The Letter About Your Information
G.L. c. 93H, § 3 — as soon as practicable, to the resident, the attorney general and consumer affairs
In Massachusetts, a person or agency that owns or licenses data with a resident's personal information gives notice, as soon as practicable and without unreasonable delay, when it knows or has reason to know of a breach of security or of unauthorized acquisition or use of the resident's information, to the attorney general, the director of consumer affairs and business regulation, and the resident.
| Who is told | When, as the section puts it |
|---|---|
| Who is toldThe resident | When, as the section puts itAs soon as practicable and without unreasonable delay |
| Who is toldThe attorney general and the director of consumer affairs and business regulation | When, as the section puts itThe same, with the nature of the breach and the number of residents affected, and a sample of the notice sent |
| Who is toldA person or agency that stores data it does not own | When, as the section puts itTells the owner as soon as practicable and without unreasonable delay |
- The office of consumer affairs and business regulation posts breach reports on its website, updated not more than 10 business days after it receives and verifies one.
What counts as personal information, the forms notice may take, and the exceptions for encrypted data are in the section and are not reproduced in full here. Whether a notice was required or on time is a question for the attorney general, a court, and a licensed Massachusetts attorney.
Sources for this section (1)
- G.L. c. 93H, § 3 — Duty to report known security breach or unauthorized use of personal information
Legal information, not legal advice. Verified as of September 2026. Applying it to a particular situation is the work of a licensed Massachusetts attorney.