Data breach notification
Maryland's breach duty is in the Maryland Personal Information Protection Act, Commercial Law section 14-3504, with definitions in section 14-3501.
Before notifying individuals, a business must provide notice of the breach to the Office of the Attorney General. In Maryland, the regulator hears first.
Individuals are then notified as soon as reasonably practicable, but not later than 45 days after the business discovers or is notified of the breach.
Personal information starts with a first name or first initial and last name, combined with an element that is not encrypted, redacted, or otherwise protected by a method that renders it unreadable or unusable.
Separately, a user name or e-mail address in combination with a password or security question and answer that permits access to an individual's e-mail account is covered.
Individual notice is owed unless the business reasonably determines that the breach does not create a likelihood that personal information has been or will be misused. That determination has to be kept for three years.
A clear picture of who opened which files is most useful early.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
Watermarks are a per-room setting, on by default. The chained log also captures uploads, invitations and changes, and exports as CSV. NDA acceptance before entry is available on Professional and Business, and each recipient confirms their email with a six-digit code, no account needed.
Checked against Maryland's published law on November 2, 2026. This is general information, not legal advice.
