Massachusetts Data Security Regulations: Deadline Looms For Amending Service Provider Contracts

Just a reminder that March 1 is an important deadline with respect to the Massachusetts data privacy and security regulations (the "Regulations"). As a refresher, the Regulations require all entities that "own or license" personal information of Massachusetts residents — wherever the entity is located — to comply with provisions requiring specific administrative, physical and technical safeguards in respect of the personal information. To reduce the risk of data breaches involving third-party service providers who will have access to personal information in some way, the Regulations require companies covered by the Regulations to take reasonable measures to select vendors capable of "maintaining appropriate security measures to protect such personal information consistent with [the] regulations and any applicable federal regulations." Furthermore, the Regulations mandate that companies contractually require their service providers to safeguard personal information in