Service Providers Required To Comply With Massachusetts Data Security Regulations On March 1

Beginning March 1, 2012, any non-governmental entity, wherever located, must amend existing agreements with third-party service providers that receive, store, maintain, process, or otherwise are permitted access to personal information (in both electronic and non-electronic format) to require such service providers to implement appropriate security measures for the personal information of Massachusetts residents consistent with the requirements of 201 CMR 17.00 ("Standards for the Protection of Personal Information of Residents of the Commonwealth"), the regulations that implement the Massachusetts data security law (M.G.L. c. 93H). The law defines personal information as a Massachusetts resident's first name (or initial) and last name in combination with the resident's Social Security number, driver's license number or state-issued identification card number, or financial account number, credit or debit card number. Because the law governs the treatment of the personal