201 CMR 17.00

Who it applies to

Anyone who owns or licenses personal information about Massachusetts residents, wherever the business is located.

Key requirements

• A comprehensive written information security program appropriate to the size of the business and the data held.
• A designated employee to maintain the program, with training and disciplinary measures.
• Oversight of third-party service providers by contract.
• Encryption of personal information sent over public networks or wirelessly, and stored on laptops and portable devices, where technically feasible.
• Secure authentication, access controls, monitoring, up-to-date patching and malware protection.
• At least an annual review of the program's scope.

Breach and incident notification

Under Massachusetts' separate breach statute (M.G.L. c. 93H), notify the Attorney General, the consumer affairs office and affected residents as soon as practicable and without unreasonable delay.

Penalties

Enforced by the Massachusetts Attorney General through civil penalties under consumer protection law.

Go deeper