# Commercial Law (GCL)

## Title 14. Miscellaneous Consumer Protection Provisions

### Subtitle 35. Maryland Personal Information Protection Act

#### Section 14-3506

(a) If a business is required under Sec. 14-3504 of this subtitle to give notice of a breach of the security of a system to 1,000 or more individuals, the business also shall notify, without unreasonable delay, each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined by 15 U.S.C. Sec. 1681a(p), of the timing, distribution, and content of the notices.

(b) This section does not require the inclusion of the names or other personal identifying information of recipients of notices of the breach of the security of a system.

---

Md. Code Ann., Com. Law (as displayed at mgaleg.maryland.gov, October 16, 2026)