Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Massachusetts |
|---|---|
| Statute citation | Mass. Gen. Laws ch. 93H, §§ 1-6 (General Laws Chapter 93H - Security Breaches) (amended 2019) |
| Individual notice timing | notify affected individuals 'as soon as practicable and without unreasonable delay' with no specific day |
| Attorney general notice | Yes Massachusetts requires notification to both the Attorney General and the Director of Consumer |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | Yes |
| Private right of action | Yes |
| Credit monitoring required | Yes |
| Breach definition (excerpt) | Not extracted in our PRC 2026 summary; check the statute. |