Understanding MODPA: Maryland’s new privacy law

The Maryland Online Data Privacy Act (MODPA) brings new requirements for businesses that market goods or services to Maryland consumers. Explore our five-part series to learn what MODPA means for your business and how to prepare for compliance.

Prepare for MODPA enforcement with our risk assessment checklist.

 

MODPA

Preparing for MODPA enforcement: risk assessment checklist

The Maryland Online Data Privacy Act (MODPA) introduces some of the most comprehensive state-level privacy requirements in the country. Effective October 1, 2025, with enforcement beginning in April 2026, MODPA significantly expands the obligations for businesses that collect or process the personal data of Maryland residents. If your organization falls under these thresholds, early preparation […]

MODPA

Creating a sustainable MODPA compliance program for your business

Preparing for enforcement and beyond In the final part of our series on the Maryland Online Data Privacy Act (MODPA), we look ahead to enforcement and beyond. With MODPA taking effect on Oct. 1, 2025, and enforcement beginning April 1, 2026, businesses must not only prepare for implementation but also build sustainable privacy programs that […]

MODPA

Managing third-party vendors under Maryland’s privacy law

In Part 4 of our series on the Maryland Online Data Privacy Act (MODPA), we turn to third-party vendors. MODPA sets strict requirements for data processing agreements and oversight of vendors who handle personal data on behalf of businesses. Like many privacy laws, Maryland’s will govern the contractual relationship between data controllers and processors. The […]

MODPA

MODPA risk assessments: How to evaluate and mitigate privacy risks

As part of our continuing series on the Maryland Online Data Privacy Act (MODPA), this installment focuses on risk assessments. MODPA requires businesses to perform data protection assessments when certain processing activities pose a heightened risk of harm to consumers. Under the Maryland Online Data Privacy Act, risk assessments are required when the processing activity […]

MODPA

Is your business covered by MODPA?

The Maryland Online Data Privacy Act (MODPA) will take effect on October 1, 2025. In this second part of our series, McNees explores which businesses the law applies to and the key mandates they will face.  Who does MODPA apply to and what does it mandate?  MODPA will apply to businesses operating in Maryland or […]

MODPA

Maryland Online Data Privacy Act: What businesses need to know

The Maryland Online Data Privacy Act (MODPA) will take effect on October 1, 2025. Businesses marketing goods or services to consumers in Maryland will need to implement legal and technical measures to comply with the new law. In this series, McNees provides guidance on the general requirements of the law and how MODPA will affect […]

Key contacts

Devin Chwastyk

Devin J. Chwastyk

Advises businesses and public entities on privacy, data security, and complex litigation. Counsels on compliance, breach response, and class action defense.

See full profile

Kayla Bushey

Advises businesses on data privacy, AI, and data transfer compliance, litigation, and evolving regulations at state, federal, and international levels

See full profile

Stay close to what matters

Receive legal perspectives, blog posts and invitations to upcoming events from McNees. Follow the topics that interest you and the developments affecting your business and industry.