What is Massachusetts Data Protection Law 201 CMR 17.00?

Massachusetts Data Protection Law 201 CMR 17.00 requires businesses, engaged in commerce, to adopt written security polices and encrypt personal data, of any Massachusetts resident, stored or transmitted through the Internet or wirelessly.

The key to Massachusetts Data Protection Law 201 CMR 17.00 is that regardless of where your business is physically or operationally, if you handle or store the personal information of any Massachusetts resident, you are legally obligated to protect that information.

This is the first data privacy law that allows a court to impose a $5,000 civil penalty for each violation—if a ‘violation‘ is interpreted by a judge to mean the unauthorized access to a single individual’s personal information.