Massachusetts Data Breach Notification Requirements

Massachusetts data breach notification requirements under Chapter 93H include a step most companies do not expect: the notice to the Attorney General must state whether you maintain a written information security program. Notices also go to affected residents and the Office of Consumer Affairs, and a breach involving Social Security numbers requires offering 18 months of free credit monitoring.

This is the Massachusetts-specific step inside what happens when you get hacked: a realistic timeline. That piece walks through the first hours and weeks of an incident. This one covers the notifications Massachusetts law attaches to them.

What triggers Massachusetts data breach notification?

A breach of security under Chapter 93H is the unauthorized acquisition or use of unencrypted data, or of encrypted data together with the key, that creates a substantial risk of identity theft or fraud against a Massachusetts resident. Good-faith acquisition by an employee or agent for a lawful purpose is not a breach if the data is not misused or further disclosed.

The data in question is the same personal information defined in 201 CMR 17.00: a name combined with a Social Security number, a driver's license or state ID number, or a financial account or card number. The requirements are set out on mass.gov under requirements for data breach notifications.

Encryption matters here. Data that was properly encrypted, without the key also being compromised, generally falls outside the trigger. That is one of the most concrete returns on the controls covered in Massachusetts WISP requirements.

Who has to be notified, and when?

Affected Massachusetts residents, the Attorney General, and the Office of Consumer Affairs and Business Regulation. Massachusetts sets no fixed number of days. The standard is as soon as practicable and without unreasonable delay.

If 1,000 or more Massachusetts residents are affected, the nationwide consumer reporting agencies must also be notified. The Attorney General's office describes the regulator filing process on its page on reporting data breaches.

"Without unreasonable delay" is not an open-ended window. The practical constraint is how quickly you can establish what happened and to whom, which depends almost entirely on logging and records that had to exist before the incident.

What must the notice to the Attorney General say?

The regulator notice must describe the nature of the breach, the number of Massachusetts residents affected, and the steps taken or planned. Since the 2018 amendments, effective April 10, 2019, it must also state the type of personal information compromised, whether the business is the owner or licensee of the data, and whether the business maintains a written information security program.

That last item is the one to plan for now. If you have no WISP, you are disclosing that in writing to the state's chief law enforcement officer in the same filing that reports the breach. The 2018 changes are summarized well by ArentFox Schiff.

What must the notice to residents say, and not say?

The resident notice must explain the right to obtain a police report, how to request a security freeze, and information about credit monitoring where it applies. It must also identify any parent or affiliated corporation of the business.

Here is the counterintuitive part: the resident notice must not include the nature of the breach or the number of Massachusetts residents affected. That is the reverse of the regulator notice, and the reverse of what most people would draft by instinct. A notice template written for another state can violate this rule.

When is credit monitoring required?

When a breach involves Social Security numbers, Chapter 93H section 3A requires offering affected residents free credit monitoring for at least 18 months, or 42 months for consumer reporting agencies. A business may not require a resident to waive the right to sue as a condition of receiving it.

That obligation has a cost that scales directly with the number of affected people, which is part of the arithmetic in what a data breach costs a Massachusetts company.

Who should own the notification process?

One named person, decided before anything happens. During an incident, notification sits between legal counsel, technical responders, insurance, leadership, and whoever handles customer communication. When nobody owns it, each assumes another does, and the "without unreasonable delay" clock keeps running while the decision gets made.

The owner does not need to draft every notice. They need to know the three Massachusetts audiences, the content rules that differ between them, the 1,000-resident threshold for consumer reporting agencies, and the 18-month credit monitoring obligation. That knowledge fits on one page. Writing that page now, and attaching it to the WISP, turns a scramble into a checklist.

What should be in place before anything happens?

The fastest notification is one where the facts are already knowable. That means logs that show what was accessed, a current list of where personal information lives, contact details for affected people, and a decided owner for the process. It also means knowing in advance which outside providers you would call, which is covered in how to talk to your insurance company about cyber coverage.

Insurance timing interacts with this too. Many cyber policies have their own notice requirements, and missing them is one of the reasons laid out in why cyber insurance claims get denied.

We build systems at Kief Studio in Worcester and Shrewsbury so that the records an incident response needs already exist. Incident response itself is Brian Gagne's domain, and briansgagne.com covers it in technical depth. This is general information, not legal advice, and an actual breach calls for counsel.

Related reading

• What happens when you get hacked: a realistic timeline
• Massachusetts WISP requirements
• What a data breach costs a Massachusetts company
• Why cyber insurance claims get denied
• How to talk to your insurance company about cyber coverage

Frequently Asked Questions

How long do you have to report a data breach in Massachusetts?

Massachusetts sets no fixed number of days. Notice must be given as soon as practicable and without unreasonable delay to affected residents, the Attorney General, and the Office of Consumer Affairs and Business Regulation.

Does a Massachusetts breach notice have to mention a WISP?

Yes. The notice to the Attorney General and the Office of Consumer Affairs must state whether the business maintains a written information security program, along with the type of information compromised and whether the business owns or licenses the data.

What should a Massachusetts breach notice to residents not include?

The resident notice must not state the nature of the breach or the number of Massachusetts residents affected. It must include information on police reports, security freezes, and any credit monitoring offered.

When is credit monitoring required after a Massachusetts breach?

When Social Security numbers are involved, the business must offer at least 18 months of free credit monitoring, or 42 months for consumer reporting agencies, without requiring a waiver of the right to sue.

Do you have to notify credit bureaus after a breach in Massachusetts?

When 1,000 or more Massachusetts residents are affected, the nationwide consumer reporting agencies must also be notified.