Obligations United States Maryland
What a Maryland business has to have in writing
Maryland pairs a broad data statute with an unusually early-triggering pay transparency rule: the Personal Information Protection Act makes reasonable security safeguards a standing duty for anyone holding a Maryland resident's personal data, and since October 2024 every employer of any size must publish a wage range and benefits summary in every job posting.
The Maryland Online Data Privacy Act adds privacy notices and data protection assessments from October 2025. MOSH runs the state OSHA plan and enforces a written heat illness prevention plan for any workplace that hits an 80 degree heat index, and insurance carriers certify a written information security program to the Insurance Administration each April.
Harassment claims reach employers with a single employee, employment contracts and policies may not waive future sexual harassment claims, and hospitals must run a written workplace safety programme with a joint safety committee.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
MarylandHandbook 2026acknowledged by name
Maryland on Recordwith AllyMatter
Cover Maryland the Modern WayEvery policy Maryland makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Maryland on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Maryland rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Maryland Personal Information Protection Act (breach notification)AI-compiledMd. Code, Com. Law §§ 14-3504 to 14-3508Any business that owns, licenses or maintains computerized personal information of a Maryland residentDistribute
Notice
Investigate whether misuse has happened or is likely, then, before telling individuals, give the Attorney General written notice of the breach, the people affected and what you did about it. Notice to affected residents follows as soon as reasonably practicable and no later than 45 days after concluding the investigation, and must describe the categories of data involved, contacts for the credit bureaus and the FTC, and the toll-free numbers.
From the first employee
Maryland Attorney General, Identity Theft Unit
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Reasonable security safeguards duty (Personal Information Protection Act)AI-compiledMd. Code, Com. Law § 14-3503Any business that owns, maintains or licenses personal information of a Maryland resident, including businesses that hand that data to a service providerWrite
Written program
Put in place and keep running security safeguards appropriate to the nature of the personal information you hold and the size of the operation, covering unauthorized access, use, change and disclosure. When you give personal information to a service provider, the contract has to bind that provider to equivalent safeguards. Records must be destroyed so the data cannot be read or reconstructed.
From the first employee
Maryland Attorney General
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Maryland Online Data Privacy Act (MODPA)AI-compiledMd. Code, Com. Law §§ 14-4701 et seq. (Ch. 455/456, Acts of 2024)Businesses doing business in Maryland or targeting Maryland residents that in a year handled personal data of 35,000+ consumers, or of 10,000+ consumers while earning more than 20 percent of gross revenue from selling personal dataWrite
Written policy
Publish a privacy notice listing the data categories, purposes, sharing, how to exercise rights and how to appeal a refusal; keep written data protection assessments for targeted advertising, sales, risky profiling and sensitive data; get opt-in consent for sensitive data and stop selling it altogether; limit collection to what the requested service reasonably needs; and honor access, correction, deletion, portability and opt-out requests including universal opt-out signals.
From the first employee
Maryland Attorney General, Consumer Protection Division
Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data
LawProduceWhat it requiresTriggerEnforced by
Facial recognition in job interviews - consent waiverAI-compiledMd. Code, Lab. & Empl. § 3-717Any employer using a facial recognition service on an applicant during an interviewDistribute + ack
Notice
Obtain a signed waiver from the applicant before running any facial recognition analysis in an interview. The waiver has to name the applicant, give the date, say the applicant consents to the use of facial recognition during the interview, and confirm the applicant read the waiver.
From the first employee
Maryland Department of Labor; private civil action
Harassment Prevention 1A written policy, and in some states annual training, on harassment
LawProduceWhat it requiresTriggerEnforced by
Maryland Fair Employment Practices Act harassment provisions and the ban on waiving sexual harassment claimsAI-compiledMd. Code, State Gov't 20-601(d) and 20-606; Md. Code, Lab. & Empl. 3-715Every Maryland employer with one or more employees for harassment claims (the 15-employee threshold applies only to other discrimination claims)Write + ack
Written policy
Employment contracts, policies and agreements that contain no provision waiving a substantive or procedural right or remedy for a future sexual harassment or retaliation claim; any such provision is null and void, the employer may not take adverse action against an employee who refuses to sign one, and an employer that tries to enforce one pays the employee's attorney's fees.
From the first employee
Maryland Commission on Civil Rights; private action in court
Workplace Safety Programs 2Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
Maryland Occupational Safety and Health (MOSH) State PlanAI-compiledMd. Code, Lab. & Empl. Title 5; COMAR 09.12; 29 CFR 1952 (Maryland State Plan)All private-sector and state and local government employers in MarylandWrite
Written program
Follow the standards MOSH adopts, which include federal standards plus Maryland-only rules, post the MOSH job safety and health poster, keep the injury and illness log, and report fatalities and serious hospitalizations to MOSH. Written programs are required where the underlying standard calls for one, such as hazard communication, bloodborne pathogens and respiratory protection.
From the first employee
Maryland Department of Labor, Division of Labor and Industry (MOSH)
Heat stress standard (written heat illness prevention plan)AI-compiledCOMAR 09.12.32Every Maryland workplace, indoor or outdoor, where employees are exposed to a heat index at or above 80 degrees FahrenheitWrite
Written program
Write and keep a site-specific heat-related illness prevention and management plan covering how heat index is monitored, drinking water, shade and rest breaks, acclimatization for new and returning workers, high-heat procedures, emergency response and annual training. The plan must be available to employees, and MOSH publishes an optional model program employers may adapt.
From the first employee
Maryland Department of Labor, Division of Labor and Industry (MOSH)
Workplace Violence Prevention 1A written plan for preventing and responding to workplace violence
LawProduceWhat it requiresTriggerEnforced by
Health care facility workplace safety programAI-compiledMd. Code, Lab. & Empl. 5-1101 to 5-1103Hospitals, subacute care units within hospitals, State-operated hospitals and State residential centresWrite
Written program
A workplace safety committee with equal numbers of management and non-management employees, and a written safety programme containing a written policy on how the facility keeps health care workers safe, an annual assessment of hazards with recommendations for reducing injuries, a process for reporting, responding to and tracking workplace injury incidents, and regular safety training for health care workers.
From the first employee
Maryland Department of Labor, Division of Labor and Industry (Maryland Occupational Safety and Health)
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
Insurance carrier cybersecurity standardsAI-compiledCh. 231, Acts of 2022 (SB 207); COMAR 31.04.22Insurance carriers licensed in Maryland, including health maintenance organizations, managed care organizations and third-party administratorsCertify
Certification
Run a risk assessment, then build and maintain a comprehensive written information security program with administrative, technical and physical safeguards, plus a written incident response plan. File an Information Security Program Certification with the Insurance Commissioner by April 15 each year, and report qualifying cybersecurity events to the Maryland Insurance Administration within three business days of determining one occurred.
From the first employee
Maryland Insurance Administration
Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Maryland Healthy Working Families Act (earned sick and safe leave)AI-compiledMd. Code, Lab. & Empl. §§ 3-1301 to 3-1311Every employer with employees in Maryland; leave is paid at 15 or more employees and unpaid below thatWrite
Written policy
Accrue at least one hour of sick and safe leave for every 30 hours worked, up to 40 hours a year, and let workers carry over unused time. Give employees written notice of their rights, show the leave balance on each pay statement or an equivalent online record, keep three years of leave records, and set out accrual, use and notice rules in a written leave policy.
From the first employee
Maryland Department of Labor, Employment Standards Service
Family and Medical Leave Insurance Program (FAMLI)AI-compiledMd. Code, Lab. & Empl. Title 8.3Employers with employees working in Maryland; employers with 15 or more employees also owe the employer share of contributionsDistribute
Notice
Give employees written notice of their FAMLI rights at hire, once a year and when leave is requested, covering benefit amounts, how to claim, job protection and the ban on retaliation. Employers either pay into the state fund or run a Department-approved private plan, and keep the payroll and claim records that go with it.
From the first employee
Maryland Department of Labor, FAMLI Division
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required workplace postersAI-compiledMd. Code, Lab. & Empl. (various: §§ 3-423, 3-1306, 5-104); COMAR 09.12Every Maryland employerPost
Posting
Display the state's current poster set where employees can read it: minimum wage and overtime, wage payment, earned sick and safe leave, equal pay for equal work, employment of minors, MOSH job safety and health, unemployment insurance and workers' compensation. The Department of Labor publishes them free.
From the first employee
Maryland Department of Labor
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Wage Range Transparency ActAI-compiledMd. Code, Lab. & Empl. § 3-304.2 (Ch. 336, Acts of 2024)Every employer advertising a position that will be performed at least partly in Maryland, with no headcount floorDistribute
Notice
Put a good-faith wage range plus a general description of benefits and other compensation in every public and internal job posting; if there was no posting, give the applicant the same information before any pay discussion and again on request. Employers may use the Commissioner's disclosure form, must keep the records, and may not ask for or rely on wage history.
From the first employee
Maryland Department of Labor, Commissioner of Labor and Industry
Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business registration (Maryland Business Express / SDAT)AI-compiledMd. Code, Corps. & Ass'ns; Md. Code, Tax-Prop. § 11-101 (annual report)Any corporation, LLC, LLP, nonprofit or out-of-state entity doing business in Maryland, plus trade name registrationsFile
Filing / record
Register the entity through Maryland Business Express with the State Department of Assessments and Taxation, keep a resident agent on file, and file the Annual Report and Personal Property Return by April 15 each year. Employers also register for state tax accounts and unemployment insurance through the same portal.
From the first employee
Maryland State Department of Assessments and Taxation
Home improvement contractor licensingAI-compiledMd. Code, Bus. Reg. Title 8 (Maryland Home Improvement Commission)Contractors, subcontractors and salespersons performing home improvement work on residential property in MarylandFile
Filing / record
Hold a Maryland Home Improvement Commission licence before contracting, pass the trade and business exam, carry the required insurance and pay into the Guaranty Fund, and use a written contract that states the licence number, scope, price, payment schedule and dates. Licences renew every two years.
From the first employee
Maryland Department of Labor, Maryland Home Improvement Commission
Food service facility license and certified food service managerAI-compiledCOMAR 10.15.03 (Food Service Facilities); Md. Code, Health-Gen. Title 21Restaurants, mobile units, caterers and other food service facilities in MarylandFile
Filing / record
Get a food service facility licence from the local health department before opening and renew it annually, pass inspections, and keep at least one certified food service manager on staff whose certificate comes from an accredited program. Higher-risk facilities must document HACCP-style procedures and a written employee illness reporting agreement.
From the first employee
Maryland Department of Health, Office of Food Protection; local health departments
Other Written Policies 3Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Wage payment notice at hire and pay statementsAI-compiledMd. Code, Lab. & Empl. § 3-504Every Maryland employerDistribute + ack
Notice
Give each employee written notice at hire of the rate of pay, regular paydays and leave benefits, and notify them at least a business day before any pay-day change. Every pay period, issue a written statement showing the dates covered, hours worked, rates, gross and net pay, deductions and the basis on which the pay was calculated.
From the first employee
Maryland Department of Labor, Employment Standards Service
Access to Information About Hazardous and Toxic SubstancesAI-compiledMd. Code, Lab. & Empl. §§ 5-401 to 5-416Maryland employers whose employees may be exposed to hazardous or toxic substances at workWrite
Written program
Keep a written chemical information list for the workplace, hold the safety data sheets, post the state notice telling employees they can ask for that information, answer written employee requests within the statutory window and train employees on the substances they work with.
From the first employee
Maryland Department of Labor, Division of Labor and Industry (MOSH)
Minor work permitsAI-compiledMd. Code, Lab. & Empl. Title 3, Subtitle 2Any employer hiring a worker under 18 in MarylandFile
Filing / record
Get and keep on file a work permit issued through the Department of Labor's online system for every minor before the first day of work, follow the hour and occupation limits for the minor's age, and produce the permits on inspection.
From the first employee
Maryland Department of Labor, Employment Standards Service
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Maryland on top
Small businessFederal + industry, with Maryland on topConstruction contractorsFederal + industry, with Maryland on topHealthcare practicesFederal + industry, with Maryland on topFood and beverage businessesFederal + industry, with Maryland on topTax and accounting firmsFederal + industry, with Maryland on topRegistered investment advisersFederal + industry, with Maryland on topInsurance agenciesFederal + industry, with Maryland on topRetail and e-commerceFederal + industry, with Maryland on topTrucking and logistics carriersFederal + industry, with Maryland on topNonprofitsFederal + industry, with Maryland on topFederal contractorsFederal + industry, with Maryland on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Maryland Attorney General - Identity TheftMaryland General Assembly - Com. Law § 14-3504Maryland General Assembly - Com. Law § 14-3503Maryland General Assembly - Com. Law § 14-4701Maryland General Assembly - Lab. & Empl. § 3-717Maryland Department of Labor - Employment StandardsMaryland General Assembly - Lab. & Empl. § 3-304.2Maryland General Assembly - Lab. & Empl. § 3-1305Maryland General Assembly - Lab. & Empl. § 3-1301Maryland Department of Labor - Paid Family and Medical LeaveMaryland Department of Labor - FAMLI FAQsMaryland General Assembly - Lab. & Empl. § 8.3-101Maryland Department of Labor - MOSHOSHA - Maryland State PlanMaryland Department of Labor - PostersMaryland Department of Labor - MOSH Heat StressMaryland General Assembly - SB 207 (2022), Chapter 231Maryland Insurance Administration - Bulletin 24-6, Information Security Program CertificationMaryland Insurance Administration - Bulletin 23-18, COMAR 31.04.22 written information security programMaryland Business ExpressMaryland State Department of Assessments and TaxationMaryland Department of Labor - Maryland Home Improvement CommissionMaryland Department of Health - Food License and PermitMaryland Department of Health - Office of Food ProtectionMaryland General Assembly - Lab. & Empl. § 3-504Maryland General Assembly - Lab. & Empl. § 5-401Maryland Department of Labor - Minor Work PermitsMaryland General Assembly, Lab. & Empl. 3-715Maryland General Assembly, State Gov't 20-601 (definition of employer)Maryland General Assembly, Lab. & Empl. 5-1103Maryland General Assembly, Lab. & Empl. 5-1102 (safety committee)Maryland General Assembly, Lab. & Empl. 5-1101 (definitions)