---
title: "Maryland privacy law (MODPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/maryland/processors"
source: "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Maryland Online Data Privacy Act

# Maryland privacy law (MODPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

A controller that uses a processor must sign a binding contract setting out instructions, nature and purpose, data types, duration and both parties' rights and obligations. The contract must require confidentiality, reasonable security, stopping processing on an authenticated consumer request, deletion or return, compliance information, subcontracting only after a chance to object, and assessments. A person that goes beyond the controller's instructions is treated as a controller.

## Key points

1. Binding contract required with instructions, nature and purpose, data types, duration and both parties' rights and obligations.

   Section: [§ 14-4708(a)(1) and (2)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false)

2. Required terms include confidentiality, reasonable security, and stopping processing on the controller's request made under a consumer's authenticated request.

   Section: [§ 14-4708(a)(3)(i) to (iii)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false)

3. Deletion or return at the end of services, compliance information on request, subcontractors only after the controller may object and under written contracts, and cooperation with assessments.

   Section: [§ 14-4708(a)(3)(iv) to (vii)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false)

4. Processors must assist with rights requests, security and breach notification, and assessments.

   Section: [§ 14-4708(b)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false)

5. A person not limited by, or not following, the controller's instructions is a controller and may face enforcement.

   Section: [§ 14-4708(d)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false)

## Sources

- [https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4708&enactments=false](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4708&enactments=false)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Maryland statute](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false)

Reference material, not legal advice.

## Other topics for Maryland

- [Applicability](https://dposchool.com/state-privacy-laws/state/maryland/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/maryland/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/maryland/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/maryland/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/maryland/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Maryland](https://dposchool.com/state-privacy-laws/state/maryland) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/maryland/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/maryland/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents