Montana CDPA

Montana Consumer Data Privacy Act - controller obligations, consumer rights.


Short name	MT CDPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MT CDPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for MT CDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for MT CDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MT-CDPA-SEC` Data Security Practices	Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices suited to the volume and nature of the personal data; verifiable software integrity supports this obligation (Montana CDPA, controller-duties provision)	Scan
`MT-CDPA-MIN` Collection Limitation Accountability	Personal data collection is limited to what is adequate, relevant and reasonably necessary for disclosed purposes; the controller should be able to enumerate the software components that process consumer data to demonstrate this (Montana CDPA, controller-duties provision)	Scan
`MT-CDPA-PROC` Processor Contract Obligations	Processors must follow controller instructions under binding contracts and flow equivalent duties to subcontractors; each third-party processing component should be attributable to a named supplier (Montana CDPA, processor provisions)	Scan
`MT-CDPA-DPIA` Data Protection Assessment Readiness	Data protection assessments are required for heightened-risk processing including targeted advertising, sale, risky profiling and sensitive data; credible assessment requires recorded versions of the processing software (Montana CDPA, data protection assessment provisions)	Scan
`MT-CDPA-RIGHTS` Consumer Rights Fulfilment	Consumers may access, correct, delete and port their personal data and opt out of targeted advertising, sale and profiling, including via universal opt-out signals; those requests require unambiguous identification of the systems holding the data (Montana CDPA, consumer-rights provisions)	Scan
`MT-CDPA-NOTICE` Privacy Notice Documentation	Controllers must provide a reasonably accessible, clear and meaningful privacy notice; the supporting system documentation should itself carry document identity and a creation timestamp so disclosures stay auditable (Montana CDPA, transparency provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`MCA-30-14-1702`	Consumer Rights: Access, Correction, Deletion & Portability
`MCA-30-14-1703`	Opt-Out of Sale, Targeted Ads & Profiling
`MCA-30-14-1704`	Sensitive Data: Consent Requirement
`MCA-30-14-1705`	Data Protection Assessment
`MCA-30-14-1706`	Processor Agreements
`MCA-30-14-1701`	Privacy Notice Transparency
`MCA-30-14-1707`	Consumer Appeals Process
`MCA-30-14-1708`	Universal Opt-Out Signal Recognition

Policy templates

Written for MT CDPA:

Montana CDPA State Privacy Notice
Montana CDPA Consumer Rights Request Handling Procedure

And 22 from the standard set, adapted to MT CDPA.