Security Breach statute, duty to report breach of personal information

Mass. Gen. Laws ch. 93H, § 3

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A breach notification rule binding public and private bodies.

As of 28 August 2026.

What it requires

Notify the Massachusetts Attorney General, the Director of Consumer Affairs and Business Regulation, and each affected Massachusetts resident as soon as practicable and without unreasonable delay after learning of a breach of security involving personal information.
Do not rely on ch. 93H to cover a breach exposing only biometric data; its personal information definition does not reach biometric identifiers at all.

If you get it wrong

Private right of actionNo

Who enforces it

Enforcement body

Massachusetts Attorney General, who may bring an action under ch. 93A sec. 4 to remedy a violation of chapter 93H; this chapter's own enforcement clause (sec. 6) does not itself deem a violation actionable under ch. 93A sec. 9

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Massachusetts's Security Breach statute, Mass. Gen. Laws ch. 93H, first enacted 2007, requires a person or agency that owns or licenses data including a resident's personal information to notify the Attorney General, the Director of Consumer Affairs and Business Regulation, and the affected resident as soon as practicable and without unreasonable delay upon learning of a breach of security or unauthorized acquisition or use.

Personal information is a resident's name combined with a Social Security number, driver's license or state ID number, or financial account or card number, and excludes information lawfully obtained from publicly available sources or government records; it does not define or reach biometric data at all.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

official Massachusetts General Laws text, Massachusetts Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app