PRIA Logo™
MarylandHB 02642026 Regular SessionHouse

Maryland Data Privacy and Protection Act of 2026

Sponsored By: Sponsor information unavailable

Signed by Governor

CybersecurityAdministrative AgenciesApplicants and ApplicationsAttorney GeneralBiometrics -see also- Artificial Intelli; Identif; FingerprtCertificationsContracts -see also- ProcurementData -see also- Census; DemographicsDisabilitiesElectronic GovernmentEquipment -see also- Charging; Med. Equip.; MV Equip; etc.Ethnic AffairsGender -see also- WomenGeneral Services, Department ofGeneticsHealth -see also- COVID19; EnvHlth; MedCon; etc.Identification -see also- Biometrics; Fingerprinting; DrLicsImmigrants and Citizenship -see also- ResidencyInformation TechnologyInformation Technology, Department ofLicenses -see also- AB Lic; Certifications; DrLic; PermitsMental and Behavioral Health -see also- Aut; Cogn; Dev; etc.Minors -see also- Age of Majority; YouthNoticesPersonal Identifying InformationPrivacyPublic InformationPublic Officials -see also- Atty Gen; Compt; Coun Admin; etcRacial Matters -see also- Ethnic Affairs; MinoritiesRecords -see also- Land Records; Vital RecordsReligion -see also- Places of WorshipReportsRules and RegulationsSexual OrientationStandards and Best PracticesSubstance AbuseWork, Labor, and Employment -see also- JobTrn; Leave; etc.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

5 provisions identified: 4 benefits, 0 costs, 1 mixed.

State agencies collect and keep less data

Beginning October 1, 2026, State units collect only data needed for a real government purpose. They must limit what they take, keep it accurate, and delete or de‑identify it when it is no longer needed. Agencies may not create new personal records without a clear need. They may not obtain personal information by fraud. When asking for your data, they must collect it from you when possible and give you a written notice about why, your rights to see or fix records, and any sharing. Each unit posts a privacy notice on its website and names a privacy officer. The Department of Information Technology issues rules and templates to help agencies comply.

More types of data get protection

Beginning October 1, 2026, more kinds of personal data get protection under State law. The law treats race, religion, health, sex life, sexual orientation, transgender status, citizenship, genetic and biometric data, kids’ data, and precise location as sensitive. It also adds taxpayer IDs, passport and other government ID numbers, account logins with passwords or security answers, and genetic and health data to personal information. These data get stronger limits on collection, use, and sharing.

Stop sale and re-sharing of your data

By July 1, 2026, every Maryland government entity must publish procedures that stop the sale and re‑sharing of personal records and precise location data it provides. The procedures must set contract limits, address data brokers and secondary uses, and cover sensitive, genetic, and geolocation data. Entities develop these with the Department of Information Technology. Each entity must send its procedures to the General Assembly by July 1, 2026.

Stronger privacy rules for State vendors

Beginning October 1, 2026, State contracts with vendors that handle State IT or personal data must include security and privacy rules. The rules cover third parties that access State systems, process personal information, or connect to State networks. Contract requirements align with recognized standards like NIST SP 800‑171, ISO 27001, CMMC, the NIST Privacy Framework, NIST SP 800‑53, and zero trust guidance. This helps cut the risk of data breaches affecting residents.

Controlled research access and privacy carve-outs

Beginning October 1, 2026, State custodians may let approved researchers see records that are not public, but only under strict safeguards. Researchers must submit a written request, protect identities, avoid contacting people without approval, and sign a binding agreement. At the same time, some records are carved out from these new rules, including law‑enforcement files, certain investigations, archived public records, IRB‑reviewed research data, and licensing application materials. Other exemptions may be added by regulation.

Sponsors & Cosponsors

Sponsors

There is no primary sponsor on record.

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

All Roll Calls

Yes: 171 • No: 0

Senate vote • 4/13/2026

Third Reading Passed

Yes: 43 • No: 0 • Other: 3

House vote • 3/21/2026

Third Reading Passed

Yes: 128 • No: 0 • Other: 7

Actions Timeline

  1. Approved by the Governor - Chapter 435

    5/12/2026

  2. Returned Passed

    4/13/2026House

  3. Third Reading Passed (43-0)

    4/13/2026Senate

  4. Second Reading Passed

    4/9/2026Senate

  5. Favorable Adopted

    4/9/2026Senate

  6. Favorable Report by Finance

    4/9/2026Senate

  7. Hearing 4/01 at 1:00 p.m.

    3/25/2026Senate

  8. Referred Finance

    3/23/2026Senate

  9. Third Reading Passed (128-0)

    3/21/2026House

  10. Favorable Adopted Second Reading Passed

    3/20/2026House

  11. Favorable Report by Government, Labor, and Elections

    3/20/2026House

  12. Hearing 2/10 at 1:00 p.m.

    1/28/2026House

  13. First Reading Government, Labor, and Elections

    1/14/2026House

  14. Pre-filed

    10/1/2025House

Bill Text

  • Enacted

    5/12/2026

    PDF

  • Third Reading

    3/20/2026

    PDF

  • First Reading

    1/14/2026

    PDF

Related Bills

Back to State Legislation