# Massachusetts — US state data breach notification deadlines by state

For Massachusetts, statute citation is M.G.L. c. 93H § 3; individual notice deadline is as soon as practicable and without unreasonable delay; ag / regulator notice deadline is as soon as practicable and without unreasonable delay; encryption safe harbor is yes; notes is Notice must be provided concurrently to the Attorney General and the Director of Consumer Affairs and Business Regulation, not just the AG. The Director then identifies relevant consumer reporting agencies and state agencies, and the notifying party must also notify those identified agencies as soon as practicable and without unreasonable delay. GLBA-compliant financial institutions are not explicitly exempted in this section, recorded from its source on 2026-08-18.

- **State:** Massachusetts
- **Statute citation:** M.G.L. c. 93H § 3
- **Individual notice deadline:** as soon as practicable and without unreasonable delay _(verified: appears in the quote below)_
- **AG / regulator notice deadline:** as soon as practicable and without unreasonable delay _(verified: appears in the quote below)_
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** Notice must be provided concurrently to the Attorney General and the Director of Consumer Affairs and Business Regulation, not just the AG. The Director then identifies relevant consumer reporting agencies and state agencies, and the notifying party must also notify those identified agencies as soon as practicable and without unreasonable delay. GLBA-compliant financial institutions are not explicitly exempted in this section. _(our reading, not quoted from the source)_

## What the source says

> (b) A person or agency that owns or licenses data that includes personal information about a resident of the commonwealth, shall provide notice, as soon as practicable and without unreasonable delay, when such person or agency (1) knows or has reason to know of a breach of security or (2) when the person or agency knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose, to the attorney general, the director of consumer affairs and business regulation and to such resident, in accordance with this chapter.

## Source

- https://malegislature.gov/Laws/GeneralLaws/PartI/TitleXV/Chapter93H/Section3

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).