201 CMR 17.00

No changes recorded yet — we are watching, and nothing has been published.

1. 2012-03-01 Transition for pre-2010 service-provider contracts without security clauses ends
2. 2010-03-01 Full compliance with 201 CMR 17.00 required

1. 2009-11-13
   201 CMR 17.00 (dated 13 November 2009) Major versionCurrent

   The regulation as published by the Commonwealth, with full compliance required by 1 March 2010. source

   More

   • Contracts with service providers entered into by 1 March 2010 satisfied the contract requirement until 1 March 2012 even without security clauses.

Anyone who owns or licenses personal information about a Massachusetts resident, with safeguards scaled to the size of the business and the data held.

Who

All persons that own or license personal information about a resident of the Commonwealth (17.01(2)). source

Records

Personal information contained in both paper and electronic records (17.01(1)). source

Scaling

Safeguards must be appropriate to the size, scope and type of business, available resources, the amount of stored data and the need for security and confidentiality. source

Statutory basis

M.G.L. c. 93H, § 2(a) directs the department to adopt regulations safeguarding residents' personal information, consistent with federal regulations that apply to the person. source

Each organisation maintains a written comprehensive information security programme with set administrative and computer security controls, and reviews it at least annually.

Written programme

A comprehensive information security programme in writing, with administrative, technical and physical safeguards (17.03(1)). source

Programme contents

A designated employee, risk assessment, employee training and discipline, cutting off terminated employees, and oversight of service providers by contract (17.03(2)). source

Encryption

To the extent technically feasible, encryption of personal information sent across public networks or wirelessly, and of all personal information stored on laptops and other portable devices (17.04). source

Computer controls

Secure authentication and access controls, monitoring, firewalls and patching, malware protection and security training for computer systems that hold personal information (17.04). source

Review

Review the scope of the security measures at least annually or on a material change in business practices, and document responses to and reviews of any breach (17.03(2)(i)-(j)). source

The Attorney General enforces through Consumer Protection Act actions, with civil penalties of up to $5,000 per violation.

Attorney General

The Attorney General may bring an action under c. 93A, § 4 to remedy violations of chapter 93H and for other appropriate relief (c. 93H, § 6). source

1. Law text 201 CMR 17.00 – Standards for the protection of personal information (PDF)
2. Guidance 201 CMR 17.00 – regulation page on Mass.gov
3. Law text M.G.L. c. 93H, § 2 – Regulations to safeguard personal information
4. Law text M.G.L. c. 93H, § 6 – Enforcement of chapter

1. NY SHIELD Act

   New York's SHIELD Act requires reasonable safeguards with an illustrative list and deems GLBA, HIPAA and 23 NYCRR 500 entities compliant; 201 CMR 17 prescribes specific controls such as encryption.

2. FTC Safeguards Rule

   The FTC Safeguards Rule sets a written security programme for non-bank financial institutions nationwide; 201 CMR 17 applies to anyone holding Massachusetts residents' data.

3. IL PIPA

   Illinois requires reasonable security measures in general terms; Massachusetts lists the programme elements and computer controls.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 23 September 2026. Subscribe to 201 CMR 17.00 (RSS)