Maryland & Federal Law
The Cybersecurity Laws
That Apply to Your
Maryland Business.
Laws Covered on This Page
For informational purposes only. This page provides plain-language summaries of cybersecurity and privacy laws that may affect Maryland businesses. It is not legal advice. Laws and enforcement guidance change — consult a qualified attorney to understand your specific obligations. Sources include the Maryland Office of the Attorney General, Maryland General Assembly, and U.S. federal agencies.
Maryland State Laws
Maryland-Specific
Compliance Requirements
These laws are enacted by the Maryland General Assembly and enforced by the Maryland Office of the Attorney General or other state regulators. They apply specifically to businesses operating in — or serving residents of — Maryland.
Md. Code Ann., Com. Law § 14-3501 et seq.
The Foundation of Maryland Data Security Law
PIPA is Maryland’s core cybersecurity statute. It applies to any business — regardless of size or location — that owns, licenses, or maintains personal information about Maryland residents. It requires businesses to implement reasonable security measures to protect that information, and to notify affected individuals and the Maryland Attorney General if a breach occurs. Violations are classified as unfair or deceptive trade practices under the Maryland Consumer Protection Act.
Penalties: Civil penalties beginning at $1,000 per first violation and $5,000 per subsequent violation. Violations are treated as deceptive trade practices under the Consumer Protection Act, which can lead to additional civil and criminal consequences. The AG may also pursue injunctive relief. Source: Maryland Office of the Attorney General
Senate Bill 541 (2024)
Signed by Governor Moore in May 2024, MODPA makes Maryland the 18th state with a comprehensive consumer privacy law — and one of the strictest in the nation. It applies to any business that processes personal data of 35,000 or more Maryland consumers annually, or derives 20% or more of revenue from selling personal data of 10,000+ consumers. MODPA is broader and stricter than many similar state laws. Enforcement by the Maryland Attorney General began April 1, 2026.
Penalties: Up to $10,000 per violation and up to $25,000 per subsequent violation, enforced exclusively by the Maryland Attorney General’s Office. No private right of action — consumers cannot sue directly. Criminal proceedings are possible for willful violations. Source: Maryland SB 541 / Maryland Office of the Attorney General
Md. Code, Insurance, Title 33
Based on the National Association of Insurance Commissioners (NAIC) model law, SB 207 requires Maryland-domiciled insurance carriers — including health maintenance organizations and third-party administrators — to develop, implement, and maintain a comprehensive Written Information Security Program (WISP) and report significant cybersecurity events to the Maryland Insurance Administration (MIA) within three business days.
Penalties: The Maryland Insurance Commissioner may investigate violations and issue fines of between $100 and $125,000 per violation. Source: Maryland Insurance Administration
Federal Law
Federal Regulations That
Apply in Maryland
In addition to state law, most Maryland businesses in regulated industries face overlapping federal compliance obligations. In many cases, compliance with a federal law also satisfies Maryland state requirements — but not always.
HIPAA
Health Insurance Portability and Accountability Act · Privacy, Security & Breach Notification Rules
GLBA
CMMC
PCI DSS
FTC Act
NIST CSF
At a Glance
Which Laws Apply
to Your Business?
This matrix provides a general overview. Your specific obligations depend on your business model, the data you hold, and your clients’ industries. A compliance assessment will give you a definitive answer.
| Law / Regulation | Financial Firms | CPA / Accounting | Medical Offices | Defense Contractors | Any Small Business |
|---|---|---|---|---|---|
| PIPA (Maryland) | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes |
| MODPA (Maryland) |  Likely | Likely | Likely | Likely | Check threshold |
| GLBA Safeguards Rule | ✓ Yes | ✓ Yes (tax prep) | — Not typically | — Not typically | If financial services |
| HIPAA | — Not typically | — Not typically | ✓ Yes | — Not typically | If handling PHI |
| CMMC 2.0 Level 1 | — Not typically | — Not typically | — Not typically | ✓ Yes (if DoD FCI) | If DoD contract |
| MD Insurance Law (SB 207) | — Not typically | — Not typically | — Not typically | — Not typically | If insurance carrier |
| PCI DSS | If card payments | If card payments | If card payments | If card payments | If card payments |
| FTC Act (Section 5) | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes |
| NIST CSF (voluntary) | ✓ Recommended | ✓ Recommended | ✓ Recommended | ✓ Recommended | ✓ Recommended |
Legislative History
How Maryland’s Cybersecurity
Law Has Evolved
Maryland has steadily strengthened its cybersecurity legal framework since 2008. Understanding this trajectory helps businesses anticipate where regulation is heading.
The Maryland Personal Information Protection Act established the state’s foundational data security requirement — mandating reasonable security practices and breach notification for any business holding Maryland residents’ personal information.
The Maryland Cybersecurity Council was established to assess cyber risk across the state and advise on policy. It issues biennial reports that directly inform new legislation. Its 2025 report — citing over 1,800 confirmed breaches — is driving the next wave of requirements.
House Bill 1154 expanded PIPA’s reach to include businesses that maintain — not just own or license — personal information. This brought third-party service providers and data processors squarely within the law’s scope.
HB 962 reduced breach notification time from 45 days after investigation conclusion to 45 days after discovery. It also added genetic information, biometric data, and health insurance policy numbers to the definition of personal information. A presumption of notification was established — notice is now required unless the business can demonstrate no misuse risk.
Insurance carriers operating in Maryland were required to implement comprehensive Written Information Security Programs (WISPs), report cybersecurity events to the Insurance Commissioner within 3 business days, and submit annual compliance certifications.
Governor Moore signed the Maryland Online Data Privacy Act, making Maryland the 18th state with comprehensive consumer privacy legislation — and one of the strictest. MODPA prohibits selling sensitive consumer data regardless of consent, mandates data protection assessments, and gives Maryland consumers robust rights over their personal information.
The Maryland Online Data Privacy Act became effective October 1, 2025. The Maryland Attorney General began enforcement on April 1, 2026. Businesses that had not yet assessed their compliance posture faced immediate exposure.
The Council’s July 2025 report identified five critical risk areas: utilities, healthcare, legacy IT systems, talent shortages, and consumer privacy. The report cited over 1,800 confirmed breaches nationwide since its previous report and is expected to drive additional legislation affecting private-sector businesses in Maryland.
Don’t Navigate This Alone