DPO SchoolDPO School

Montana Consumer Data Privacy Act

Montana privacy law (MCDPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General has exclusive enforcement authority, using the state's unfair trade practices powers, and may issue civil investigative demands, including for data protection assessments. Since 1 October 2025 there is no cure period, and a violation carries a civil penalty of up to $7,500 each, plus injunctions and recovery of fees and costs. There is no private right of action.

Key points

  1. Attorney General has exclusive authority, using the powers in Title 30, chapter 14, parts 1 and 2.

    Section: § 30-14-2817(1)

  2. Civil investigative demands may request relevant data protection assessments.

    Section: § 30-14-2817(3)

  3. The former 60-day notice-and-cure period (due to end 1 April 2026) was removed by the 2025 amendments.

    Section: § 30-14-2817

  4. Civil penalty up to $7,500 per violation; injunctions; attorney fees and expenses.

    Section: § 30-14-2820(2) to (4)

  5. A violation of the part is also a violation of the unfair trade practices law.

    Section: § 30-14-2820(1)

  6. No private right of action.

    Section: § 30-14-2817(5)

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Montana statute

Reference material, not legal advice.