In short
Maryland PIPA after the 2022 amendments: 45 days from discovery, Attorney General notice first, 10-day vendor notice, reasonable security, and the IT behind it.
In this article
Maryland’s Personal Information Protection Act is one of the stricter state breach laws, and the 2022 amendments made it stricter: a 45-day clock that starts at discovery rather than at the end of your investigation, Attorney General notice before customers are told, and a duty to maintain reasonable security that now applies to any business that holds the data, not just the one that owns it. If your business has Maryland customers, employees, or patients, this applies to you regardless of size. This article explains what the law requires and what the practical IT work looks like.
The law in plain terms
PIPA is at Maryland Code, Commercial Law, Sections 14-3501 through 14-3508. It applies to any business that owns, licenses, or maintains personal information of a Maryland resident. Personal information means a first name or initial and last name together with any of: Social Security number, driver’s license or state ID number, passport number, account or card number with the code needed to use it, health information, health insurance policy or subscriber number, biometric data, or genetic information. A username or email address with the password or security answer that opens the account is also personal information on its own.
The Act has four parts that matter to a small business:
- Reasonable security. A business that owns, licenses, or maintains personal information must implement and maintain reasonable security procedures and practices appropriate to the nature of the information and the size of the business. Since October 2022 this applies to businesses that merely maintain the data for someone else, which pulls in most IT providers, payroll vendors, and software vendors.
- Breach notification to individuals. After a breach, the business must investigate promptly and, if misuse of the information has occurred or is reasonably likely, notify affected residents as soon as reasonably practicable and no later than 45 days after discovering or being notified of the breach. The 2022 change is the important one: the 45 days run from discovery, not from the end of the investigation.
- Notice to the Attorney General. Before notifying individuals, the business must notify the Maryland Attorney General, with the number of residents affected, a description of the breach and when it happened, the steps taken in response, and a copy of the notice. There is no minimum headcount for this; it applies to every notification.
- Service providers. A business that maintains data on behalf of another must notify the owner within 10 days of discovering a breach (the 2022 amendments cut this from 45). If you use a vendor, your contract should reflect this, and if you are the vendor, your incident process has to meet it.
Two further points: the Act also requires secure disposal of records containing personal information when they are no longer needed, and encrypted data is excluded from the definition of a breach provided the key was not also taken. Businesses already subject to HIPAA or the Gramm-Leach-Bliley Act are deemed compliant for the data covered by those laws, but PIPA still applies to the rest, such as employee records at a medical practice.
What triggers notification in practice
| Event | Likely outcome under PIPA |
|---|---|
| Ransomware with evidence that data was taken | Notifiable if the data includes personal information and was not encrypted by you. The 45-day clock started the day you found the ransom note |
| Ransomware with no evidence either way | You must investigate promptly. Without logs you often cannot rule out misuse, which pushes toward notifying |
| A compromised email account with HR or client attachments | Usually notifiable; mailboxes hold more personal information than anyone remembers |
| Lost or stolen laptop, encrypted | Generally not a breach under the encryption exclusion |
| Lost or stolen laptop, not encrypted | Notifiable if it held personal information |
| Your payroll or software vendor is breached | They owe you notice within 10 days; your 45 days to individuals run from when they tell you |
Penalties
A violation of PIPA is an unfair or deceptive trade practice under the Maryland Consumer Protection Act, enforced by the Attorney General, with civil penalties per violation and the possibility of private claims by affected consumers. As with every breach law, the statutory penalty is rarely the largest cost; investigation, notification, legal fees, and lost customers are.
The IT work that keeps you compliant
“Reasonable security” is not defined in the statute. The controls below are what regulators, insurers, and courts consistently treat as reasonable for a small business, and each one maps to a trigger above.
- A data inventory. Which systems, folders, mailboxes, and vendors hold personal information. You cannot protect, dispose of, or scope a breach for data you have not found.
- Full-disk encryption on every device. The single control that most often turns a lost laptop into a non-event.
- Multi-factor authentication everywhere, email first.
- Endpoint detection and response with 24/7 monitoring. So an intrusion is stopped early, and so you have the logs to show what was and was not accessed. The 45-day clock is only workable if you can answer that question in days.
- Immutable, tested backups. Ransomware recovery without paying depends on them. See how often to back up your business data.
- Vendor contracts that require notice within the statutory 10 days and the same security standard you hold yourself to.
- Retention and disposal. Decide how long HR and customer records are kept, delete them securely when they expire, and destroy old drives and paper properly.
- A written incident response plan that names who decides, who calls counsel and the insurer, and how the Attorney General notice gets drafted inside the window.
Related Maryland requirements
Businesses in specific sectors carry more. Defense subcontractors have CMMC and ITAR and NIST SP 800-171 obligations on top of PIPA. Broker-dealers and advisers have FINRA and SEC controls. Cyber insurers ask for the same controls listed above; see cyber insurance IT requirements in Maryland.
How Corporate Technologies helps Maryland businesses
We support businesses across Maryland from our Frederick office, with a 24/7 help desk and security operations center shared across our 21 locations. The controls above are what our Secure Advantage package delivers, with device encryption and backups through our managed IT plans. If you want to see where you stand first, the network health check takes about three minutes.
This article is general information about the statute, not legal advice. For a specific incident, involve counsel on day one; the 45-day clock does not pause for the investigation.
Frequently asked questions
Does PIPA apply if we are not based in Maryland?
Yes, if you own, license, or maintain personal information of Maryland residents. Where your office is does not matter.
Do we have to tell the Attorney General even for a small breach?
Yes. Unlike many states, Maryland has no minimum number of affected residents for Attorney General notice, and it has to go before the individual notices.
Is a password-protected laptop “encrypted”?
No. A login password does not protect the data on the drive. Full-disk encryption (BitLocker on Windows, FileVault on Mac) has to be turned on and the recovery keys stored where you can find them.
We are an IT or payroll vendor. What changed for us in 2022?
Two things: you now have your own duty to maintain reasonable security for the data you hold for clients, and you must notify the data owner within 10 days of discovering a breach, not 45.
Keep reading
More in IT Solutions →
FINRA and SEC IT Controls for Small Financial Firms in Maryland
Amended Regulation S-P (incident response, 72-hour vendor notice, 30-day customer notice), FINRA 4370, Reg S-ID, Maryland PIPA, and what examiners expect.
IT for New Mexico Cannabis Businesses: Track and Trace, POS, Cameras, and Compliance
Cannabis Control Division rules that are really IT rules: daily track-and-trace reconciliation, unique accounts, camera retention, and what managed IT covers.
Business IT 101
What IT Documentation Should Every SMB Have?
Learn what IT documentation every small business should maintain to improve security, disaster recovery, compliance, and network management.
Free, same business day
What would managed IT cost for your team?
Tell us how many computers and users you have. An engineer sends a per-user range, usually the same business day. No credit card, no bot.
- Live service specialist in about a minute, 24/7
- 21 offices across 18 states
- 60-day money-back guarantee
Get your instant IT support estimate
Tell us how many computers and users you have and we send a per-user range, usually the same business day.
