State Extends Deadline For Compliance With Data Security Regulations Until May 1, 2009

We recently informed you that Massachusetts enacted comprehensive data security regulations relating to a 2007 data security law intended to protect Massachusetts residents from identity theft. A copy of the bulleting explaining the regulations can be found here. These regulations, which had been slated to take effect on January 1, 2009, will impose a significant compliance obligation on virtually all businesses with employees or customers in Massachusetts. In light of current economic conditions, the general deadline for compliance with Massachusetts' data security regulations has been extended to May 1, 2009, while the deadline for obtaining written certification of security compliance from third party providers, and for encrypting portable devices other than laptops, has been extended to January 1, 2010.