.0GV.SC-05
A violation is enforced only by the Office of the Attorney General's Consumer Protection Division, as an unfair or deceptive trade practice, for injunctive relief and a civil penalty of up to $10,000 per violation ($25,000 for a repeat violation); any person harmed may also bring a private action for injury or loss, and Title 13's own misdemeanor provision may extend to a violation of this duty.

These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Maryland (guidance, recorded 14 September 2026).

In the frameworks

NIST Privacy Framework

ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
CT.DM-P5Data are destroyed according to policy.
PR.DS-P5Protections against data leaks are implemented.

NIST CSF 2.0

GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected

CIS Controls

3.5Destroying data in a way that fits its sensitivity and storage type.
3.10Encryption of sensitive data as it crosses networks.
3.11Encryption of sensitive data where it is stored on servers and applications.
6.8Access rights defined by job role, and kept up to date.
7.1A documented, reviewed approach to finding and handling weaknesses.
8.2Turning on and gathering logs from the enterprise's systems.

FINOS AIGF

AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest
AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance

3 more

AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

1.1Policy on the security of network and information systems
2.1Risk management framework
3.1Incident handling policy
3.2Monitoring and logging
4.1Business continuity and disaster recovery plan
4.2Backup and redundancy management

6 more

6.2Secure development life cycle
6.5Security testing
6.10Vulnerability handling and disclosure
9.1Cryptography
11.2Management of access rights
12.2Handling of assets

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Title 13's own criminal provision, Commercial Law section 13-411(a), makes a violation of any provision of that title a misdemeanor, on conviction a fine of up to $1,000 or imprisonment of up to one year or both, in addition to any civil penalties. Section 14-3508 subjects a violation of the safeguards and secure-disposal duty to Title 13's enforcement and penalty provisions generally, so whether section 13-411's misdemeanor extends to this duty, as distinct from the section 13-410 civil penalty alone, has not been construed in the Office of the Attorney General's own published compliance guidance or located in any other primary source.

Penalty structure

Civil penalty under Commercial Law section 13-410: up to $10,000 for each violation of Title 13 (subsection (a)), and up to $25,000 for each subsequent violation by a merchant already found to have engaged in a violation who repeats the same violation (subsection (b)); the highest tier is coded. The statute names no aggregate cap. Maryland's separate breach-notification duty (section 14-3504) is filed under this jurisdiction's privacy row.

Rule: Per violation only
As of: 31 October 2026
Currency: USD
Per violation unit: Violation
Per violation amount: 25,000

Who enforces it

Enforcement body

Commercial Law section 14-3508 deems a violation of the safeguards and secure-disposal duty an unfair or deceptive trade practice under Title 13 of the Commercial Law Article (the Maryland Consumer Protection Act) and subjects it to that title's enforcement and penalty provisions, so it is enforced by the Office of the Attorney General's Consumer Protection Division; Commercial Law section 13-408 also lets any person harmed bring a private action.

Settledness

As of: 14 September 2026
Guidance link: https://oag.maryland.gov/i-need-to/Pages/Guidelines-for-Businesses-to-Comply-with-the-Maryland-Personal-Information-Protection-Act.aspx
Guidance body: Office of the Attorney General of Maryland
Open questions: Does Commercial Law section 14-3508's incorporation of Title 13's 'enforcement and penalty provisions' reach the criminal misdemeanor in section 13-411, or only the civil penalty in section 13-410?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

A business that owns, maintains, or licenses the personal information of a Maryland resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information and the nature and size of the business, to protect it from unauthorized access, use, modification, or disclosure.

When destroying a customer's, an employee's, or a former employee's records containing personal information, the business must take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.

Where the business discloses personal information to a nonaffiliated third-party service provider under a written contract entered into on or after January 1, 2009, it must require the provider by that contract to implement and maintain the same kind of reasonable security procedures and practices.

A business already complying with the security, notification, or destruction rules of its own primary or functional federal or State regulator, or already subject to and in compliance with the Gramm-Leach-Bliley Act, the Fair and Accurate Credit Transactions Act's Red Flags Rule, the federal Interagency Guidelines Establishing Information Security Standards, or Health Insurance Portability and Accountability Act (HIPAA), is deemed to be in compliance with this subtitle.

A violation is an unfair or deceptive trade practice under Title 13 of the Commercial Law Article, enforceable by the Attorney General for injunctive relief and a civil penalty of up to $10,000 per violation, $25,000 for a repeat violation, under Commercial Law section 13-410, and Commercial Law section 13-408 also lets any person bring a private action to recover for injury or loss the violation caused.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example · Lint your app

Page updated 14 September 2026.