Data Breach Notice to Residents and State Authorities in Massachusetts
At a glance
| Covered entity and service provider | Owner/licensee: resident, AG, consumer-affairs director; nonowner holder: owner notice and cooperation (§ 3(a)-(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition/use with substantial identity-theft/fraud risk; name plus SSN, ID, or financial-account data; separate known unauthorized acquisition/use trigger (§§ 1, 3) |
| Risk screen or notice exception | Defined breach requires substantial identity-theft/fraud risk; good-faith internal acquisition excluded absent later misuse/disclosure; no general documented harm waiver (§§ 1, 3) |
| Individuals who receive notice | Owner/licensee notifies affected MA resident; nonowner holder notifies owner/licensee (§ 3(a)-(b)) |
| Individual notice deadline and clock | As soon as practicable and without unreasonable delay after knowledge or reason to know; no fixed outer day count; unknown total cannot delay (§ 3(b)) |
| Regulator threshold and deadline | AG AND consumer-affairs director for qualifying incident, no numerical threshold; without unreasonable delay; detailed report and sample resident notice (§ 3(b)) |
| Consumer-reporting-agency notice | Director identifies relevant consumer reporting or state agencies; entity then notifies those identified, without unreasonable delay (§ 3(b)) |
| Individual delivery and content | Writing or qualifying electronic notice; police-report right, security-freeze instructions/no charge, mitigation services, parent name if applicable; omit breach nature and count (§§ 1, 3) |
| Substitute notice conditions and channels | Written-notice cost >$250,000, affected class >500,000, or insufficient contact; email if available AND homepage if any AND statewide media (§ 1) |
| Delays and alternate compliance | Law-enforcement delay after written AG notification; resume without unreasonable delay on clearance; SSN exposure brings 18-month monitoring, 42 months for reporting agencies (§§ 3A, 4) |
Requirements one by one
Covered information and reporting trigger
Mass. Gen. Laws ch. 93H, § 1 defines a breach as unauthorized acquisition or use of unencrypted data, or encrypted electronic data and its confidential key or process, creating a substantial risk of identity theft or fraud. Covered information joins a resident's name or initial and surname with a Social Security number, driver’s license or state ID, or financial account or payment card number permitting account access. Lawfully public information is excluded. Section 3 also triggers notice when the owner or licensor knows or has reason to know that a resident's information was acquired or used by an unauthorized person or for an unauthorized purpose.
Who reports and when
Under § 3(a), a nonowner holder tells the owner or licensor as soon as practicable and without unreasonable delay. Its cooperation covers the approximate date, nature, and response steps, subject to the statute's confidentiality limit. It need not notify residents.
The owner or licensor notifies affected residents, the Attorney General, and the director of consumer affairs and business regulation under § 3(b). There is no fixed outer day limit. An unknown affected-resident count cannot delay notice; added or corrected information follows promptly.
State and consumer-reporting-agency reports
The § 3(b) regulator report includes incident nature, current Massachusetts count, reporter and entity identity, compromised data categories, security-program status, and response steps. The entity also supplies a sample resident notice and the specified credit-monitoring certification. The director identifies relevant consumer reporting or state agencies; the entity then notifies those identified agencies without unreasonable delay.
Resident delivery and content
Section 1 permits writing or qualifying electronic notice. The § 3(b) resident notice explains the right to a police report, how to obtain a free security freeze, and mitigation services. It must not state the breach's nature or affected Massachusetts count. If the entity has a parent or affiliate, § 3(d) requires that name.
Substitute notice under § 1 is available if written notice would cost more than $250,000, the affected Massachusetts class exceeds 500,000, or contact information is insufficient. It combines email where available, homepage posting if there is a site, and statewide media publication or broadcast.
What trips people up
State and resident messages differ. Section 3(b) asks for incident details in the state report but forbids the breach nature and Massachusetts count in the resident notice.
Social Security numbers add credit monitoring. Under § 3A, the entity arranges at least 18 months of no-cost monitoring for residents whose numbers were or reasonably may have been disclosed. A consumer reporting agency must provide at least 42 months.
Police delay needs a formal determination. Section 4 requires law enforcement to find that notice may impede a criminal investigation, notify the Attorney General in writing, and inform the entity. Notice resumes without unreasonable delay after clearance.
Common questions
Must the affected Massachusetts count be final first?
No. Section 3(b) bars delaying notice for that reason and calls for an additional notice when information becomes available.
Does a service provider send the consumer notice?
Section 3(a) gives the nonowner holder an owner-or-licensor notice and cooperation duty. The owner or licensor sends resident and state notices under § 3(b).
Statutes and sources
- Mass. Gen. Laws ch. 93H, § 1 — definitions and notice methods.
- Mass. Gen. Laws ch. 93H, § 3 — holder, owner, resident, regulator, and agency notices.
- Mass. Gen. Laws ch. 93H, § 3A — credit monitoring.
- Mass. Gen. Laws ch. 93H, § 4 — criminal-investigation delay.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Massachusetts law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Massachusetts law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace