Law / United States / 
Maryland
Maryland units of State and local government: personal information security procedures, records destruction and breach notification
Md. Code Ann., State Gov't §§ 10-1301 to 10-1308 (Title 10, Subtitle 13)
In force since .
A breach notification rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Breach notice, Retention
- Audit expectation
- none
What it requires
- If you are a unit of State or local government that collects personal information of an individual, implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information collected and the nature of the unit and its operations (State Gov't 10-1304(a)).
- If you disclose personal information about an individual to a nonaffiliated third party service provider under a written contract entered into on or after , require by that contract that the provider implement and maintain reasonable security procedures and practices that are appropriate to the personal information disclosed and reasonably designed to help protect it from unauthorized access, use, modification, disclosure or destruction (10-1304(b)).
- When you destroy records of an individual that contain personal information of the individual, take reasonable steps to protect against unauthorized access to or use of the personal information, taking into account the sensitivity of the records, the nature of the unit and its operations, the costs and benefits of different destruction methods and available technology (10-1303).
- When you discover or are notified of a breach of the security of a system that holds computerized data including personal information of an individual, conduct in good faith a reasonable and prompt investigation to determine whether the unauthorized acquisition has resulted in or is likely to result in misuse of the information (10-1305(b)(1)).
- If the investigation concludes that misuse of the individual's personal information has occurred or is likely to occur, notify the individual of the breach as soon as reasonably practicable after the investigation, unless the information was secured by encryption or redacted and the encryption key has not been compromised or disclosed (10-1305(b)(2) and (b)(3)).
- Where you delay that notice because a law enforcement agency determines that it will impede a criminal investigation or jeopardize homeland or national security, give the notice as soon as reasonably practicable after the agency determines that it will not impede a criminal investigation and will not jeopardize homeland or national security (10-1305(d)(2)).
- Before you give the notice to individuals, notify the Office of the Attorney General of the breach, and if you are a unit as defined in 10-1301(f)(1), also notify the Department of Information Technology (10-1305(h)).
- Include in the notice to the individual a description of the categories of information acquired, your contact information, the toll-free telephone numbers and addresses of the major consumer reporting agencies, and the contact details of the Federal Trade Commission and the Office of the Attorney General with a statement that the individual can obtain information from them about steps to avoid identity theft (10-1305(g)).
- If you determine after the investigation that notice to the individual is not required, keep records that reflect that determination for 3 years after it is made (10-1305(b)(4)).
- If you must give notice of a breach to 1,000 or more individuals, also notify each nationwide consumer reporting agency without unreasonable delay of the timing, distribution and content of the notices (10-1307(a)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What record it asks for
What the log must hold
Decision basis
Log retention
Runs from the date the determination that notice is not required is made, and applies only to the records of that determination.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
A unit that investigates a breach of the security of a system and determines that notice to the individual is not required must keep records that reflect that determination. The records are those of the decision, so the contents are coded as the decision's basis. The section names no regulator access, audit or review of those records. The period is a minimum with no stated maximum.
- Kind
- Explicit
- As of
- Provision
- Md. Code Ann., State Gov't § 10-1305(b)(4)
- Trigger
- security_incident
What this law does
Subtitle 13 of Title 10 of the State Government Article defines a unit to include a county board of education and any other political subdivision of the State. The definition of a unit does not include a public institution of higher education. The subtitle does not apply to the Legislative or Judicial Branch of State government.
The subtitle does not apply to personal information that is publicly available information lawfully made available to the general public from government records, that an individual has consented to have publicly disseminated or listed, that is disclosed in accordance with the federal Health Insurance Portability and Accountability Act (other than a medical record that a person may not redisclose under section 4-302(d) of the Health-General Article), or that is disclosed in accordance with the federal Family Educational Rights and Privacy Act.
Personal information means an individual's first name or first initial and last name, personal mark, or unique biometric or genetic print or image, in combination with one or more listed data elements. The listed data elements include a username or e-mail address in combination with a password or security question and answer that permits access to an individual's e-mail account, genetic and health-related data, and sensitive data as defined in section 14-4701 of the Commercial Law Article.
Chapter 435 of the Acts of 2026, which rewrote the list of data elements in the definition of personal information, took effect on . A unit that collects personal information of an individual must implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information collected and the nature of the unit and its operations.
A unit that discloses personal information to a nonaffiliated third party service provider under a written contract entered into on or after must require by that contract that the provider implement and maintain reasonable security procedures and practices. A unit that destroys records of an individual that contain personal information of the individual must take reasonable steps to protect against unauthorized access to or use of the personal information.
A unit that discovers or is notified of a breach of the security of a system must conduct in good faith a reasonable and prompt investigation to determine whether the unauthorized acquisition has resulted in or is likely to result in misuse of the information. If the investigation shows that misuse of an individual's personal information has occurred or is likely to occur, the unit must notify the individual of the breach.
The notice must be given as soon as reasonably practicable after the unit conducts the investigation, except where it is delayed under subsection (d). A unit need not notify an individual whose personal information was secured by encryption or redacted when the encryption key has not been compromised or disclosed, unless the unit knows that the encryption key has been broken.
The notice may be delayed if a law enforcement agency determines that it will impede a criminal investigation or jeopardize homeland or national security, or to determine the scope of the breach, identify the individuals affected or restore the integrity of the system. A unit that determines after the investigation that notice is not required must keep records that reflect its determination for 3 years after the determination is made.
Before giving the notice to individuals, a unit must give notice of the breach to the Office of the Attorney General. A unit as defined in section 10-1301(f)(1) must also notify the Department of Information Technology of the breach. A unit that must notify 1,000 or more individuals of a breach must also notify each nationwide consumer reporting agency, without unreasonable delay, of the timing, distribution and content of the notices.
A nonaffiliated third party that maintains computerized data that includes personal information provided by a unit must notify the unit of a breach if the unauthorized acquisition of the individual's personal information has occurred or is likely to occur. A unit or nonaffiliated third party that complies with the safeguards, disposal and breach-response requirements of the listed federal financial privacy and credit reporting laws and interagency guidance is deemed to comply with the subtitle.
The subtitle is exclusive and preempts any provision of local law. The subtitle was enacted by Chapter 304 of the Acts of 2013, which the Governor approved on . The subtitle took effect on .
When LexLint raises it
When your app profile says your app processes personal data or processes biometric data.
Back to the example · Lint your app
Page updated .