Law / United States / 
Maryland
Maryland State government personal records: collection limits, retention and deletion, collection notice and posted privacy notice (Chapter 435 of 2026)
Chapter 435 of the Acts of 2026 (House Bill 264), Gen. Prov. § 4-501
In force since .
A privacy notice rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Disclosure, Retention
- Audit expectation
- none
What it requires
- If you are a unit that collects personal information for personal records, keep it appropriate and relevant to the legitimate government purpose for which it is collected, and limit it to the minimum amount of personal information necessary to accomplish that purpose (Gen. Prov. 4-501(b)(2), as amended by Chapter 435 of 2026).
- Do not retain that personal information for longer than is reasonably necessary to fulfill the legitimate government purpose for which it was collected (4-501(b)(2)).
- In accordance with your retention schedule or as the law allows, securely delete or de-identify that personal information when it is no longer needed to fulfill that purpose (4-501(b)(2)).
- If you are a unit of the State and you request personal information for personal records, tell each person in interest from whom you collect it the legitimate government purpose for which it is collected, any specific consequences of refusing to provide it, the person's right to inspect, amend or correct the records, whether the information is generally available for public inspection, and whether it is made available to, transferred to or shared with any entity other than the official custodian (4-501(c)(3)).
- If you are a unit of the State, post a privacy notice and your privacy policies on the collection of personal information on your Internet website, consistent with the guidelines, standards and policies the Department of Information Technology issues under State Fin. & Proc. 3.5-319 (4-501(c)(4)).
- The collection-notice and posting duties in subsection (c) do not apply to personal records on the enforcement of criminal laws or the administration of the penal system, investigative materials kept to investigate a specific violation of State law, public records accepted by the State Archivist for deposit in the Maryland Hall of Records, information gathered in institutional-review-board-approved research projects, application or renewal materials on the licensing, registration or certification of an individual for an occupation or profession, or personal records exempted by regulations of the Secretary of Budget and Management (4-501(c)(5)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What record it asks for
Logging duty
A unit of the State posts a privacy notice and gives a collection notice to the person in interest, and personal information is deleted or de-identified under the unit's retention schedule. No log, register or access-record duty is stated.
- Kind
- None
- As of
What this law does
Chapter 435 of the Acts of 2026 (House Bill 264), the Maryland Data Privacy and Protection Act of 2026, amended section 4-501 of the General Provisions Article on personal records. A personal record is a public record that names or, with reasonable certainty, otherwise identifies an individual by an identifying factor such as an address, a description, a fingerprint or voice print, a number or a picture.
Personal information collected for personal records must be limited to the minimum amount of personal information necessary to accomplish the legitimate government purpose for which it was collected. Personal information collected for personal records must not be retained for longer than is reasonably necessary to fulfill the legitimate government purpose for which it was collected.
Personal information collected for personal records must be securely deleted or de-identified, in accordance with the unit's retention schedule or as allowed by law, when no longer needed to fulfill the legitimate government purpose for which it was collected. Subsection (c) of section 4-501 applies only to units of the State.
An official custodian who requests personal information for personal records must tell each person in interest the legitimate government purpose for which it is collected, any specific consequences of refusing to provide it, the person's right to inspect, amend or correct the records, whether it is generally available for public inspection and whether it is made available to, transferred to or shared with any entity other than the official custodian.
Each unit of the State must post a privacy notice and its privacy policies on the collection of personal information on its Internet website. The posted privacy notice and privacy policies must be consistent with the guidelines, standards and policies issued by the Department of Information Technology under section 3.5-319 of the State Finance and Procurement Article.
Personal records on the enforcement of criminal laws or the administration of the penal system are exempt from the requirements of subsection (c). Chapter 435 took effect on . The Governor approved Chapter 435 on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .