---
title: "Montana privacy law (MCDPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/montana/processors"
source: "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Montana Consumer Data Privacy Act

# Montana privacy law (MCDPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Processors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. A binding contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must also require confidentiality, deletion or return at the end, compliance information on request, flow-down to subcontractors, and cooperation with assessments or an independent assessor's report.

## Key points

1. Processor must follow instructions and assist with consumer requests, security, breach notice and data protection assessments.

   Section: [§ 30-14-2813(1)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

2. Binding contract with instructions, nature and purpose, data types, duration, and both parties' rights and obligations.

   Section: [§ 30-14-2813(2)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

3. Contract must require confidentiality, deletion or return at the end, compliance information, written subcontractor flow-down, and assessments.

   Section: [§ 30-14-2813(2)(a) to (e)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

4. A processor that sets purposes and means becomes a controller for that processing.

   Section: [§ 30-14-2813(4)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

5. Processors must also help controllers meet the minors' duties and minors' assessments, under a contract meeting § 30-14-2813(2).

   Section: [§ 30-14-2818](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

## Sources

- [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0130/0300-0140-0280-0130.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0130/0300-0140-0280-0130.html)
- [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0180/0300-0140-0280-0180.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0180/0300-0140-0280-0180.html)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Montana statute](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

Reference material, not legal advice.

## Other topics for Montana

- [Applicability](https://dposchool.com/state-privacy-laws/state/montana/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/montana/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/montana/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/montana/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/montana/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Montana](https://dposchool.com/state-privacy-laws/state/montana) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/montana/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/montana/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents