What does the Massachusetts data breach notification law require? The Massachusetts data breach notification law, Chapter 93H of the General Laws, requires a business that owns or licenses personal information about a Massachusetts resident to report a breach to the Attorney General, the Office of Consumer Affairs and Business Regulation, and the affected residents. Notice is due as soon as practicable and without unreasonable delay. The law also sets what each notice must say, and what the notice to residents must leave out.
Most owner-operators hear about this law for the first time in the middle of an incident. That is the worst time to learn it. The obligations are not complicated, but they move fast, and several of the decisions they force are much easier to make in advance.
This is a plain-language summary based on the state's own pages, not legal advice. If you think you've had a breach, call counsel first.
Who the law covers
The law covers any business that owns or licenses personal information about a Massachusetts resident. There is no size threshold and no minimum number of records. A 15-person firm with payroll files is covered in the same way as a large employer.
Personal information has a specific meaning here. It is a resident's first name or first initial and last name, combined with one of the following (Mass.gov):
- A Social Security number
- A driver's license or state-issued ID number
- A financial account number, or a credit or debit card number, that could permit access to the account
Information that can be legally obtained from public sources is not included.
The state describes a breach as unauthorized acquisition or use of this kind of information that creates a substantial risk of identity theft or fraud. It names hacking, ransomware and employee error, such as sending data to the wrong recipient, as common causes. Whether a specific incident meets that standard is a judgment call for you and your counsel, and it's the first one you'll have to make.
Owners and the vendors who hold your data
The law splits duties between two roles (Chapter 93H, Section 3).
- The owner or licensor is the business the data belongs to. It notifies the regulators and the residents.
- The maintainer is anyone who stores or handles the data without owning it: your payroll provider, your MSP, a cloud application, an outside bookkeeper. It must notify the owner and cooperate, including sharing when the breach happened, what happened and what it has done about it.
So a breach at a vendor is still your notification to make. That is worth checking in your contracts. Ask each vendor that holds employee or customer data how quickly they'll tell you, and who they'll tell.
Who must be notified, and what each notice says
| Recipient | Who sends it | What it must include |
|---|---|---|
| Attorney General | Owner | Nature of the incident, number of Massachusetts residents affected, steps taken and planned, whether you keep a written information security program |
| Office of Consumer Affairs and Business Regulation | Owner | The same information, plus a sample copy of the resident notice |
| Affected residents | Owner | Right to a police report, how to request a free security freeze, any credit monitoring offered, the name of any parent or affiliated company |
| The data owner | Vendor or maintainer | When the breach happened, its nature, steps taken or planned |
Two details catch businesses out.
First, the resident notice must not describe the nature of the breach or the number of residents affected. It's an unusual rule, and a letter drafted from a generic template often breaks it.
Second, the regulators ask whether you maintain a written information security program and whether you've updated it. Massachusetts requires one under 201 CMR 17.00, and the breach report is where its absence shows. We cover what that program needs in 201 CMR 17.00, a plain guide.
OCABR accepts reports through an online form, by email or by mail to 1 Federal Street in Boston (OCABR). The Attorney General's Office must receive a report as well.
Timing: no fixed number of days
The law doesn't give you 30 or 60 days. It requires notice as soon as practicable and without unreasonable delay once you know, or have reason to know, of a breach.
The state is also clear that you can't wait for the full count. Notices to residents can go out on a rolling basis as more facts come in, and the filing with the regulators should not be held until the number of affected residents is known (Mass.gov FAQ). These rules reflect amendments that took effect on April 10, 2019.
Credit monitoring when Social Security numbers are involved
If a breach exposes Social Security numbers, the business must offer free credit monitoring for 18 months through a third-party vendor. Consumer reporting agencies must offer at least 42 months. The business also files a certification with the Attorney General and OCABR that its monitoring meets the statute, which can go in with the breach notice.
You can't make monitoring conditional on the resident waiving the right to sue. If no Social Security numbers were involved, monitoring isn't required, though you may still choose to offer it.
What to have ready before anything happens
Most of the cost of a breach response is time spent deciding things under pressure. Settle these now.
- Know where the data lives. List every system and vendor that holds Social Security numbers, license numbers or account numbers, including old exports and shared drives.
- Name an owner. One person decides whether an incident is a breach and starts the clock. Write down their backup.
- Have counsel and a forensics contact lined up. Many cyber insurance policies require you to use their panel. Check yours, because calling the wrong firm first can affect coverage. Our cyber insurance requirements guide covers what carriers are asking.
- Check vendor contracts. Look for breach notice timing, cooperation duties and who pays for notification.
- Keep a current written security program. It's required anyway, and the breach report will ask.
- Draft the resident letter in advance. Include the required items, leave out the forbidden ones, and have counsel approve the template.
- Bookmark the reporting routes. Keep the OCABR form and the Attorney General's reporting page in your incident plan.
Where The Deady Group fits
We're an independent technology advisory in Boston. We don't sell forensics or legal services. We help owner-operators find where personal information sits, which vendors hold it, and whether their contracts and security program would hold up in a breach report. If you'd like an outside view of where your business stands, start with the free Digital Presence & Technology Review.
Questions, answered plainly
How long does a Massachusetts business have to report a data breach? The law does not set a fixed number of days. It requires notice as soon as practicable and without unreasonable delay once the business knows, or has reason to know, of a breach. Waiting until the full count of affected residents is known is not a reason to delay.
Does the law apply if our vendor had the breach? Yes. A vendor that stores or maintains data it does not own must notify the business that owns it. The owner is then responsible for notifying the Attorney General, the Office of Consumer Affairs and Business Regulation, and affected residents.
Do we have to offer credit monitoring? Only if Social Security numbers were involved. In that case the business must offer free credit monitoring for 18 months through a third-party vendor, and certify to the state that it did. Residents cannot be asked to give up their right to sue as a condition of receiving it.
Is a small business covered? Yes. The law has no size threshold. Any business that owns or licenses personal information about a Massachusetts resident is covered, and employee records count.
