Law / United States / 
Montana
Montana Consumer Data Privacy Act (MCDPA), data protection assessments
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, and the processing of sensitive data.
- Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
- Make an assessment available to the attorney general when the attorney general requires disclosure of one that is relevant to an investigation.
- Apply the assessment duty to processing activities created or generated after , and not to earlier ones.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, risky profiling and the processing of sensitive data (30-14-2814(1)), and the assessment must weigh the benefits of the processing against the risks to the consumer's rights (30-14-2814(2)). The attorney general may require a controller to disclose an assessment relevant to an investigation, the controller must make it available, and the attorney general may evaluate it (30-14-2814(3)(a) and (b)); assessments are confidential (30-14-2814(3)(c)). The section sets no period for keeping an assessment. The section has no scope clause; the reach and the consumer definition are in 30-14-2802 and 30-14-2803, which this row does not cite.
- Kind
- Explicit
- As of
- Provision
- Mont. Code Ann. 30-14-2814(1)-(3)
- Trigger
- personal_data_processing
What this law does
MCDPA requires a controller to conduct and document a data protection assessment for each of its processing activities that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, and the processing of sensitive data.
Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards, and the controller must factor in the use of de-identified data, the reasonable expectations of consumers, the context of the processing and the relationship between the controller and the consumer.
The attorney general may require a controller to disclose any assessment relevant to an investigation, the controller must make it available to the attorney general, and the attorney general may evaluate it for compliance with the part. Assessments are confidential and exempt from disclosure under the federal Freedom of Information Act, and disclosure to the attorney general does not waive attorney-client privilege or work product protection.
The assessment requirements apply to processing activities created or generated after , and are not retroactive.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or makes high-risk automated decisions.