← All jurisdictions
MA · data breach notification
medMassachusetts
Mass. Gen. Laws ch. 93H
Individual deadline
No fixed limit
Trigger standard
Any breach
AG / regulator
Required
| Notice to individuals | as soon as practicable and without unreasonable delay |
| Risk-of-harm standard | None, notice required on any qualifying breach of covered personal information. |
| Encryption safe harbor | Yes, encrypted data (key not compromised) generally exempt. |
| Regulator notice | Massachusetts Attorney General, required for any affected resident; as soon as practicable |
| MA Office of Consumer Affairs & Business Regulation (OCABR), required for any affected resident; as soon as practicable | |
| Credit reporting agencies | No CRA-notice requirement. |
| Credit monitoring | 18 months credit monitoring when SSN involved (42 months if breaching entity is a consumer reporting agency); compliance certification filed |
| Letter restriction | Consumer letter must NOT describe the nature of the breach or the number of residents affected |
| Substitute notice | Typically available above $250,000 cost / 500,000 affected (verify). |
| Private right of action | Yes. |
| Penalties | AG enforcement under ch. 93A; WISP requirement (201 CMR 17.00) |
Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →
Is a Massachusetts breach part of a multi-state incident?
See every jurisdiction at once, with letters and filing packets generated.
Run the calculator →