DPO SchoolDPO School

Montana Consumer Data Privacy Act

Montana privacy law (MCDPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. A binding contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must also require confidentiality, deletion or return at the end, compliance information on request, flow-down to subcontractors, and cooperation with assessments or an independent assessor's report.

Key points

  1. Processor must follow instructions and assist with consumer requests, security, breach notice and data protection assessments.

    Section: § 30-14-2813(1)

  2. Binding contract with instructions, nature and purpose, data types, duration, and both parties' rights and obligations.

    Section: § 30-14-2813(2)

  3. Contract must require confidentiality, deletion or return at the end, compliance information, written subcontractor flow-down, and assessments.

    Section: § 30-14-2813(2)(a) to (e)

  4. A processor that sets purposes and means becomes a controller for that processing.

    Section: § 30-14-2813(4)

  5. Processors must also help controllers meet the minors' duties and minors' assessments, under a contract meeting § 30-14-2813(2).

    Section: § 30-14-2818

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Montana statute

Reference material, not legal advice.