Maryland Online Data Privacy Act (MODPA) is a state privacy law that gives Maryland residents rights over how their personal data is collected, used, shared, and sold. It sets obligations for controllers and processors around notice, consent, data minimization, security, and consumer rights such as access, deletion, and correction.
What MODPA Means for Privacy Governance
MODPA is not just a disclosure rule. It is a state privacy framework that forces organisations to define why personal data is collected, how much of it is necessary, who can receive it, and how residents can exercise rights against the controller and processor.
For practitioners, the practical shift is from broad data use toward documented purpose limitation, minimisation, and rights handling. That means the law touches collection design, vendor flows, retention logic, and the operational teams that must answer access, deletion, and correction requests.
Core Obligations Under MODPA
The law’s obligations cluster around notice, consent where required, data minimisation, security safeguards, and consumer rights. Those duties matter because privacy compliance fails most often at the seams, where product teams, legal review, security controls, and data operations do not share the same record of what personal data exists.
A useful way to read MODPA is as a lifecycle law: collect less, explain more clearly, keep only what you can justify, and ensure downstream processors are contractually and technically aligned with the controller’s commitments. Data Mapping and ROPA Guide is a practical companion for keeping those obligations tied to actual data flows.
Consumer Rights and Operational Response
MODPA gives residents rights that are only meaningful if an organisation can locate personal data, confirm identity or authority where needed, and respond within a controlled process. Access, deletion, and correction requests are therefore as much an operational issue as a legal one.
That is why teams need clear ownership for intake, identity verification, search across systems, exception handling, and processor coordination. If rights requests are handled inconsistently, the organisation can comply on paper while still failing to execute the underlying data change in systems of record and backups.
Security, Transfers, and Accountability
MODPA’s security requirement matters because privacy and security are intertwined: if personal data is weakly protected, minimisation and rights commitments lose practical value. The controller also needs visibility into where personal data is shared, sold, or processed by third parties so accountability does not stop at the first system boundary.
For broader context on how state privacy regimes are being operationalised across the US, US State Privacy Laws Guide helps compare MODPA with other state laws, while EU General Data Protection Regulation (GDPR) is useful for understanding how purpose limitation, minimisation, and security are treated in a mature privacy regime.
Risk and Threat Considerations
MODPA reduces privacy and compliance exposure, but the main failure modes are familiar: overcollection, weak processor governance, incomplete deletion, and rights requests that cannot be operationalised across all systems. Those weaknesses can turn into regulatory exposure and, in the event of a breach, greater harm because the organisation retained or distributed more personal data than necessary.
Failure mechanism: Personal data is collected or shared without a tight purpose and inventory model, so the organisation cannot confidently locate, restrict, or remove it when a resident exercises rights or when a processor mishandles it.
Impact: The result can be privacy non-compliance, unnecessary data exposure, and a larger blast radius if a dataset is compromised or reused beyond the original business purpose.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 and GDPR define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | PT-2 — Purpose Specification | MODPA centers on collecting and using personal data for defined purposes. |
| DM-1 — Minimize Personal Data Processing and Retention | MODPA requires data minimization and limited retention of personal data. | |
| IP-1 — Consent | MODPA uses consent-based obligations for certain personal data uses and disclosures. | |
| Recommendation — Define and document the specific purposes for collecting personal data before processing it. Limit collection and retention to the minimum personal data needed for the stated purpose. Capture and honor consent decisions before processing personal data that depends on consent. | ||
| ISO/IEC 27001:2022 | A.5.34 — Privacy and protection of PII | MODPA is a privacy law governing the handling of personal data. |
| A.5.32 — Intellectual property rights | MODPA’s sharing and use restrictions benefit from clear governance over data handling rights and obligations. | |
| Recommendation — Apply privacy controls to protect personal data across its lifecycle and service providers. Document rights and obligations so data use stays within approved legal and contractual boundaries. | ||
| GDPR | Article 5 — Principles relating to processing of personal data | MODPA closely tracks core privacy principles such as minimisation, purpose limitation, and storage limits. |
| Article 12-22 — Data subject rights | MODPA resident rights mirror access, deletion, and correction style rights management. | |
| Article 25 — Data protection by design and by default | MODPA’s privacy obligations depend on embedding minimisation and control into system design. | |
| Recommendation — Use purpose limitation, minimisation, and storage limitation as baseline design rules for personal data. Build an end-to-end rights workflow that can verify, locate, and fulfill data requests reliably. Design systems to default to the least personal data and the narrowest sharing needed. | ||
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | MODPA requires the organisation to know which personal data activities are in scope and who owns them. |
| PR.DS-01 — Data-at-Rest is Protected | MODPA’s security duty depends on protecting stored personal data. | |
| Recommendation — Inventory personal data processing activities and assign accountable owners for each. Protect stored personal data with appropriate safeguards matched to sensitivity and exposure. | ||
Practitioner Guidance
Governance implication: MODPA works best when privacy ownership is explicit across legal, security, product, and data teams. Treat the law as a design constraint on data collection and sharing, not as a notice template that can be applied after the fact.
Practitioner takeaway: If you can’t explain why each personal data element is needed, where it flows, and how a resident request is executed end to end, you are not yet operating to MODPA’s standard.
Related resources from NHI Mgmt Group
- Why can a low consumer threshold still create significant compliance risk under the Vermont Data Privacy and Online Surveillance Act?
- Maryland Online Data Protection Act
- Who is accountable when a third-party service provider mishandles personal data under the Colorado Privacy Act?
- How should organisations implement privacy controls for sensitive data under Maryland’s privacy law?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org