Maryland MODPA

Maryland Online Data Privacy Act - strongest US state privacy regime, data minimisation, sale prohibition.


Short name	MD MODPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MD MODPA

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for MD MODPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for MD MODPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MD-MODPA-SEC` Data Security Practices	Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices appropriate to the data processed; given MODPA's strictness, integrity verification across the processing stack is expected at a high bar (Maryland MODPA, controller-duties provision)	Scan
`MD-MODPA-STRICTMIN` Strict Data Minimisation Evidence	Collection is lawful only when reasonably necessary and proportionate to provide a specifically requested product or service: a stricter standard than any peer state law; demonstrating necessity requires a complete, precisely described inventory of every component that touches personal data (Maryland MODPA, data-minimisation provisions)	Scan
`MD-MODPA-INV` Processing System Inventory	The heightened minimisation and sensitive-data duties presume the controller can enumerate every software system through which consumer data flows (Maryland MODPA, controller-duties provisions)	Scan
`MD-MODPA-PROC` Processor and Vendor Oversight	Processors act under binding contracts with flow-down obligations to subcontractors, and the sensitive-data sale ban makes downstream vendor accountability critical; each third-party component should carry a named supplier (Maryland MODPA, processor provisions)	Scan
`MD-MODPA-FLOWS` Sensitive Data Flow Mapping	Because selling sensitive data is prohibited outright, controllers must be able to trace how data moves between systems and third parties; a documented dependency graph among processing components evidences that flow control (Maryland MODPA, sensitive-data sale prohibition)	Scan
`MD-MODPA-DPIA` Data Protection Assessment Readiness	Data protection assessments are required for heightened-risk processing, including an assessment for each algorithm used; credible per-algorithm assessment requires precise version records for the software involved (Maryland MODPA, data protection assessment provisions)	Scan
`MD-MODPA-RIGHTS` Consumer Rights Fulfilment	Consumers hold access, correction, deletion, portability and opt-out rights, with universal opt-out recognition; the strictness of the regime warrants a high bar for unambiguous identification of the components holding consumer data (Maryland MODPA, consumer-rights provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`MD-CL-14-4604`	Consumer Rights: Access, Correction, Deletion & Portability
`MD-CL-14-4605`	Opt-Out of Sale, Targeted Advertising & Profiling
`MD-CL-14-4606`	Sensitive Data: Opt-In Consent & Data Minimization
`MD-CL-14-4608`	Data Protection Assessment
`MD-CL-14-4609`	Processor Agreements
`MD-CL-14-4603`	Privacy Notice Transparency
`MD-CL-14-4607`	Children's Data: Heightened Protection
`MD-CL-14-4610`	Non-Discrimination & Security

Policy templates

Written for MD MODPA:

Maryland MODPA State Privacy Notice
Maryland MODPA Sensitive Data Consent & Minimization Policy

And 22 from the standard set, adapted to MD MODPA.