MODPA Readiness Checklist (Free Diagnostic)

🔒

DARS does not store your data. This assessment runs locally in your browser. No answers are transmitted to DARS servers. MODPA compliant by design. We're advising you on MODPA compliance. It would be hypocritical not to practise it ourselves.

Organisation Name

MODPA Diagnostic Tool v · Questions last updated:

Step 1 of 4

Are you a Controller or Processor?

This determines which questions apply to your organisation.

If a Processor deviates from Controller instructions on any processing activity, MODPA deems it a Controller for that activity.

🏢

Controller

I decide the purpose and means of collecting personal data

⚙️

Processor

I only process data on behalf of another company

🔄

Both

I act as both — routes to Controller path (higher standard applies)

If you do both, the higher standard applies — answer as a Controller.

Step 2 of 4

Select Your Sector

After the core assessment, you'll receive sector-specific questions that add depth to your report.

Step 3 of 4 — Answer all questions, then click Get Results

Results open in a pop-up. You can then print a full report.

Who this tool is for

The Maryland Online Data Privacy Act (MODPA) reaches any organization that does business in Maryland or targets Maryland residents and crosses its data-volume thresholds — regardless of where the company is headquartered or how many employees it has. This diagnostic is for the people who need to answer "does this apply to us, and how far off are we?": operations and compliance leads, in-house and outside counsel doing an initial scope, nonprofit executives who assumed privacy laws only apply to tech companies, healthcare and financial services firms checking how MODPA interacts with HIPAA and GLBA, and vendors whose Maryland customers are now sending data processing addenda.

What it measures — and what “in scope” means

The diagnostic first establishes your role — controller or processor — because MODPA assigns different duties to each. It then asks sector-specific questions about the personal data you collect, how you use it, whether you sell it or use it for targeted advertising or profiling, how you handle sensitive data and minors' data, how you honor consumer rights requests, whether you run data protection assessments for high-risk processing, and how you manage processors and contracts. Each answer is scored against the relevant statutory provision, and the report cites the section of the Act behind each gap. "In scope" means MODPA's applicability thresholds are met; the article linked below explains why the 35,000-consumer threshold is reached far earlier than most organizations expect.

What your result is not

The report is a readiness diagnostic, not a legal opinion and not a compliance certification. It cannot account for exemptions that depend on your specific facts, it does not analyze your contracts or your privacy notice, and a high score does not mean the Maryland Attorney General would agree. MODPA is enforced by the Attorney General with no private right of action, and the initial cure period has ended — so treat the gap report as the agenda for a conversation with counsel, not as the conclusion of one.

Frequently asked questions

QWho does MODPA apply to?

Organizations that conduct business in Maryland or target Maryland residents and, in a year, control or process the personal data of 35,000 or more consumers, or 10,000 or more consumers while deriving more than 20 percent of revenue from selling personal data. Records count — not just customers — so web visitors, leads, and inactive accounts all add up.

QIs MODPA already being enforced?

Yes. The Act took effect October 1, 2025, and enforcement began April 1, 2026, when the grace period for processing activities ended.

QWhat is the difference between a controller and a processor under MODPA?

A controller decides why and how personal data is processed. A processor handles data on a controller's behalf under contract. Controllers carry most of the consumer-facing duties; processors have contractual and assistance obligations.

QDoes using AI tools like ChatGPT or Copilot affect MODPA scope?

It can. Feeding personal data into AI tools is processing, and profiling or automated decisions can trigger data protection assessment requirements. The related MODPA-and-AI article covers the common cases.

QAre nonprofits exempt from MODPA?

Not automatically. Unlike several other state privacy laws, MODPA does not broadly exempt nonprofits. Check the thresholds and the specific exemptions in the Act with counsel.

QDoes this tool send my answers to DARS?

No. The diagnostic runs entirely in your browser and nothing is transmitted or stored. Print the report if you want to keep it.

MODPA Readiness Diagnostic