Massachusetts. Breach notification. Act
MA breach lawMassachusetts data breach notification law (Mass. Gen. Laws ch. 93H; 201 CMR 17.00)
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Massachusetts residents to notify affected individuals after a security breach. Core timing rule: Individuals as soon as practicable. Covered data: name plus SSN, driver's licence/ID, financial account or card numbers.
- Key themes
- Unique features
Notices to residents must not disclose the nature of the breach or number affected; 18 months of free credit monitoring when SSNs are exposed; 201 CMR 17 imposes a written information security programme.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Massachusetts requires the maintaining entity to notify the owner as soon as practicable and cooperate, including disclosing remediation steps. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals as soon as practicable; AG and OCABR for every notifiable breach (no threshold); CRAs as directed
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $5,000 per violation under ch. 93A
§3Dates
- Key dates
- Adopted
- In force
- HB 4806 (2019, eff. 2019-04-11) added 18-month credit monitoring and notice-content rules
§4Text and authority
- Text
- Authoritative text malegislature.gov
- Authority
- Massachusetts Attorney General and Office of Consumer Affairs and Business Regulation
§5Where it applies
- Domestic law of
- Massachusetts
§6Sources and verification
- Sources consulted
- Verification
High confidence.