Maryland Online Data Privacy Act of 2024
Pseudonymisation and De-Identification - Maryland MODPA

Maryland Online Data Privacy Act of 2024 MD-MODPA-Pseudonymisation-De-Identification-Section-14-4610-4611-Internal-Research-Aggregated: Maryland MODPA Pseudonymisation + De-Identification + Section 14-4610 + 14-4611 + Internal Research + Aggregated

Apply pseudonymisation and de-identification under Sections 14-4610 and 14-4611 to enable lawful internal research + product improvement + aggregated reporting while protecting consumer privacy. Pseudonymised Data definition (Section 14-4601(V)) - personal data that cannot be attributed to specific consumer without use of additional information kept separately and subject to technical and organisational measures preventing re-identification. De-Identified Data definition - cannot reasonably be linked to consumer or household + technical safeguards + business processes preventing re-identification + publicly commit to maintain without re-identifying + contractually bind recipients. Aggregated Consumer Information - statistical de-identified about group/category from which individual identities removed + not linked to any consumer. Internal research exemption (Section 14-4611) permits processing without consent for internal product improvement + bug repair + security maintenance + scientific research in public interest under privacy-by-design + research ethics review board + data destruction post-research timeline. Maryland Consumer Health Information Act (separate) interaction. HIPAA Safe Harbor / Expert Determination cross-walk for health data.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 261 controls across 75 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 14 controls

GDPR · 8 controls

  • GDPR-Art.10 Processing of personal data relating to criminal convictions
  • GDPR-Art.11 Processing which does not require identification
  • GDPR-Art.15 Right of access by the data subject
  • GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction
  • GDPR-Art.25 Data protection by design and by default
  • GDPR-Art.35 Data protection impact assessment
  • GDPR-Art.38 Position of the data protection officer
  • GDPR-Art.9 Processing of special categories of personal data

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 6 controls

  • AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction
  • AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement)
  • AT-DSG-12 Section 62 - Administrative penalties
  • AT-DSG-13 Section 36 - Scope of law enforcement processing
  • AT-DSG-14 Section 38 - Lawfulness of law enforcement processing
  • AT-DSG-7 Section 18 - Establishment of the Data Protection Authority

Bahrain PDPL · 6 controls

Barbados Data Protection Act 2019 · 6 controls

  • BB-DPA-1 Section 1 - Short Title
  • BB-DPA-14 Section 15 - Right to Data Portability
  • BB-DPA-16 Section 22 - General Principle for Transfers
  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities
  • BB-DPA-21 Sections 61-69 - Data Privacy Officer
  • BB-DPA-4 Section 4 - Principles Relating to Processing

ISO/IEC 23894:2023 · 5 controls

  • ISO23894-6.3 AI Risk Assessment
  • ISO23894-6.3.1 AI Risk Identification
  • ISO23894-6.3.3 AI Risk Evaluation
  • ISO23894-A.1 Data Quality and Representativeness
  • ISO23894-A.5 Privacy and Data Protection in AI

Privacy Act 1988 (Australia) · 5 controls

  • AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework
  • AUPRV-4 APP 10-11 Quality, Security of Personal Information
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children
  • AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response
  • AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement

South Korea ISMS-P · 5 controls

  • ISMSP-MS-02 Risk Management
  • ISMSP-PI-01 Personal Information Collection
  • ISMSP-PI-04 Cross-Border Transfer
  • ISMSP-SYS-02 Encryption Implementation
  • ISMSP-SYS-04 Vulnerability Management

Azerbaijan Law on Personal Data (2010) · 4 controls

  • AZ-DPA-12 Article 13 - Cross-border transfer
  • AZ-DPA-14 Article 16 - Liability for violations
  • AZ-DPA-15 Article 17 - Dispute resolution
  • AZ-DPA-6 Article 6 - State regulation in personal data protection

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 4 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)
  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)
  • UAE-PDPL-FreeZones Coordination with DIFC, ADGM and sectoral data protection regimes

ISO 27799:2025 · 4 controls

  • ISO27799-03 Minimum necessary standard enforcement
  • ISO27799-04 Patient data de-identification procedures
  • ISO27799-05 Audit trail for ePHI access
  • ISO27799-06 Security management process and risk analysis

ISO/IEC 27400:2022 · 4 controls

  • 27400-5.4 Data and privacy risks
  • 27400-7.1 Network Security for IoT
  • 27400-7.3 Data minimization and purpose limitation
  • 27400-7.4 Data retention and deletion

Malaysia PDPA 2010 · 4 controls

  • MY-PDPA-Cross-Border-Transfer-Section-129-Whitelist-Abolition-2024-Adequacy-SCC-BCR-Processor-Direct-Marketing Malaysia PDPA Cross-Border + Section 129 + Whitelist Abolition 2024 + Adequacy + SCC + BCR + Processor + Marketing
  • MY-PDPA-DPO-Designation-Class-Data-User-Registration-DPIA-Code-Practice-Section-43A-2024-Amendment Malaysia PDPA Governance + DPO Section 43A + Class of Data User Registration + DPIA + Code of Practice
  • MY-PDPA-Data-Subject-Rights-Access-Correction-Portability-Withdraw-Consent-Prevent-Marketing-Sections-30-43 Malaysia PDPA Subject Rights + Access + Correction + Portability + Withdraw Consent + Prevent Marketing + Sections 30 to 43
  • MY-PDPA-Seven-Personal-Data-Protection-Principles-General-Notice-Choice-Disclosure-Security-Retention-Data-Integrity-Access Malaysia PDPA Seven Principles + General + Notice and Choice + Disclosure + Security + Retention + Data Integrity + Access

South Korea PIPA · 4 controls

  • PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33
  • PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021
  • PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37
  • PIPA-Pseudonymisation-Article-28-2-3-Enforcement-PIPC-Investigation-Surcharges-3-Percent-Revenue-Article64-2 Korea PIPA Pseudonymisation + Article 28-2 + Enforcement + PIPC + Surcharges 3% + Article 63 + 64-2

APPI · 3 controls

  • APPI-A23 Security Control Measures
  • APPI-A24 Supervision of Employees
  • APPI-A33 Request for Disclosure of Retained Personal Data

Albania Law No. 124/2024 on Personal Data Protection · 3 controls

  • AL-DPA-12 International Data Transfers
  • AL-DPA-14 Direct Marketing
  • AL-DPA-7 Right of Access

Armenia Law on Protection of Personal Data (2015) · 3 controls

Australian Privacy Principles (APPs) · 3 controls

  • APP-1 APP 1 - Open and transparent management of personal information
  • APP-3 APP 3 - Collection of solicited personal information
  • APP-5 APP 5 - Notification of the collection of personal information

BSI IT-Grundschutz · 3 controls

  • BSI-13 Risk assessment procedures
  • BSI-15 Security categorization
  • BSI-17 Continuous monitoring strategy

ISO/IEC 25012:2008 - Data Quality Model · 3 controls

  • ISO-25012-5.1 Establishing data quality requirements
  • ISO-25012-5.2 Defining data quality measures
  • ISO-25012-5.3 Planning and performing data quality evaluations

ISO/IEC 27011:2024 · 3 controls

  • 27011-5.2 Information Security Roles in Telecoms
  • 27011-6.3 Awareness and Training
  • 27011-8.6 Data protection and backup

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 3 controls

  • 27557-3 Terms and definitions
  • 27557-4.3 Individual impact consideration
  • 27557-6.3 Privacy risk assessment

ISO/IEC 29100:2024 · 3 controls

  • 29100-6.10 Information security
  • 29100-6.5 Use, retention and disclosure limitation
  • 29100-6.9 Accountability

ISO/IEC 29134:2023 · 3 controls

  • 29134-1 Scope
  • 29134-3 Terms and definitions
  • 29134-9.1 PIA report structure

Nevada Gaming Control Board Cybersecurity Requirements · 3 controls

  • NGCB-1 Regulation 5.260 Scope, Applicability, and Licensee Categories
  • NGCB-5 Technical Security Controls - Access + Network + Encryption + Vulnerability + Logging
  • NGCB-8 Annual Independent Cybersecurity Assessment + Reporting + Board Oversight

Pakistan Personal Data Protection Bill 2023 · 3 controls

  • PAKPDPB-6 Cross-Border Transfer and Data Localization
  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO
  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 3 controls

  • IM8-DAT.2 Data Protection
  • IM8-DAT.4 Data Retention and Disposal
  • IM8-SEC.4 Vulnerability Management

API 1164 · 2 controls

  • API1164-07 Remote Access
  • API1164-24 Vulnerability assessment for critical systems

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

  • AWWA-1.2 Risk Assessment
  • AWWA-3.4 Encryption and Data Protection

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

  • DIQ-2 Data Quality Management
  • DIQ-3 Metadata Management

EASA Part-IS - Information Security in Aviation · 2 controls

  • IS.D.OR.205 Information Security Risk Assessment
  • IS.I.OR.205 Information Security Risk Assessment

FTC GLBA Safeguards Rule (16 CFR Part 314) · 2 controls

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))
  • FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)

Florida Digital Bill of Rights (FDBR) · 2 controls

  • FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711)
  • FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

French Sapin II Law (Law No. 2016-1691) · 2 controls

  • Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques)
  • Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A)

ICAO Annex 17 - Aviation Security (AVSEC) · 2 controls

  • ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18)
  • ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain

IEC 62443 · 2 controls

  • IEC62443-07 Personnel risk assessment
  • IEC62443-24 Vulnerability assessment for critical systems

ISO/IEC 27003:2017 · 2 controls

  • ISO27003-6.1 Actions to address risks and opportunities
  • ISO27003-8.2 Information security risk assessment

ISO/IEC 27019:2024 · 2 controls

  • ISO27019-07 Personnel risk assessment
  • ISO27019-24 Vulnerability assessment for critical systems

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-1 Audit Planning, Scaling, Risk Assessment, and Integration
  • ASTWO-3 Entity-Level Controls and Period-End Financial Reporting Process

Russia Federal Law on Personal Data (152-FZ) · 2 controls

  • RUSPD-1 Scope, Definitions, Principles under 152-FZ
  • RUSPD-4 Special Categories, Biometric Data

SQF Code Edition 9 - Safe Quality Food · 2 controls

  • 2.4.4 Hazard Analysis and Risk Assessment
  • 2.7.2 Food Fraud Plan

Turkey KVKK · 2 controls

  • TURKEYKVKK-2 Information Notice and Data Subject Rights
  • TURKEYKVKK-3 Special Categories and Sensitive Data

UAE Virtual Asset Regulatory Authority (VARA) Regulations · 2 controls

  • CRM-1 AML/CFT Compliance
  • CRM-4 Business Risk Assessment

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • UKDEFSTD-1 Cyber Defence Cyber Risk Profile (CRP)

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 2 controls

  • CPSC-CS.3 Data Protection for Safety Systems
  • CPSC-RA.3 Lifecycle Risk Assessment

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 2 controls

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 2 controls

  • USMCADIGITAL-1 Cross-Border Data Flows and Localisation
  • USMCADIGITAL-2 Personal Information Protection and Consumer Protection

Vermont Data Privacy and Online Surveillance Act · 2 controls

  • VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency
  • VERMONTAICDA-4 Vermont AG Enforcement and Cure

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 2 controls

  • VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content)
  • VIETNAMCYBER-4 Incident Reporting and Cooperation

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-PartA-RiskAssess ML/TF Risk Assessment

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-11 Identification, Assessment and Management of Operational Risk

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-27 Outbound data loss prevention (Very Good)

ASIS SPC.1-2009 - Organizational Resilience Standard · 1 control

  • 4.3.1 Risk Assessment and Impact Analysis

Annex 11 to EU GMP - Computerised Systems · 1 control

Azure Security Benchmark · 1 control

  • DS-2 Ensure software supply chain security

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-3.C Strong and Agile Encryption

COSO Internal Control - Integrated Framework (2013) · 1 control

  • CA-10 Selects and Develops Control Activities

Connecticut Data Privacy Act (CTDPA) · 1 control

  • CTDPA-1 Definitions

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) · 1 control

FBI CJIS Security Policy · 1 control

  • CJIS-17 Risk Assessment

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 1 control

ISO 22313:2020 - Guidance on Business Continuity Management Systems · 1 control

  • ISO-22313-8.2 Business impact analysis and risk assessment

ISO 26000:2010 · 1 control

  • ISO-26000-6.7 Consumer issues

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

  • ISO-26262-3-7 Hazard analysis and risk assessment (HARA)

ISO/IEC 27031:2011 · 1 control

  • 27031-7.2 Resource Requirements

ISO/IEC 29147:2018 · 1 control

  • 29147-5.11 Researcher Safe Harbour and Legal Posture

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

Kuwait National Cybersecurity Framework · 1 control

NIST Privacy Framework · 1 control

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

OWASP Top 10 for LLM Applications 2025 · 1 control

  • OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02)

Regulation on the European Health Data Space (EHDS) · 1 control

  • EHDS-HOLD-3 Dataset Descriptions and Catalogues

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

  • RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out)

Singapore AI Governance Framework · 1 control

  • AIGF-1.3 Data Management

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 261 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Maryland Online Data Privacy Act of 2024 controls