Massachusetts Data Breach Notification Law

M.G.L. c. 93H; 201 CMR 17.00

Massachusetts requires breach notification as expeditiously as possible and mandates that covered businesses maintain a Written Information Security Program (WISP). Any breach affecting Massachusetts residents — no matter how small — must be reported to both the AG and the state consumer protection agency.

⏱

Notification Deadline

As expeditiously as possible and without unreasonable delay

⚖️

Private Right of Action

No private right of action under the breach notification statute; AG and OCABR may bring civil action

💰

Statutory Damages

No fixed statutory damages under the breach notification statute (M.G.L. c. 93H). The AG may seek injunctive relief and civil penalties. Affected individuals may pursue common law claims (negligence, breach of contract). The AG may also act under M.G.L. c. 93A (Consumer Protection Act), which provides for double or triple damages for willful violations.

🏛

AG Notification Required

Yes

Must notify the AG and the Office of Consumer Affairs and Business Regulation (OCABR) whenever Massachusetts residents are affected — no minimum threshold

What This Law Covers

Massachusetts's breach notification law requires businesses and government agencies that maintain personal information about Massachusetts residents to notify affected individuals when that information is subject to unauthorized access or acquisition. "Personal information" typically includes Social Security numbers, driver's license numbers, financial account numbers, and in many states has been expanded to cover medical data, biometric data, online credentials, and tax IDs.

What the Company Must Tell You

A compliant breach notification to Massachusetts residents must include:

✓A description of the breach — what happened and when
✓The types of personal information that were involved
✓What the company is doing to investigate and contain the breach
✓Steps you can take to protect yourself (e.g., credit freeze, fraud alert)
✓Contact information so you can ask questions

Attorney General Notification

Companies that experience a breach affecting Massachusetts residents are required to notify the Massachusetts Attorney General in addition to the affected individuals.

Must notify the AG and the Office of Consumer Affairs and Business Regulation (OCABR) whenever Massachusetts residents are affected — no minimum threshold

Legal Disclaimer

This reference is for general educational purposes only and does not constitute legal advice. Last reviewed: 2025-01-01. Laws change frequently — always verify against the current official statute and consult a licensed attorney for advice specific to your situation.

📬

What to Do After a Breach Notification

Step-by-step actions to take when you receive a letter

⚖️

How Class Action Lawsuits Work

From filing to settlement — a plain-language guide

💵

Am I Entitled to Compensation?

Find out if you qualify and how to file a claim

📊

Settlement Amounts Explained

What victims actually receive and why payouts vary

Look up breaches affecting Massachusetts residents

Search our database for companies that filed breach notifications with the Massachusetts attorney general.

View Massachusetts Breaches →Search by Company Name

Legal Disclaimer

The information on this page is provided for general informational purposes only and does not constitute legal advice. Laws change frequently — always verify the current statute with the official state source or consult a licensed attorney in your jurisdiction before taking any action. This site is not a law firm and does not create an attorney-client relationship.

← Back to all state laws