Data breach notification
Massachusetts covers breaches in General Laws chapter 93H, section 3, with definitions in section 1.
Notice goes, as soon as practicable and without unreasonable delay, to the attorney general, to the director of consumer affairs and business regulation, and to the affected resident.
The two state offices also receive a sample copy of the consumer notice. There is no resident count that switches the state notice on; it travels with the resident notice.
The duty arises when a business knows or has reason to know of a breach of security, or knows or has reason to know that a resident's personal information was acquired or used by an unauthorized person or used for an unauthorized purpose.
A breach of security is itself defined as unauthorized acquisition or use that creates a substantial risk of identity theft or fraud against a resident. The second trigger stands on its own, so the substantial-risk test does not answer every case.
Personal information is a resident's first name and last name or first initial and last name, together with a Social Security number, a driver's license or state-issued ID number, or a financial account, credit or debit card number with or without any required security code.
Encrypted electronic data counts only when the confidential process or key capable of compromising it is acquired or used as well.
The notice to residents must not state the nature of the breach or the number of residents affected. A letter drafted from a generic template can easily include both, so it is worth checking before it goes out.
After an incident, a precise view of file activity is valuable.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
The watermark is a per-room setting, on by default. The log is chained, exportable as CSV, and also covers invitations and changes. Because groups see only their own folders, the set of possible readers for any document is defined in advance.
Checked against Massachusetts's published law on November 2, 2026. This is general information, not legal advice.
