Overview
201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth is a Massachusetts data security regulation issued by the Office of Consumer Affairs and Business Regulation (OCABR) that establishes minimum standards for safeguarding the personal information of Massachusetts residents. The regulation applies to any organization or individual that owns, licenses, stores, or processes personal information relating to Massachusetts residents, regardless of where the organization is located. It requires the implementation of a comprehensive, risk-based information security program, including administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. The regulation also includes requirements for computer system security, employee access controls, encryption, vendor oversight, and ongoing monitoring to help ensure the confidentiality and integrity of personal information.