Massachusetts
For Massachusetts, statute citation is M.G.L. c. 93H § 3; individual notice deadline is as soon as practicable and without unreasonable delay; ag / regulator notice deadline is as soon as practicable and without unreasonable delay; encryption safe harbor is yes; notes is Notice must be provided concurrently to the Attorney General and the Director of Consumer Affairs and Business Regulation, not just the AG. The Director then identifies relevant consumer reporting agencies and state agencies, and the notifying party must also notify those identified agencies as soon as practicable and without unreasonable delay. GLBA-compliant financial institutions are not explicitly exempted in this section, recorded from its source on 2026-08-18.
- State
- Massachusetts
- Statute citation
- M.G.L. c. 93H § 3
- Individual notice deadline
- as soon as practicable and without unreasonable delay verified
- AG / regulator notice deadline
- as soon as practicable and without unreasonable delay verified
- Encryption safe harbor
- yes our reading
- Notes
- Notice must be provided concurrently to the Attorney General and the Director of Consumer Affairs and Business Regulation, not just the AG. The Director then identifies relevant consumer reporting agencies and state agencies, and the notifying party must also notify those identified agencies as soon as practicable and without unreasonable delay. GLBA-compliant financial institutions are not explicitly exempted in this section. our reading
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
(b) A person or agency that owns or licenses data that includes personal information about a resident of the commonwealth, shall provide notice, as soon as practicable and without unreasonable delay, when such person or agency (1) knows or has reason to know of a breach of security or (2) when the person or agency knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose, to the attorney general, the director of consumer affairs and business regulation and to such resident, in accordance with this chapter.
— malegislature.gov, retrieved 2026-08-18
Source
- malegislature.govhttps://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3