1. Home
  2. State breach laws
  3. Massachusetts

Massachusetts data breach notification law

What Massachusetts requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Mass. Gen. Laws ch. 93H, §§ 1-6 (notice duty in § 3, enforcement in § 6).

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Massachusetts requires a report to both the Attorney General and the Office of Consumer Affairs and Business Regulation for every breach, regardless of size, including whether the business maintains a written information security program. That every-breach rule puts small organizations on the state's radar that other states never see, and the Attorney General can seek up to $5,000 per violation. Massachusetts also has its own written information security program regulation (201 CMR 17), so a breached organization is often already out of compliance with a rule it can name.

See recent Massachusetts breach filings →

Requirements in detail

Statute
Mass. Gen. Laws ch. 93H, §§ 1-6 (notice duty in § 3, enforcement in § 6)
Deadline to notify residents
As soon as practicable and without unreasonable delay once the business knows or has reason to know of the breach or unauthorized use. There is no fixed number of days.
Attorney General notification
Yes, for any breach that requires notice to even one Massachusetts resident. The business must notify both the Attorney General and the Director of the Office of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay. The notice must describe the breach, the number of residents affected, the types of personal information involved, whether the business maintains a written information security program, and the steps taken or planned. Consumer reporting agencies and state agencies identified by the Director must also be notified.
Penalties
The Attorney General enforces the law through Chapter 93A, Section 4, which allows civil penalties of up to $5,000 per violation, plus injunctive and other relief. Violating a resulting court order can bring penalties of up to $10,000 per violation.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Massachusetts's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Massachusetts has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
None enacted in 2024–2026. House Bill 93, which would add biometric information to the law, was sent to House Ways and Means in July 2025. The comprehensive Massachusetts Data Privacy Act passed the Senate in September 2025 and the House in June 2026, but as of October 2026 it remains in conference committee and has not been enacted.

Massachusetts breach notification FAQ

What is the data breach notification deadline in Massachusetts?

As soon as practicable and without unreasonable delay once the business knows or has reason to know of the breach or unauthorized use. There is no fixed number of days. The governing law is Mass. Gen. Laws ch. 93H, §§ 1-6 (notice duty in § 3, enforcement in § 6).

Does Massachusetts require notifying the Attorney General of a data breach?

Yes, for any breach that requires notice to even one Massachusetts resident. The business must notify both the Attorney General and the Director of the Office of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay. The notice must describe the breach, the number of residents affected, the types of personal information involved, whether the business maintains a written information security program, and the steps taken or planned. Consumer reporting agencies and state agencies identified by the Director must also be notified.

What are the penalties for failing to report a data breach in Massachusetts?

The Attorney General enforces the law through Chapter 93A, Section 4, which allows civil penalties of up to $5,000 per violation, plus injunctive and other relief. Violating a resulting court order can bring penalties of up to $10,000 per violation.

Can individuals sue over a data breach in Massachusetts?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Massachusetts?

Massachusetts's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Massachusetts limit breach lawsuits for companies with a cybersecurity program?

No. Massachusetts has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Massachusetts Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →