The Massachusetts Data Privacy Act: Where It Stands and What a Small Business Should Do Now

TL;DR: No, not yet. As of October 22, 2026, the Massachusetts Data Privacy Act is not law. The Senate passed its version 40 to 0 in September 2025, the House passed a different one 146 to 0 in June 2026, and a conference committee is working out the differences. Small businesses already have binding duties under 201 CMR 17.00 and chapter 93H.

The Massachusetts Data Privacy Act is the state's first attempt at a broad consumer privacy law, and the question people ask about it is short: did it pass? Here is the answer as of October 22, 2026, from the Legislature's own records, then the part that matters more for a small business: what to do now, whatever the final bill says.

This is a practical guide to Massachusetts data privacy from a technology company, not legal advice. For your own obligations, talk with a Massachusetts attorney who knows privacy law.

Did the Massachusetts Data Privacy Act pass?

Not as of today. Here is what the official bill history shows, in order. (Massachusetts Legislature, bill S.2619)

• September 25, 2025: the Senate passed its bill, filed as S.2608 and reprinted as S.2619, by a vote of 40 to 0.
• June 4, 2026: the House replaced the Senate text with its own version, published as H.5479, and passed it 146 to 0. (WBUR, June 5, 2026)
• June 11, 2026: the Senate declined to accept the House version and named its negotiators: Senators Cindy Creem, Barry Finegold and Patrick O'Connor.
• June 17, 2026: the House insisted on its version and named Representatives Michael Moran, Tricia Farley-Bouvier and David Vieira.

That June 17 entry is still the last action on the bill page as I write this. The six negotiators opened their talks in public on July 7, 2026, walking through the two bills section by section and setting the harder policy questions aside for later. (State House News Service, July 7, 2026) No compromise bill has been filed, and nothing has gone to the Governor.

Why can it still pass after the usual end of July? The Legislature's joint rules end formal business on the last day of July in the second year of a session, but they make an exception for "reports of committees of conference formed on or before the last day of July." This committee was formed in June, so it qualifies. (Joint Rules of the Massachusetts Legislature, Rule 12A) The Boston Globe explains that such talks "can continue through the fall and winter" and that lawmakers can return for formal sessions to approve deals "before the full two-year term ends in early January." (The Boston Globe, July 2026)

So the answer on the Massachusetts data privacy bill has three parts. It has not passed. Both chambers have voted for a version of it, unanimously. And it can still become law before the session ends in early January 2027, or run out of time and start over next session. The bill history page linked above updates when anything moves.

What would the Massachusetts Data Privacy Act require?

The two versions of the Massachusetts data privacy bill disagree on important details, but they share a common frame. State House News Service describes both as "requiring businesses to limit data collection, honor consumer requests to access or delete personal information, and allow consumers to opt out of targeted advertising and certain data sales." I read both texts on the Legislature's site. The pieces below appear in both versions, so they are the parts most worth knowing now.

• Collect only what you need. The Senate text limits collection "to what is reasonably necessary to provide or maintain a specific product or service requested by the consumer." The House text uses "reasonably necessary and proportionate" to the purposes disclosed to the consumer. (S.2619 text; H.5479)
• A privacy notice that matches reality. Both require a clear, "not misleading" notice listing the categories of personal data you collect, a separate list of sensitive data, the purpose for each category, and how people can use their rights.
• Answer requests on a clock. Both give a business 45 days to respond to a request to access, correct or delete data, with one 45-day extension when reasonably necessary.
• Written contracts with your vendors. Both require a written, binding contract between a business and any vendor that processes data for it, setting out the instructions, the purpose, the type of data and how long processing lasts.
• The Attorney General enforces it. Both texts make a violation an unfair or deceptive practice under chapter 93A and let the Attorney General seek civil penalties of up to $5,000 per violation.

The disagreements are real. The Senate would ban the sale of sensitive data outright and allow collecting it only when "strictly necessary," while the House would allow most sales with the consumer's opt in and would ban the sale of precise geolocation data. The House also lets individuals sue a "large data holder," defined in its text as one holding personal data on more than 2,000,000 consumers or sensitive data on more than 200,000. The Senate leaves enforcement to the Attorney General. (State House News Service, July 7, 2026)

Would the Massachusetts Data Privacy Act apply to a small business?

For most small businesses in Central Massachusetts, probably not directly, but the line sits closer than many owners assume. The two Massachusetts data privacy bills set different thresholds based on how many Massachusetts residents' data a business handled in the previous calendar year.

• Senate version: personal data of at least 60,000 consumers (not counting data used only to complete a payment), or at least 20,000 consumers plus 20% or more of gross revenue from selling personal data, or any reproductive or sexual health data.
• House version: personal data of at least 100,000 consumers (with the same payment carve out), or at least $100,000 in gross revenue from selling personal data, or processing sensitive data.

Two definitions matter here. "Consumer" means a Massachusetts resident, and both versions leave out people acting as employees, owners or contractors in a business role, so your staff records and your business to business contacts mostly fall outside the count. "Personal data," though, is broad: in the Senate text it is "any information that is linked or reasonably linkable to an identified or identifiable consumer." That is much wider than the narrow definition in the state's breach law, which covers a name combined with a Social Security number, a driver's license or state ID number, or a financial account or card number. (M.G.L. c. 93H, section 1)

Now place the Massachusetts data privacy thresholds next to a typical local business. A ten person shop that sells mostly to neighbors will not reach 60,000 Massachusetts residents. An online store, a busy membership program, or a website that tracks every visitor with advertising tools can count more people than its owner expects, and I would rather a client count than guess.

The other triggers are the ones I would read twice. Both versions reach businesses that touch health or other sensitive data in ways a headcount threshold does not capture, and HIPAA covered entities have their own carve outs that differ between the two texts. If your business handles health, biometric, location or similar data, wait for the final text and read its coverage section with your attorney.

What Massachusetts data privacy rules already apply to a small business today?

While the new law waits, three Massachusetts rules are already binding, and they reach far smaller businesses than any version of the Massachusetts data privacy bill.

201 CMR 17.00, the data security regulation. Every person that "owns or licenses personal information about a resident of the Commonwealth" must keep a written information security program with administrative, technical and physical safeguards sized to the business. There is no headcount floor. (201 CMR 17.03) I wrote a full guide to that program on ameliasgagne.com, so I will not repeat it here: Massachusetts WISP requirements under 201 CMR 17.00.

Chapter 93H, the breach notice law. A business that owns or licenses personal information about a Massachusetts resident must give notice "as soon as practicable and without unreasonable delay" to the Attorney General, the Office of Consumer Affairs and Business Regulation and the affected residents when it knows or has reason to know of a breach. A vendor that only stores the data must notify the business that owns it. (M.G.L. c. 93H, section 3) The step by step is in Massachusetts data breach notification requirements. Brian pulled together the 2025 Massachusetts data breach numbers.

Chapter 93I, the disposal law. Paper with personal information must be "redacted, burned, pulverized or shredded," and electronic media must be destroyed or erased so the data "cannot practicably be read or reconstructed." Fines run up to $100 per person affected, capped at $50,000 per instance. (M.G.L. c. 93I, section 2) Brian wrote a guide to disposing of old business computers under that law.

For the official documents behind all of these, MyRHC keeps an index of Massachusetts compliance sources, and it is a good place to read the source text before you talk to anyone, us included.

What should a small business do now, whatever the final law says?

The useful thing about this moment is that the work the Massachusetts data privacy bill would require and the work 201 CMR 17.00 already requires are largely the same work. The Federal Trade Commission's guide for businesses puts it in five words that have aged well: take stock, scale down, lock it, pitch it, plan ahead. (FTC, Protecting Personal Information: A Guide for Business) Here is how I would turn that into a short list for a small team.

1. Make a data inventory. One spreadsheet: every system that holds customer or employee information (point of sale, email marketing, booking, accounting, website forms, shared drives), what fields it keeps, who can see it and where it lives. 201 CMR 17.03 already asks you to identify "reasonably foreseeable internal and external risks" to those records, and you cannot assess risk to data you have not found.
2. Delete what you do not need. The FTC's rule of thumb is plain: "If you don't have a legitimate business need for sensitive personally identifying information, don't keep it." Stop collecting fields no one uses, such as a birth date on a newsletter form, and set a retention period for old records. Data you no longer hold cannot be breached, and data you never collect never counts toward a threshold.
3. Make your privacy notice true. Read your website's privacy notice next to your inventory. If it says you do not share data and your site runs advertising pixels, fix the notice or the site. The FTC says that when companies make privacy promises, it "can and does take law enforcement action to make sure that companies live up these promises." (FTC, Privacy and Security Enforcement) Both versions of the Massachusetts data privacy bill would also require a clear, not misleading notice that lists what you collect and why.
4. Read your vendor contracts. 201 CMR 17.03 already requires "reasonable steps to select and retain third-party service providers" that can protect the data, and requiring them "by contract" to maintain appropriate security measures. Both bill versions add written processing instructions. Start with the vendors that hold the most customer data. MyRHC's vendor management frameworks list the source documents.
5. Decide who answers a privacy request. Pick one person and one inbox. Write down how you would find, export or delete one customer's records in each system on your inventory.
6. Dispose of old records properly. Shred paper and wipe or destroy old drives and laptops before they leave the building, as chapter 93I already requires.

None of this depends on which chamber wins the argument over sensitive data.

What does Massachusetts data privacy work look like for a Central Massachusetts business?

The examples below are hypothetical, to show the shape of the work rather than anyone's real situation.

A landscaping company in Grafton might find that its customer list lives in four places: the scheduling app, the invoicing system, an old spreadsheet and a former office manager's email. The fix is not a new policy. It is retiring the spreadsheet, moving the email records into the system of record and closing the old mailbox.

An online shop in Worcester might discover that its website collects phone numbers and birthdays it never uses, and that its privacy notice was copied from a template years ago. Trimming the form and rewriting the notice against what the site actually does removes a real source of risk.

A small practice in Shrewsbury that handles health information is in a different position. Its HIPAA obligations come first, and the two versions of the Massachusetts data privacy bill treat HIPAA covered entities differently, so the final text will matter. That business should watch the bill page closely and plan the review with its counsel.

In each case the first step is the same: know where the data is. Once that map exists, whatever the Legislature decides on Massachusetts data privacy becomes adjustment rather than discovery.

This article is general information, not legal advice. Kief Studio is not a law firm, and reading it does not create an attorney-client relationship. Laws and regulations change, so check the current text and talk with a licensed Massachusetts attorney about your situation.