Massachusetts Data Security Regulations: Deadline To Update Service Provider Contracts Is Fast Approaching

The deadline for compliance with a key requirement of the Massachusetts Data Security Regulations ("Regulations") is only a month away. By March 1, 2012, contracts must require that certain service providers implement and maintain appropriate security measures to protect personal information.¹ See 201 CMR 17.03(2)(f).

This requirement pertains to entities that "own or license" personal information of Massachusetts residents. Regardless of location, an entity must comply if it receives, stores, maintains, processes, or otherwise has access to personal information of Massachusetts residents in connection with the provision of goods and services or in connection with employment. Because the Regulations contain such broad definitions for terms such as "own and license," most service providers – from your payroll provider to your e-commerce hosting provider – are likely subject to this requirement.