Massachusetts Data Breach Notification Law

The Massachusetts data breach notification law: three notices, no day count

Under Chapter 93H, the Massachusetts breach notification law, a business that owns or licenses personal information of a Massachusetts resident must notify three parties as soon as practicable and without unreasonable delay: the Attorney General, the OCABR Director and each affected resident ¹. There is no day count, but there is a rule other states lack. Notice may not be held back because the business has not yet worked out how many residents were affected ¹. Waiting for a complete list before sending anything is what the law rules out.

The covered data is broader than it first looks. Along with Social Security and driver's license numbers, Massachusetts counts a financial account number or a credit or debit card number with or without any required security code ². A leaked list of card numbers can trigger notice even without the codes.

Why a no-harm finding will not get you out of notice

Unlike many states, Massachusetts leaves little practical room to skip notice after deciding harm is unlikely. The definition of a breach includes a substantial risk of identity theft or fraud test ², but section 3(b) separately requires notice whenever the business knows or has reason to know that a resident's personal information was acquired or used by an unauthorized person or for an unauthorized purpose ¹. That second trigger has no harm test.

Some published summaries still list Massachusetts as a risk-of-harm state. Read on its own terms, the statute gives little room for that, so plan to notify once data was acquired and make any contrary call only with counsel.

Encryption is the one dependable exception. Data encrypted at 128-bit or higher is exempt, unless the confidential process or key was also acquired or used ².

What the notices must include, and what they must leave out

Massachusetts limits what goes in the resident letter. It may not describe the nature of the breach or say how many residents were affected ¹. A notice copied from another state's template can break this rule.

The report to the Attorney General and OCABR must say whether the business keeps a written information security program ¹³. OCABR then tells the business which consumer reporting agencies or state agencies to notify, instead of the statute setting a count ¹.

If Social Security numbers were exposed, the business must offer at least 18 months of free credit monitoring, or 42 months if the business is a consumer reporting agency, and may not make residents waive their right to sue to get it ⁴³. A vendor that holds data for another company must notify that company ¹.

Penalties, lawsuits and the WISP rule

The Attorney General enforces Chapter 93H through the consumer protection law, Chapter 93A, section 4, where the civil penalty is up to $5,000 per violation ⁵. Chapter 93H does not say whether residents can sue on their own, so that question is open and belongs with counsel.

Massachusetts also requires the security program the breach report asks about. Regulation 201 CMR 17.00 requires every business that owns or licenses personal information about a Massachusetts resident to develop, implement and maintain a comprehensive written information security program ⁶. Our written information security plan guide covers what goes in one. IC3's 2025 tally for Massachusetts was 22,936 complaints and about $411 million in reported losses ⁷.

Getting Massachusetts notices out quickly

While the attack continues, a Massachusetts business with cyber insurance alerts its carrier first, sends a report to the FBI's IC3, and keeps systems exactly as they are until evidence is collected ⁸⁹¹⁰.

Then:

• Have your IT company or an outside forensic team contain the attack; what incident response involves covers the roles and costs.
• Start the AG and OCABR report and the resident letters while forensics continue, since an incomplete count is no excuse for delay here.
• Group the people by home state. New Hampshire and Rhode Island residents carry their own laws, and all the other states are in our table.
• Line up credit monitoring if Social Security numbers were involved.
• Read your policy alongside the conditions insurers commonly set.

Businesses in Boston and Worcester can compare local IT support that includes breach response in our city guides.

Chapter 93H was compared with this summary on October 13, 2026. Nothing on the page is legal advice; Massachusetts counsel should confirm your obligations, including what your WISP must contain.