Law / United States / 
Massachusetts
Standards for the Protection of Personal Information of Residents of the Commonwealth
In force since .
A security baseline statutes rule binding private bodies.
- Obligation class
- Security
What it requires
- This binds any person that owns or licenses personal information about a Massachusetts resident, meaning any person or business that receives, stores, maintains, processes, or otherwise has access to it in connection with providing goods or services or in connection with employment; it reaches a business outside Massachusetts that holds a Massachusetts resident's personal information the same as one located here.
- Develop, implement, and maintain a comprehensive written information security program (WISP), in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size, scope, resources, amount of stored data, and the sensitivity of the personal information you hold.NIST CSF 2.0GV.PO-01
- Designate one or more employees to maintain the WISP; identify and assess foreseeable internal and external risks to personal information and evaluate whether your safeguards limit them; train employees; discipline violations; cut off a terminated employee's access to records; restrict and secure physical access to records; review the WISP's scope at least annually or after a material change in business practice; document your response to any security-breach incident; and select only third-party service providers capable of maintaining appropriate security measures, requiring those measures by contract.NIST CSF 2.0GV.RR-02NIST CSF 2.0ID.RA-05NIST CSF 2.0GV.SC-05
- For personal information you store or transmit electronically, build a computer-system security program with secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewalls and operating-system security patches for any internet-connected system, up-to-date malware protection, and employee training on the security system.NIST CSF 2.0PR.AA-05NIST CSF 2.0PR.DS-02NIST CSF 2.0PR.DS-01
- There is no compliance runway left to build against: every covered person has been required to be in full compliance since .
These lines are LexLint's reading of the law's text. Also read by: Office of Consumer Affairs and Business Regulation (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- PR.AA-05Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
1 more
- PR.DS-02The confidentiality, integrity, and availability of data-in-transit are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
M.G.L. ch. 93H, section 6 gives the Attorney General authority to bring an action under ch. 93A, section 4 to remedy a violation of chapter 93H, which this regulation implements. Ch. 93A, section 4 caps the civil penalty the court may impose at $5,000 for each violation the court finds a person knew or should have known violated ch. 93A, section 2, plus investigation and litigation costs including attorney's fees; a further civil penalty of up to $10,000 per violation applies to violating an injunction or order issued under section 4. 940 CMR 3.16(3) routes a violation of this regulation into that mechanism by deeming it a section 2 violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Statutory damages
Ch. 93A, section 9(3): a private plaintiff recovers actual damages or $25, whichever is greater, trebled (or at minimum doubled) for a willful or knowing violation, plus attorney's fees and costs under section 9(4). Section 9(2) permits a class action for similarly injured persons. This route is opened by 940 CMR 3.16(3), which deems a failure to comply with a regulation meant to protect Massachusetts consumers, including this one, a ch. 93A, section 2 violation; ch. 93H, section 6 and this regulation carry no private-right-of-action language of their own. This row carries no private right of action: neither ch. 93H nor this regulation grants one, and the sums above reach a plaintiff only if 940 CMR 3.16(3), a general rule, brings a violation of this regulation within ch. 93A, section 2.
- As of
- Currency
- USD
- Per person minimum
- 25
- Class action available
- Yes
Who enforces it
Enforcement body
M.G.L. ch. 93H, section 6 authorizes the Attorney General to bring an action under ch. 93A, section 4 to remedy a violation of chapter 93H, which this regulation implements. Neither chapter 93H nor this regulation names a private plaintiff; 940 CMR 3.16(3) is a general rule that treats a failure to comply with a statute or regulation meant to protect Massachusetts consumers as a ch. 93A, section 2 violation.
Settledness
The Office of Consumer Affairs and Business Regulation, which issued the regulation, publishes a compliance checklist for small businesses that states it is not a substitute for compliance with 201 CMR 17.00.
- As of
- Guidance link
- https://www.mass.gov/info-details/requirements-for-data-breach-notifications
- Guidance body
- Office of Consumer Affairs and Business Regulation
- Open questions
- Does a business that only "otherwise has access to personal information" in connection with providing goods or services, without storing it, own or license that information within the definition of "Owns or Licenses" in 201 CMR 17.02, or is it bound only through the contract that 201 CMR 17.03(2)(f)2 requires a covered person to impose on its service providers?
- How is a business to measure "the size, scope and type of business" and "the amount of resources available" under 201 CMR 17.03(1)(a) and (b) when deciding which safeguards are "appropriate" for its written information security program?
What this law does
Every person that owns or licenses personal information about a Massachusetts resident, meaning anyone who receives, stores, maintains, processes, or otherwise has access to it in connection with providing goods or services or in connection with employment, must develop, implement, and maintain a comprehensive written information security program (WISP) with administrative, technical, and physical safeguards appropriate to the business's size, scope, resources, amount of stored data, and the need for security and confidentiality of both consumer and employee information.
The WISP must designate one or more employees to maintain it, identify and assess reasonably foreseeable internal and external risks and evaluate the effectiveness of current safeguards, train employees, impose discipline for violations, cut off a terminated employee's access to records containing personal information, restrict and secure physical access to and storage of records, monitor the program's operation, and review its scope at least annually or after a material change in business practice.
It must also document the entity's response to any security-breach incident and oversee third-party service providers by taking reasonable steps to select and retain only ones capable of maintaining appropriate security measures and requiring those measures by contract.
Where personal information is stored or transmitted electronically, 17.04 adds a computer-system security program: secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewall protection and operating-system security patches for a system connected to the internet, up-to-date malware protection, and employee training on the security system.
The regulation was promulgated by the Office of Consumer Affairs and Business Regulation under the rulemaking authority M.G.L. ch. 93H, section 2(a) grants it. It required full compliance by every covered person on or before (17.05). Ch. 93H, section 6 gives the Attorney General authority to bring an action under ch. 93A, section 4 to remedy a violation of chapter 93H, which this regulation implements (17.01(1)).
Separately, 940 CMR 3.16(3) deems a failure to comply with a statute or regulation meant to protect the public and intended to provide Massachusetts consumers protection a ch. 93A, section 2 unfair or deceptive practice; chapter 93H and this regulation grant a private person no cause of action of their own.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .