Maryland SaaS Agreement Review
Maryland's Online Data Privacy Act, Commercial Law 14-4701 and following, took effect October 1, 2025 and applies to processing from April 1, 2026. It is widely seen as the strictest of the newer state laws. It applies at 35,000 consumers and limits sensitive data to what is strictly necessary. A Baltimore or Bethesda business buying SaaS needs vendors that can live within those limits.
Consumer privacy law in Maryland
Maryland Online Data Privacy Act (MODPA)
Data rights in Maryland
Maryland has enacted the Maryland Online Data Privacy Act (MODPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Maryland residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What makes Maryland's privacy law stricter?
Section 14-4707 bars collecting, processing or sharing sensitive data unless it is strictly necessary to provide a product or service the consumer requested, and bans selling sensitive data outright. Ordinary personal data must be limited to what is reasonably necessary and proportionate. Targeted advertising and data sales are barred where a business knows or should know the consumer is under 18.
The thresholds are 35,000 Maryland consumers, or 10,000 when more than 20% of gross revenue comes from selling personal data.
Maryland breach notice timing
Under Commercial Law 14-3504, a business must notify affected residents as soon as reasonably practicable and no later than 45 days after it discovers or is notified of the breach, and must notify the Attorney General before notifying individuals. A vendor maintaining data for you must tell you within 10 days of discovery and share what it knows, without charging a fee for that information.
Maryland breach records and email notice
A business that decides after investigation that data was not and will not be misused must record that decision and keep it for three years. Email notice to residents requires their express consent unless the business operates mainly online, and notice of an email credential breach cannot be sent to the compromised account. If law enforcement delays notice past the 45 days, it is due within seven days after the delay ends.
Maryland sources checked 2026-10-09: Md. Com. Law 14-4702 (Maryland General Assembly) · Md. Com. Law 14-4707 (Maryland General Assembly) · Md. Com. Law 14-3504 (Maryland General Assembly) · Ashurst Perkins Coie, Maryland breach chart. Laws change; confirm the current rule before relying on it.
Maryland SaaS agreement FAQ
Does Maryland have a data privacy law that affects SaaS contracts?
Yes. Maryland has enacted a comprehensive consumer privacy law, the Maryland Online Data Privacy Act (MODPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Maryland residents.
Can a SaaS vendor use my Maryland business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Maryland law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Maryland?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Maryland law in about a minute.
Can a SaaS vendor process health data for a Maryland business?
Yes, but only within the strictly necessary standard. Under MODPA, sensitive data such as health information may be processed only when strictly necessary to provide a product or service the consumer asked for, and it can never be sold. Confirm the vendor will not use that data for analytics, benchmarking or model training.
Does Maryland let consumers revoke consent given through a SaaS app?
Yes. Controllers must offer a way to revoke consent that is at least as easy as the way consent was given, and must stop the processing within 30 days of a revocation request. If your SaaS vendor runs the consent flow, the contract should require it to honor revocations within that window.
Reviewing a SaaS contract in Maryland?
Upload it and get the data, liability, and renewal terms checked against Maryland law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Maryland law when you run your agreement, and you should confirm anything critical with a qualified attorney.