Montana Consumer Data Privacy Act (MTCDPA)
Montana's legal framework applies to both consumers and businesses engaged in activities within the state involving the handling of personal data.
Is Complying with MTCDPA Mandatory?
The law applies to:
Any data controller that handles the personal data of at least 50,000 Montana residents, except for data used exclusively for payment transactions, falls under this law.
Controllers that manage personal data from at least 25,000 consumers and derive more than 25 percent of their revenue from selling personal data also must comply with the law.
What are the penalties for not complying with MTCDPA?
If the controller or any of their data processors remain in violation after the cure period or after submitting their statement, the Attorney General can initiate investigative actions.
Unlike many other state-level data privacy laws, the MTCDPA doesn't specify a particular dollar amount for fines or other statutory damages for breaking the law. It simply states that the Attorney General can take legal action.