Law / United States / 
Maryland
Maryland State government privacy governance: Privacy Officers, Department of Information Technology guidance and contract privacy requirements (Chapter 435 of 2026)
Chapter 435 of the Acts of 2026 (House Bill 264), State Fin. & Proc. §§ 3.5-319 and 13-115
In force since .
An enforcement supervision rule binding government bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- If you are a unit of State government, designate a Privacy Officer to oversee compliance with the subtitle and coordinate with the Department of Information Technology and the Office of the Attorney General (State Fin. & Proc. 3.5-319(a)).
- If you are the Department of Information Technology, adopt regulations, guidance and model templates to support compliance with the subtitle, including standard Public Information Act formats and data protection protocols (3.5-319(b)).
- If you are the Department of Information Technology, require basic security, data collection and privacy requirements to be included in a contract under which a third-party contractor will collect, store or process personal information as defined in State Gov't 10-1301 (State Fin. & Proc. 13-115(a)(2)).
- If you are the Department of Information Technology, make the privacy requirements for those contracts consistent with widely recognized privacy standards, including those of the National Institute of Standards and Technology (13-115(c)).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What record it asks for
Logging duty
Each unit designates a Privacy Officer and the Department of Information Technology requires contract privacy terms. No log, register or access-record duty is stated.
- Kind
- None
- As of
What this law does
Chapter 435 of the Acts of 2026 (House Bill 264) added section 3.5-319 to the State Finance and Procurement Article. Chapter 435 also amended section 13-115 of the State Finance and Procurement Article. Each unit of State government must designate a Privacy Officer to oversee compliance with the subtitle and coordinate with the Department and the Office of the Attorney General.
The Department must adopt regulations, guidance and model templates to support compliance with the subtitle, including standard Public Information Act formats and data protection protocols. The Department of Information Technology must require basic security, data collection and privacy requirements to be included in a contract under which a third-party contractor will collect, store or process personal information as defined in section 10-1301 of the State Government Article.
The privacy requirements developed for those contracts must be consistent with widely recognized privacy standards, including those of the National Institute of Standards and Technology. Chapter 435 took effect on . The Governor approved Chapter 435 on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .