United States law applies in MassachusettsMassachusetts is a state of the United States, whose 134 researched instruments are listed on the United States page, not here. The law of Massachusetts, described on this page below, applies here too.
29 of 35 named instruments researched to a stage, across six of the ten areas of law we track: 22 in force and 7 proposed. As of .
When each starts6 of 29 carry a date, 23 do not. Earlier is before 2014.
in forcenot yet in forceblocked by a courtproposedno longer in force
Massachusetts has not enacted a general-purpose AI-transparency or disclosure statute.
The Attorney General's April 2024 advisory takes the position that existing consumer-protection law (chapter 93A), civil-rights statutes, and the data-security regulation at 201 CMR 17.00 already reach deceptive, discriminatory, or insecure uses of AI; because the duty in each case attaches to consumer protection or data security generally rather than to an AI system specifically, none of those instruments is catalogued here as an AI-specific finding.
Two bills targeting AI in elections passed the House on and are pending before the Senate Committee on Ways and Means: one bans distributing deceptive AI-generated or manipulated media about a candidate or an election within 90 days of that election, and the other requires that AI-generated synthetic media used in political advertising disclose that fact at the start and end of the communication.
Other AI bills remain earlier in the process: a consumer-chatbot-protection bill (S.264) was reported favorably by its Senate committee in December 2025 and now sits in Senate Ways and Means; a general AI-disclosure bill (H.81) was sent to a study order in February 2026, which in Massachusetts practice ends its progress for this session without further action; and bills addressing AI in behavioral-health utilization review (S.2632) and algorithmic non-discrimination (SD.3007/HD.4827) have not been confirmed past initial committee referral. None of the four is catalogued here as an instrument.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds private bodies.
What this law does
The Senate's version of House bill 5576, an economic development bill, would insert a new chapter 93M, the Transparency in Frontier Artificial Intelligence Act, into the General Laws. A frontier developer is a person that has trained, or begun training, a foundation model using more than 10^26 integer or floating-point operations of computing power. A large frontier developer is a frontier developer that together with its affiliates has annual gross revenues above $500,000,000.
A large frontier developer would have to write, implement, comply with, and publish a frontier AI framework describing how it assesses and mitigates catastrophic risk. It would also have to review and update the framework at least annually. Before or concurrently with deploying a new or substantially modified frontier model, a frontier developer would have to publish a transparency report. A large frontier developer would add summaries of its catastrophic risk assessments to the report.
A frontier developer would have to report a critical safety incident to the attorney general within 15 days of discovering it. It would have to disclose an incident that poses an imminent risk of death or serious physical injury within 24 hours to an appropriate authority. A large frontier developer that fails to comply would face a civil penalty of up to $1,000,000 for a first violation and up to $3,000,000 for later ones. Only the attorney general could recover the penalty, in a civil action.
The Senate passed the bill as amended on . On the House did not concur in the Senate amendment. A committee of conference was appointed the same day.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
This bill has not been enacted, so read the following as what it would require rather than a current duty.
As passed by the House, it would prohibit distributing deceptive audio or visual media within 90 days of an election, covering media depicting a candidate with intent to injure their reputation or deceive a voter, media intended to disrupt the safety or regular operation of an election, and media intended to mislead voters about voting dates, methods, or deadlines, election certification, or a false endorsement.
A candidate whose voice or likeness appears in such media may seek injunctive relief or bring an action for damages and attorney's fees against the distributing party. Exemptions cover media outlets that air or report on the content while acknowledging authenticity questions, websites, newspapers, magazines and periodicals, and satire and parody. Originally filed as H.76, the House Committee on Ways and Means reported a new draft as H.5093.
The redraft passed the House 154 to 3 on . It was then referred to the Senate Committee on Ways and Means on .
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds public and private bodies.
What this law does
This bill has not been enacted, so read the following as what it would require rather than a current duty. As passed by the House, any synthetic media audio or video communication intended to influence voting for or against a candidate or a ballot proposition would have to disclose, at the beginning and the end of the communication, that it contains AI-generated material. A violation would be punishable by a fine of not more than $1,000.
Originally filed as H.846, the House Committee on Ways and Means reported a new draft as H.5094. The redraft passed the House 157 to 0 on . It was then referred to the Senate Committee on Ways and Means on .
Privacy law16 instruments, 14 in force, 2 proposed
Research summary (577 words)
Massachusetts has no comprehensive consumer-privacy statute in force. The Massachusetts Data Privacy Act (MDPA), which would establish one, passed the Senate 40-0 as S.2608/S.2619 and the House 146-0 in an amended form (H.5472, republished as H.5479), but the Senate non-concurred in the House amendment on and the bill remains in a conference committee with no compromise text produced. Massachusetts's general privacy law is a security-breach statute, Mass.
Gen. Laws ch. 93H, and its implementing regulation, 201 CMR 17.00, neither of which defines or reaches biometric data at all.
Chapter 93H's own enforcement clause arms only the Attorney General, but a private right of action for a ch. 93H or 201 CMR 17.00 violation opens through a separate, third instrument: 940 CMR 3.16(3), an Attorney General consumer-protection regulation issued under ch. 93A's own rulemaking power, deems a failure to comply with a consumer-protection statute or regulation an unfair or deceptive act under ch. 93A section 2, which ch. 93A section 9 then arms a private plaintiff to sue on for damages, trebled if knowing, plus attorney fees.
Section 70G of chapter 111 of the Massachusetts General Laws bars a facility, physician or health care provider from testing a person for genetic information without first obtaining the person's prior written consent. Chapter 175I of the Massachusetts General Laws requires an insurance institution or insurance representative to give applicants or policyholders a notice of information practices in connection with insurance transactions.
Section 120E of chapter 175 of the Massachusetts General Laws bars an insurer, agent or broker authorized to issue policies on the lives of persons in the commonwealth from requiring an applicant to undergo a genetic test as a condition of the issuance or renewal of a policy.
Section 4, paragraph 19 of chapter 151B of the Massachusetts General Laws makes it unlawful discrimination for an employer, employment agency, labor organization or licensing agency to collect, solicit or require disclosure of genetic information from any person as a condition of employment.
Section 70F of chapter 111 of the Massachusetts General Laws bars a facility, physician or health care provider from testing a person for the HIV antibody or antigen without first obtaining that person's verbal informed consent. Section 70 of chapter 111 of the Massachusetts General Laws provides that a hospital or clinic's treatment records may be inspected by the patient to whom they relate.
Section 24 of chapter 176G of the Massachusetts General Laws bars a health maintenance organization subject to that chapter, and its officer or agent, from requiring genetic tests or private genetic information as a condition of issuing or renewing a health maintenance contract.
Section 4A of chapter 176I of the Massachusetts General Laws bars an organization and a preferred provider from requiring genetic tests or private genetic information as a condition of issuing or renewing a health benefit plan.
Section 106 of chapter 93 of the Massachusetts General Laws bars a person engaged in the business of leasing or renting videos, or an employee of one, from making available to a third party records that would indicate the name of the borrower or the title or category of any video leased or rented by a borrower, except under a proceeding authorized by federal law.
Section 14 of chapter 167B of the Massachusetts General Laws provides that the consumer's United States Social Security number shall not be used as a central information file number, personal identification number or primary financial account number.
If a resident's Social Security number was disclosed or reasonably believed disclosed in a breach, the person or agency that experienced the breach must contract with a third party to offer that resident credit monitoring services at no cost for not less than 18 months. If the entity that experienced the breach is itself a consumer reporting agency, it must instead offer not less than 42 months of free credit monitoring.
The entity may not require a resident to waive any right to a private right of action as a condition of the credit-monitoring offer. Section 3A was added by chapter 444 of the Acts of 2018, approved . The Office of Consumer Affairs and Business Regulation states that the act takes effect 90 days later, on .
Massachusetts's Security Breach statute, Mass. Gen. Laws ch. 93H, first enacted 2007, requires a person or agency that owns or licenses data including a resident's personal information to notify the Attorney General, the Director of Consumer Affairs and Business Regulation, and the affected resident as soon as practicable and without unreasonable delay upon learning of a breach of security or unauthorized acquisition or use.
Personal information is a resident's name combined with a Social Security number, driver's license or state ID number, or financial account or card number, and excludes information lawfully obtained from publicly available sources or government records; it does not define or reach biometric data at all. Chapter 93H was added by chapter 82 of the Acts of 2007, approved .
The Office of Consumer Affairs and Business Regulation states that the chapter has been in effect since .
Proposed.proposed Not law. It binds no one unless it is enacted.
In reconciliation between two chambers, dated , as of .Binds private bodies.
What this law does
The Massachusetts Data Privacy Act (MDPA) would establish the state's first comprehensive consumer personal-data regime; it is not enacted and imposes no duty today. Originally S.2608, it passed the Senate 40-0 on , was engrossed as S.2619, and was amended by the House (Ways and Means reported a substitute striking the text and inserting H.5472, itself amended and republished as H.5479) before passing the House 146-0 on .
The Senate non-concurred in the House amendment on and appointed a conference committee; the House insisted on its own amendment and appointed its own conferees on . As of the date shown, the bill remains in conference with no compromise text produced.
Section 70 of chapter 111 requires a hospital or clinic subject to licensure by the department of public health, or supported in whole or in part by the commonwealth, to keep records of the treatment of the cases under its care, including the medical history and nurses' notes. Section 70 provides that such records may be inspected by the patient to whom they relate, except in a hospital or clinic under the control of the department of mental health.
Section 70 limits the reasonable fee for a copy of a hospital or clinic medical record to a base charge of not more than $15 for each request, not more than $0.50 per page for each of the first 100 pages copied and not more than $0.25 per page for each page in excess of 100 pages. Section 70 provides that the reasonable fee may be adjusted so that the base amount and the per page charge are increased by the proportional consumer price index for medical care services.
Section 70 allows a hospital or clinic to destroy records only after the applicable retention period has elapsed and after notifying the department of public health that the records will be destroyed. Section 70 requires a hospital or clinic to provide, on the notice of privacy practices distributed to its patients, information concerning the provisions of the section and its records termination policy.
Section 70 requires a health care provider to furnish a health record requested for a claim or appeal under the Social Security Act or a federal or state financial needs-based benefit program within thirty days of the request. The codified text carries no history note, and no day on which the section came into force has been located.
Chapter 175I applies to an insurance institution, insurance representative or insurance-support organization that, in the case of life, health and disability insurance, collects, receives or maintains information in connection with an insurance transaction about a natural person who is a resident of the commonwealth, or engages in an insurance transaction with an applicant, individual or policyholder who is a resident.
Section 2 of chapter 175I defines an insurance institution as any corporation, association, partnership, reciprocal exchange, inter-insurer, Lloyd's insurer, fraternal benefit society or other person engaged in the business of insurance. Section 4 of chapter 175I requires an insurance institution or insurance representative to give applicants or policyholders a notice of information practices in connection with insurance transactions.
Section 8 of chapter 175I requires an insurance institution, insurance representative or insurance-support organization to respond to a written request for access to recorded personal information within thirty business days. Section 9 of chapter 175I requires an insurance institution, insurance representative or insurance-support organization to correct, amend or delete, or reinvestigate, disputed recorded personal information within thirty business days of a written request.
Section 10 of chapter 175I requires the insurance institution or insurance representative responsible for an adverse underwriting decision to give the specific reason in writing or to advise that the person may receive it on written request.
Section 13 of chapter 175I bars an insurance institution, insurance representative or insurance-support organization from disclosing personal or privileged information collected in connection with an insurance transaction unless the disclosure falls within the exceptions the section lists, the first being the individual's written authorization.
Section 18(a) of chapter 175I lets the commissioner order a penalty of not more than one thousand dollars for each knowing violation, with aggregate limits of ten thousand dollars for an insurance representative and fifty thousand dollars for an insurance institution or insurance-support organization.
Section 18(b) of chapter 175I sets fines of up to ten thousand dollars for each violation of a cease and desist order, and up to fifty thousand dollars where the violations amount to a general business practice. Section 20(a) of chapter 175I lets a person whose rights under sections 8, 9 or 10 are violated apply to the superior court for equitable relief.
Section 20(b) of chapter 175I makes an insurance institution, insurance representative or insurance-support organization that discloses information in violation of section 13 liable for special and compensatory damages. Section 20(e) of chapter 175I leaves an individual no other remedy or recovery in law or in equity for a violation of the chapter.
Section 22 of chapter 175I punishes knowingly and willfully obtaining information about an individual from an insurance institution, insurance representative or insurance-support organization under false pretenses by a fine of not more than ten thousand dollars or imprisonment for not more than one year, or both. The codified text carries no history note, and no day on which the chapter came into force has been located.
Mass. S.2619 (Senate text of S.2608 as amended) proposed G.L. c. 93M, s. 4(a)(vi)(C) and (b); House amendment H.5479, s. 4(a)(6)(iii), 194th Gen. Ct.official Massachusetts Legislature bill texts, malegislature.gov
Proposed.proposed Not law. It binds no one unless it is enacted.
In reconciliation between two chambers, dated , as of .
What this law does
As the Senate passed it, proposed chapter 93M section 4(a)(vi)(C) gives a consumer the right to opt out of the collection and processing of the consumer's personal data for profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
The House amendment, H.5479, section 4(a)(6)(iii), likewise lets a consumer opt out of the collection and processing of their personal data for profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
In the Senate text, section 4(b)(1) gives a consumer whose personal data is profiled in furtherance of a decision that produces legal or similarly significant effects the right to question the result of the profiling, to be informed of the reason it resulted in the decision, to be informed of the actions the consumer might have taken to secure a different decision and, where feasible, might take to secure one in the future, and to review the personal data used in the profiling.
In the Senate text, section 4(b)(2) gives a consumer whose decision is determined to have been based upon inaccurate personal data the right to have the data corrected and the profiling decision reevaluated based upon the corrected data.
A private right of action for a Massachusetts data-security violation opens through a separate Attorney General consumer-protection regulation, not through ch. 93H or 201 CMR 17.00 directly.
940 CMR 3.16, promulgated under ch. 93A section 2(c), provides that an act or practice violates ch. 93A section 2 if, among other things, it fails to comply with an existing statute, rule, or regulation meant for the protection of the public's health, safety, or welfare and intended to provide Massachusetts consumers protection.
A failure to comply with ch. 93H's breach-notice duty or 201 CMR 17.00's WISP mandate is therefore a ch. 93A section 2 violation, which ch. 93A section 9 arms any injured person to sue on for damages, trebled if the violation was knowing, plus attorney fees. Chapter 93H section 6 alone does not open this route; the mechanism is entirely this separate regulation. The regulation text carries no history note, and no day on which 940 CMR 3.16(3) came into force has been located.
Chapter 93H's own enforcement clause lets the Attorney General bring an action under ch. 93A section 4 to remedy a violation. On its own face, this section creates no private right of action: it does not deem a ch. 93H violation to be an unfair or deceptive practice actionable by a private plaintiff under ch. 93A section 9. A private right of action for a ch. 93H violation exists only through a separate Attorney General regulation, 940 CMR 3.16(3).
Chapter 93H was added by chapter 82 of the Acts of 2007, approved . The Office of Consumer Affairs and Business Regulation states that the chapter has been in effect since .
Section 14 of chapter 167B provides that the consumer's United States Social Security number shall not be used as a central information file number, personal identification number, primary financial account number, or a subpart thereof. Section 14 of chapter 167B provides that the Social Security number shall not be used to electronically identify the consumer to any financial institution or organization, though it may be used to assist in verifying the identity of a consumer.
Section 1 of chapter 167B defines a financial institution as any person who directly or indirectly holds an account belonging to a consumer or issues an access device and agrees with a consumer to provide electronic fund transfer services, subject to the exclusions that definition lists.
Section 20 of chapter 167B makes any person who fails to comply with any provision of the chapter with respect to a consumer liable for actual damage and, in an individual action, an amount of not less than $100 nor greater than $1,000, with costs and a reasonable attorney's fee. Section 21(a) of chapter 167B punishes whoever knowingly and willfully fails to comply with any provision of the chapter by a fine of not more than $5,000 or imprisonment for not more than one year, or both.
Section 22(a) of chapter 167B lets the commissioner request the attorney general to bring an action to restrain a violation of the chapter. Section 22(b) of chapter 167B subjects a person who violates the terms of an injunction or order issued under that section to a civil penalty of not more than $10,000 for each violation. The codified text carries no history note, and no day on which the section came into force has been located.
Section 4, paragraph 19 of chapter 151B makes it unlawful discrimination for an employer, employment agency, labor organization or licensing agency to take any of eight listed actions concerning a person's genetic information, among them collecting, soliciting or requiring disclosure of genetic information, requiring or administering a genetic test, and inquiring about a person's family members' genetic information.
Section 1 of chapter 151B includes the commonwealth and all political subdivisions, boards, departments and commissions thereof in the term employer, and whether another employer is covered turns on the scale test in that section.
Section 5 of chapter 151B lets the commission assess a civil penalty of up to $10,000 on a respondent found to have engaged in an unlawful practice, up to $25,000 where one prior discriminatory practice was adjudged in the previous five years, and up to $50,000 where two or more were adjudged in the previous seven years.
Section 9 of chapter 151B lets a person aggrieved by a practice made unlawful under the chapter bring a civil action for damages or injunctive relief, or both, in superior or probate court after ninety days from filing a complaint with the commission. Section 9 of chapter 151B lets a court that finds for the petitioner award actual and punitive damages.
Section 23A of the 2000 act relative to insurance and genetic testing and privacy protection added paragraph 19 to section 4 of chapter 151B. The 2000 act was approved on . Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day it took effect.
Section 70G of chapter 111 bars a facility, physician or health care provider from testing a person for genetic information without first obtaining the person's prior written consent. Section 70G bars a facility, physician or health care provider from disclosing the results of a genetic test to anyone other than the person tested without informed written consent, except where the results disclosed will be used only as confidential research information.
Section 70G(b) names a commercial genetic testing company among the holders whose reports and records pertaining to any genetic information may not be divulged by a person having charge of or access to them without informed written consent, subject to the exceptions that subsection lists. Section 70G allows a laboratory to conduct a requested genetic test only when the request carries the ordering practitioner's signed statement that the appropriate prior written consent has been obtained.
Section 70G(d) deems a violation of the section a violation of section 2 of chapter 93A. Section 70G(d) lets a person whose rights under the section are violated, and the Attorney General, bring a civil action for injunctive and other equitable relief. Section 70G does not apply to a law enforcement official in the execution of official duties, among the exclusions subsection (e) lists.
Section 70E defines facility, the term section 70G uses, to include any hospital or clinic licensed or subject to licensing by the department and any state hospital operated by the department. The 2000 act relative to insurance and genetic testing and privacy protection inserted section 70G into chapter 111 after section 70F. The 2000 act was approved on .
Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day it took effect.
Section 70F of chapter 111 bars a facility, physician or health care provider from testing a person for the HIV antibody or antigen without first obtaining that person's verbal informed consent, from disclosing the results to anyone other than the subject without the subject's written informed consent, and from identifying the subject of the tests to anyone without that written consent.
Section 70F provides that no employer shall require HIV antibody or antigen tests as a condition for employment. Section 70F provides that whoever violates the section shall be considered to have violated section 2 of chapter 93A. Section 70F provides that reporting information to the department of public health under chapter 111 or chapter 111D is not a violation of the section.
Section 70E defines facility, the term section 70F uses, to include any hospital or clinic licensed or subject to licensing by the department and any state hospital operated by the department. The codified text carries no history note, and no day on which the section came into force has been located.
Section 108H of chapter 175 bars a company, its officer or agent, and an insurance broker from cancelling, refusing to issue or renew, or discriminating in premiums, length of coverage or other terms of an individual or group accident and sickness policy that provides hospital and surgical expense insurance, based on genetic information.
Section 108H bars a company, its officer or agent, and an insurance broker from requiring genetic tests or genetic information as a condition of issuing or renewing such a policy. Section 108I(b) of chapter 175 bars an insurer, agent or broker authorized to issue disability or long term care policies in the commonwealth from practicing unfair discrimination because of the results of a genetic test or the provision of genetic information.
Section 108I bars such an insurer, agent or broker from requiring an applicant to undergo a genetic test as a condition of issuing or renewing a disability or long term care policy. Section 120E of chapter 175 bars an insurer, agent or broker authorized to issue policies on the lives of persons in the commonwealth from practicing unfair discrimination because of the results of a genetic test or the provision of genetic information.
Section 120E bars such an insurer, agent or broker from requiring an applicant to undergo a genetic test as a condition of issuing or renewing a life policy. Section 120E lets a company, its officer or agent, or an insurance broker ask on an application for life insurance whether the applicant has taken a genetic test, provided that the application states the applicant is not required to answer and that failing to answer may result in an increased rate or denial of coverage.
Section 108H makes a violation of that section an unfair method of competition or unfair or deceptive act or practice in violation of chapters 93A and 176D. Section 108I(b) makes a violation of that section an unfair method of competition or unfair or deceptive act or practice in violation of chapters 93A and 176D. Section 120E makes a violation of that section an unfair method of competition or unfair or deceptive act or practice in violation of chapters 93A and 176D. Section 7 of chapter 176D punishes a person whom the commissioner finds to have engaged in an unfair or deceptive act or practice by a fine of not more than one thousand dollars for each and every act or practice, in addition to a cease and desist order.
The 2000 act relative to insurance and genetic testing and privacy protection inserted sections 108H and 108I into chapter 175 after section 108G. The 2000 act relative to insurance and genetic testing and privacy protection inserted section 120E into chapter 175 after section 120D. The 2000 act was approved on .
Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day it took effect.
Section 3B of chapter 176A bars a corporation subject to that chapter, and its officer or agent, from cancelling, refusing to issue or renew, or discriminating in premiums, length of coverage or other terms of a medical service plan based on genetic information. Section 3B of chapter 176A bars a corporation subject to that chapter, and its officer or agent, from requiring genetic tests or private genetic information as a condition of issuing or renewing a hospital service plan.
Section 3B of chapter 176A makes a violation of that section an unfair method of competition or unfair or deceptive act or practice in violation of chapters 93A and 176D. Section 5B of chapter 176B bars a corporation subject to that chapter, and its officer or agent, from cancelling, refusing to issue or renew, or discriminating in premiums, length of coverage or other terms of a medical service plan based on genetic information.
Section 5B of chapter 176B bars a corporation subject to that chapter, and its officer or agent, from requiring genetic tests or private genetic information as a condition of issuing or renewing a medical service plan.
Section 5B of chapter 176B makes a violation of that section an unfair method of competition or unfair or deceptive act or practice in violation of chapters 93A and 176D. Section 24 of chapter 176G bars a health maintenance organization subject to that chapter, and its officer or agent, from cancelling, refusing to issue or renew, or discriminating in premium, rates, length of coverage or other terms of a health maintenance contract based on genetic information.
Section 24 of chapter 176G bars a health maintenance organization subject to that chapter, and its officer or agent, from requiring genetic tests or private genetic information as a condition of issuing or renewing a health maintenance contract.
Section 24 of chapter 176G makes a violation of that section an unfair method of competition or deceptive act or practice in violation of chapters 93A and 176D. The 2000 act relative to insurance and genetic testing and privacy protection inserted section 3B into chapter 176A after section 3A. The 2000 act relative to insurance and genetic testing and privacy protection inserted section 5B into chapter 176B after section 5A. The 2000 act relative to insurance and genetic testing and privacy protection inserted section 24 into chapter 176G. The 2000 act was approved on .
Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day it took effect.
Section 4A of chapter 176I bars an organization and a preferred provider from cancelling, refusing to issue or renew, or discriminating in premiums, length of coverage or other terms of a health benefit plan based on genetic information. Section 4A of chapter 176I bars an organization and a preferred provider from requiring genetic tests or private genetic information as a condition of issuing or renewing a health benefit plan.
The 2000 act relative to insurance and genetic testing and privacy protection inserted section 4A into chapter 176I after section 4. Section 8 of chapter 176I lets the commissioner, after due hearing, issue an order requiring any person or organization to cease and desist from violating any provision of the chapter.
Section 8 of chapter 176I lets the commissioner, after due hearing, require any person or organization found to have violated any provision of the chapter to forfeit an amount not to exceed ten thousand dollars for any single violation. The 2000 act was approved on . Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day it took effect.
Section 106 of chapter 93 bars a person engaged in the business of leasing or renting videos, or an employee of one, from maintaining records that would indicate the title or category of any video leased or rented by a borrower, other than the records necessary to ensure a completed transaction. Section 106 of chapter 93 requires records indicating the name of the borrower together with the title or category of the video to be eliminated within thirty days after the transaction is completed.
Section 106 of chapter 93 bars a person engaged in the business of leasing or renting videos, or an employee of one, from making available to a third party records that would indicate the name of the borrower or the title or category of any video leased or rented by a borrower, except under a proceeding authorized by federal law.
Section 106 of chapter 93 punishes a violation of that section by imprisonment in a house of correction for not more than sixty days or a fine of one thousand dollars, or both. The codified text carries no history note, and no day on which the section came into force has been located.
Massachusetts adds its own criminal computer-crime statutes on top of the federal baseline: unauthorized access to a computer system is a standalone state offense turning on the same password-or-authentication gate the Computer Fraud and Abuse Act (CFAA) uses, and a separate section reaches fraudulently obtaining a subscription-based commercial computer service. Neither section carries a private civil right of action of its own.
The state's principal civil vehicle for a scraping-adjacent claim is chapter 93A's unfair-or-deceptive-practices statute, the same California-style role its Unfair Competition Law plays there, which arms a private plaintiff with double or treble damages for a willful violation.
No Massachusetts appellate decision addressing browsewrap or clickwrap enforceability, database rights, or robots.txt's legal weight specifically has been located; those dimensions rest on the federal-law baseline already covered in the national document.
Whoever, with intent to defraud, obtains or attempts to obtain a commercial computer service by false representation, false statement, unauthorized charging to another's account, tampering with equipment, or any other means, is punished by up to two and one-half years in the house of correction, a fine of up to $3,000, or both.
"Commercial computer service" is defined as the use of, or access to or copying of data from, a computer, system, program, or network that its proprietor offers to others on a subscription or other paid basis, so the section reaches circumventing a paywall or subscription gate rather than accessing an openly published page. Section 33A was inserted by chapter 168 of the Acts of 1994. Chapter 168 was approved , and carries no effective-date clause or emergency preamble of its own.
Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day it took effect.
Whoever, without authorization, knowingly accesses a computer system by any means, or after gaining access by any means knows that access is not authorized and fails to terminate it, is punished by up to 30 days in the house of correction, a fine of up to $1,000, or both.
The section states that a password or other authentication requirement itself constitutes notice that access is limited to authorized users, the same authorization-gate reasoning the Computer Fraud and Abuse Act (CFAA)'s federal case law uses, so a public, unauthenticated page raises no exposure under this section on the same logic. Section 120F was inserted by chapter 168 of the Acts of 1994. Chapter 168 was approved , and carries no effective-date clause or emergency preamble of its own.
Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day it took effect.
Section 2 declares unfair methods of competition and unfair or deceptive acts or practices in trade or commerce unlawful, directing courts to be guided by FTC Act Section 5 interpretations, the same federal standard chapter 93A imports. Section 9 arms any person injured by such conduct with a private civil action for damages and equitable relief, including an injunction. A willful or knowing violation exposes the defendant to up to three, but not less than two, times the actual damages found.
Section 2 was inserted by chapter 813 of the Acts of 1967. Chapter 813 was approved , and carries no effective-date clause or emergency preamble of its own. Section 9 was added by chapter 690 of the Acts of 1969. Chapter 690 was approved , and carries no effective-date clause or emergency preamble of its own.
Article XLVIII of the Amendments to the Massachusetts Constitution bars such a law from taking effect earlier than ninety days after it becomes law, and no source states the day either took effect. The sections this entry groups came into force on different days.
Massachusetts's product-security and baseline-security posture rests on one enacted regulation with its own enabling statute, layered over the federal-level regimes already researched as this jurisdiction's national row and not repeated here.
201 CMR 17.00, Standards for the Protection of Personal Information of Residents of the Commonwealth, promulgated by the Office of Consumer Affairs and Business Regulation under the rulemaking authority M.G.L. ch. 93H, section 2(a) grants it, requires every person who owns or licenses personal information about a Massachusetts resident, reaching anyone who receives, stores, maintains, processes, or otherwise has access to it in connection with providing goods or services or in connection with employment, to develop, implement, and maintain a comprehensive written information security program (WISP), in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to the business's size, resources, amount of stored data, and the sensitivity of the information (17.03(1)).
The WISP must designate one or more employees to maintain it, identify and assess foreseeable internal and external risks, train employees, impose discipline for violations, cut off a terminated employee's access, restrict physical access and require locked storage, monitor the program's operation, review its scope at least annually or after a material change in business practice, oversee third-party service providers by selecting only ones capable of maintaining appropriate security measures and requiring those measures by contract, and document the entity's response to any security-breach incident (17.03(2)).
Where personal information is stored or transmitted electronically, 17.04 layers on a computer-system security program: secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, reasonable monitoring for unauthorized use, up-to-date firewalls and operating-system security patches for an internet-connected system, up-to-date malware protection, and employee training on the computer security system.
Every covered person had to be in full compliance by (17.05); there is no forward compliance runway left to describe.
Ch. 93H, section 6 gives the Attorney General authority to bring an action under ch. 93A, section 4 to remedy a violation of 'this chapter,' which 201 CMR 17.00 implements by its own text (17.01(1)); separately, 940 CMR 3.16(3), a general Attorney General consumer-protection regulation promulgated under ch. 93A, section 2(c), deems a failure to comply with a statute or regulation meant to protect the public and intended to provide Massachusetts consumers protection, which reaches 201 CMR 17.00, a ch. 93A, section 2 unfair or deceptive practice; that in turn opens ch. 93A, section 9 to any person injured by the deemed violation, recoverable as actual damages or $25, whichever is greater, trebled (or at minimum doubled) for a willful or knowing violation, plus attorney's fees, with a class action available under section 9(2), while the Attorney General may separately recover a civil penalty of up to $5,000 per violation under ch. 93A, section 4.
No Massachusetts statute sets security requirements a connected device or software product must meet before or after it reaches the market. The closest is S.3190 (194th Gen. Ct.), a redraft the Joint Committee on Consumer Protection and Professional Licensure reported favorably on from the original petition S.3090 (filed as Senate docket SD.3606 on by Senators William N. Brownsberger and David M. Rogers), now pending before the Senate Committee on Ways and Means.
As filed, it would require a manufacturer of a connected consumer product manufactured on or after to disclose a minimum guaranteed support period for technical support, security updates, and bug fixes, to notify consumers at least six months before end-of-life of the cybersecurity and other risks of continued use, and would require an internet service provider that supplies or leases such a product to keep it receiving security updates or replace it at no cost once the product reaches end-of-life; a violation would be an unfair or deceptive practice under ch. 93A, section 2.
It has not been enacted, so this is a researched absence rather than a gap in this profile's coverage, and the quoted provisions are the bill as introduced (S.3090); the committee's redraft, S.3190, has not itself been read for a possibly different set of terms. No Massachusetts cyber-resilience regime binding a class of entity by sector, criticality, or size, comparable to NIS2 or DORA, was located that reaches a digital service this corpus can currently flag against.
Massachusetts has no general private-sector duty to report an exploited vulnerability or a security incident, as distinct from a personal-data breach, to an authority; no analogue to New York's Chapter 177 (binding only government bodies) or to the federal Cyber Incident Reporting for Critical Infrastructure Act (not yet implemented) was found reaching a private business here.
Massachusetts's breach-notification duty, ch. 93H, section 3 (with the credit-monitoring offer at section 3A for a breach touching a Social Security number), is already this jurisdiction's privacy row rather than repeated here: it and 201 CMR 17.00 sit in the same chapter, with the breach-notice duty attaching to the exposure of personal data and the WISP duty attaching to the security program that would have prevented it.
Mass. Gen. Laws ch. 93I, sec. 2Official text of Massachusetts General Laws chapter 93I, section 2, Massachusetts Legislature
In force since .Binds public and private bodies.
What this law does
When disposing of records, each agency or person must meet the minimum standards for proper disposal of records containing personal information. Paper documents containing personal information must be redacted, burned, pulverized or shredded so that personal data cannot practicably be read or reconstructed. Electronic and other non-paper media containing personal information must be destroyed or erased so that personal information cannot practicably be read or reconstructed.
A third party hired to dispose of the material must implement and monitor compliance with policies and procedures that prohibit unauthorized access to or acquisition of or use of personal information during collection, transportation and disposal. A violator is subject to a civil fine of not more than $100 per data subject affected, not to exceed $50,000 for each instance of improper disposal. The attorney general may file a civil action to recover the penalties.
201 CMR 17.01-17.05Official Code of Massachusetts Regulations text, Office of Consumer Affairs and Business Regulation, PDF from mass.gov
In force since .Binds private bodies.
What this law does
Every person that owns or licenses personal information about a Massachusetts resident, meaning anyone who receives, stores, maintains, processes, or otherwise has access to it in connection with providing goods or services or in connection with employment, must develop, implement, and maintain a comprehensive written information security program (WISP) with administrative, technical, and physical safeguards appropriate to the business's size, scope, resources, amount of stored data, and the need for security and confidentiality of both consumer and employee information.
The WISP must designate one or more employees to maintain it, identify and assess reasonably foreseeable internal and external risks and evaluate the effectiveness of current safeguards, train employees, impose discipline for violations, cut off a terminated employee's access to records containing personal information, restrict and secure physical access to and storage of records, monitor the program's operation, and review its scope at least annually or after a material change in business practice.
It must also document the entity's response to any security-breach incident and oversee third-party service providers by taking reasonable steps to select and retain only ones capable of maintaining appropriate security measures and requiring those measures by contract.
Where personal information is stored or transmitted electronically, 17.04 adds a computer-system security program: secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewall protection and operating-system security patches for a system connected to the internet, up-to-date malware protection, and employee training on the security system.
The regulation was promulgated by the Office of Consumer Affairs and Business Regulation under the rulemaking authority M.G.L. ch. 93H, section 2(a) grants it. It required full compliance by every covered person on or before (17.05). Ch. 93H, section 6 gives the Attorney General authority to bring an action under ch. 93A, section 4 to remedy a violation of chapter 93H, which this regulation implements (17.01(1)).
Separately, 940 CMR 3.16(3) deems a failure to comply with a statute or regulation meant to protect the public and intended to provide Massachusetts consumers protection a ch. 93A, section 2 unfair or deceptive practice; chapter 93H and this regulation grant a private person no cause of action of their own.
Massachusetts's central instrument in this topic is General Laws chapter 272, section 99, the Commonwealth's wiretap statute, which turns on secrecy rather than on which party is doing the recording: an interception is defined as secretly hearing or secretly recording the contents of a wire or oral communication by any person other than one given prior authority by all the parties to it, so a recording made openly, with the parties aware it is happening, falls outside the definition, while a party's own secret recording of a call is not excused merely by that party's participation in it.
This departs from the federal Wiretap Act's one-party rule, which lets a party record a call without telling the other party at all.
A violation carries a civil action for actual damages, but not less than liquidated damages of $100 a day of violation or $1,000, whichever is higher, plus punitive damages and attorney's fees, and criminal exposure of a fine of up to $10,000 or up to five years in the state prison, or up to two and a half years in a jail or house of correction, or both, with a separate misdemeanor for knowingly disclosing or using an unlawfully intercepted communication or possessing an interception device with unlawful intent.
An office intercommunication system used in the ordinary course of business, a common carrier's own use of its facilities, and a financial institution's recorded calls with a corporate or institutional trading partner on semi-annual notice are all exempt.
For telephone contact, chapter 159C, the Telemarketing Solicitation Act, bars a telephone solicitor from calling a consumer on the state's no sales solicitation calls listing, calling between 8 p.m. and 8 a.m. local time, sending an unsolicited sales fax, or using a recorded message device, and requires immediate self-identification and a description of the offer before payment is taken; these duties reach only an unsolicited telephonic sales call, a term that excludes a call the consumer requested, a call about an existing debt or unfinished contract, a call to an existing customer of the previous 24 months who has not opted out, a nonprofit's call, and a poll or survey.
A consumer who receives more than one such call from the same solicitor within 12 months may sue for actual loss or up to $5,000 for a knowing violation, and the Attorney General may separately seek a civil penalty of up to $5,000 per knowing violation, no less than $1,500 where the consumer is 65 or older; the chapter states no criminal penalty.
An older, separate scheme, chapter 159, sections 19B through 19E, requires an automatic telephone dialing system sold or used in the state to honor a customer's own do-not-call request lodged with their common carrier at no charge and to release the called line within five seconds of hang-up, and requires a residential telephone sales call to identify the caller, the caller's principal, and the goods or services offered before any other statement, without stating a penalty or a private right of action for either duty.
Massachusetts has no general statute requiring consent before sending a commercial email or a commercial text message, so the federal CAN-SPAM Act and 47 CFR 64.3100, already researched at the national rung, are this state's floor for both channels. Massachusetts has no pen register or trap and trace statute reaching a private person: chapter 272, section 99 neither defines nor mentions a pen register.
Massachusetts has not enacted a comprehensive consumer privacy law giving a resident an opt-out right for direct or targeted marketing; a bill that would create one, the Massachusetts Data Privacy Act (S.2619), remains pending and is researched on this jurisdiction's privacy document.
Section 99 makes it unlawful to secretly hear, secretly record, or aid another to secretly hear or record the contents of a wire or oral communication by any means, unless the person doing so has been given prior authority by all the parties to the communication, so a recording made openly with the parties' knowledge falls outside this definition and a party's own secret recording is not excused merely by that party's participation.
The Supreme Judicial Court held in 2024 that the act's word "communication" is ambiguous as applied to a person's browsing of publicly available information on a hospital's websites, so under the rule of lenity the plaintiff's wiretap act claims over that browsing should be dismissed. An office intercommunication system used in the ordinary course of business, and a common carrier's own use of its facilities in the ordinary course of its business, are exempt.
A financial institution may record its calls with a corporate or institutional trading partner if it gives that partner semi-annual written notice that designated lines are recorded. A person whose communication is unlawfully intercepted, disclosed, or used has a civil action for actual damages, but not less than liquidated damages of $100 for each day of violation or $1,000, whichever is higher, plus punitive damages and a reasonable attorney's fee.
Willfully committing or attempting an interception, or procuring another to do so, is punishable by a fine of not more than $10,000, imprisonment in the state prison for not more than five years, or imprisonment in a jail or house of correction for not more than two and a half years, or both; knowingly disclosing or using the contents of an unlawfully intercepted communication, and possessing an interception device with intent to use it unlawfully, are each a separate misdemeanor punishable by up to two years in a jail or house of correction or a fine of up to $5,000.
The provisions this entry describes came into force on different days.
Section 19B defines an automatic telephone dialing system as terminal equipment that stores or produces numbers with a random or sequential number generator and delivers a prerecorded message.
Section 19D requires such a system, if sold or used in the Commonwealth, to be designed to prevent the selection or dialing of a telephone number a customer has listed under section 19C. Section 19D also requires such a system to automatically create a disconnect signal within five seconds after the called party hangs up, releasing the called party's line. Section 19C lets a customer of a common carrier notify that carrier that they do not wish to receive automatic-dialing-system calls.
A common carrier may not charge a customer for being placed on that no-call list, and must offer the customer the opportunity to give this notification when a telephone is installed and at least annually after that.
Section 19E separately requires anyone soliciting a residential sale by telephone to state, before any other statement besides a greeting, the identity of the person making the call, the trade name of the person the caller represents, and the kind of goods or services offered, and bars a plan, scheme, or ruse that misrepresents the caller's true status or purpose. The codified text carries no history note, and no day on which these sections came into force has been located.
Chapter 159C requires the Office of Consumer Affairs and Business Regulation to establish and maintain a no sales solicitation calls listing of consumers who do not wish to receive unsolicited telephonic sales calls, updated not less than quarterly. A telephone solicitor may not call a consumer whose number appears on that listing, call between 8 p.m. and 8 a.m. local time at the consumer's location, send an unsolicited telephonic sales call by facsimile, or use a recorded message device.
These duties reach only an 'unsolicited telephonic sales call', a term whose definition excludes a call made at the consumer's own express request, a call primarily about an existing debt or a contract not yet performed, a call to an existing customer of the previous 24 months who has not asked the solicitor to stop, and a call whose sale is not completed until a face-to-face meeting.
The chapter also excludes a tax-exempt nonprofit organization's calls and a noncommercial poll or survey from the definition of a marketing or sales solicitation altogether.
A telephone solicitor must identify itself, the company on whose behalf it is calling, and the purpose of the call within the first minute of a telephonic sales call and before requesting, accepting, or arranging for payment, and must disclose the correct name of the ultimate seller and a complete and accurate description of the goods or services offered, including their retail market value.
A consumer who has received more than one unsolicited telephonic sales call from the same solicitor within a 12-month period may sue to enjoin further violations and to recover actual monetary loss or not more than $5,000 in damages for a knowing violation, whichever is greater.
The Attorney General may separately bring a civil penalty action of not more than $5,000 for each knowing violation, but not less than $1,500 where the violation involves a consumer 65 years of age or older; the chapter states no criminal penalty. It is a defense that the defendant established and implemented, with due care, reasonable practices and procedures to prevent violations of the chapter.
Both chambers of the Massachusetts legislature passed distinct social media bills for minors in 2026. The House passed its version on by substituting the text of H.5349 into S.2581, a Senate passed school cellphone bill; it would bar platforms from allowing accounts for users under 14 and would require verifiable parental consent for 14 and 15 year olds, using the best available age verification technology.
The Senate non-concurred and a conference committee was appointed in May 2026. The Senate separately passed S.3164 on , which would instead require platforms to disable addictive design features, such as autoplay, infinite scroll, and algorithmic feeds, by default for minors, using an age verification method that need not rely solely on government ID. No adult content or app store age verification bill has advanced in Massachusetts.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds private bodies.
What this law does
As passed by the House, would bar social media platforms from allowing an account for a user under 14, require termination and deletion of existing under-14 accounts by , and require verifiable parental consent for 14 and 15 year old users, verified through the best available age verification technology, alongside a school day cellphone ban.
The House engrossed it 129 to 25 on by substituting the text of H.5349; the Senate non-concurred on and the bill is in a six member conference committee.
Proposed.proposed Not law. It binds no one unless it is enacted.
Binds private bodies.
What this law does
Would require social media platforms to disable, by default, algorithmic feeds, autoplay, infinite scroll, and other addictive design features on minors' accounts, send reminders after extended use, and turn off notifications overnight. Requires an age verification method that need not rely solely on government issued identification. Passed the Senate 38 to 2 on , and is now before the House, which took a different under-14 ban approach in its own bill.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Reuse law
Massachusetts has no press-publisher neighbouring right, mandatory platform-to-publisher bargaining code, or codified hot-news misappropriation statute distinct from federal law. The General Laws carry no title on copyright; chapter 93A's unfair-or-deceptive-practices statute reaches deceptive trade conduct generally but no provision addressing reproduction of news headlines, snippets, linking, framing, or a text-and-data-mining opt-out.
No Massachusetts legislative bill proposing a journalism usage fee or a platform-to-publisher payment scheme, and no reported decision of the Supreme Judicial Court or the Appeals Court addressing snippet reproduction, linking, framing, or hot-news misappropriation specifically, was located.
Copyright over news content reproduced or aggregated by a service operating in Massachusetts, including the copyrightability of headlines and snippets and the availability of a fair-use defense, arises solely under the federal Copyright Act, already covered in the national document.
As of .
Reporting clocks that run here18 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Massachusetts comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
If you are a frontier developer, report a critical safety incident to the attorney general within 15 days of discovering it, and within 24 hours to an appropriate authority when the incident poses an imminent risk of death or serious physical injury.
Notify the Massachusetts Attorney General, the Director of Consumer Affairs and Business Regulation, and each affected Massachusetts resident as soon as practicable and without unreasonable delay after learning of a breach of security involving personal information.
The law of the United States, which applies in Massachusetts
Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred.
A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.
If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more.
This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.
If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.
If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.
Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
If your organization is an Securities and Exchange Commission (SEC) reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
