Get help →
Home›Obligations›United States›By state›Massachusetts

What a Massachusetts business has to have in writing

Massachusetts is the state that made the written information security program a legal artifact: 201 CMR 17.00 requires anyone holding personal information about a Massachusetts resident to keep a written, documented WISP with a named owner, vendor contracts and encryption rules, and it applies whether or not the business is located here.

On the employment side the Commonwealth stacks written obligations too, with a distributed anti-harassment policy at six employees, a written CORI policy at five background checks a year, PFML notice with a signed acknowledgment, and wage ranges in postings at twenty-five employees.

Any program licensed, certified or funded by the health and human services secretariat also needs a written workplace violence prevention and crisis response plan. The state OSHA plan covers only public employers, so private employers stay under federal OSHA.

Massachusetts has a rule of its own in 10 of the 14 areas, listed below. In 3 more we searched the state's own site and found nothing beyond the federal rule, but we have not finished writing up where we looked, so those are not shown yet. One area we have not checked yet.

Headcount

Industry  General is always on

Share
Ad from the publisher
Policy  Acknowledgment  Proof
MassachusettsHandbook 2026acknowledged by name
Massachusetts on Recordwith AllyMatter
Cover Massachusetts the Modern WayEvery policy Massachusetts makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Massachusetts on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
See how it works →Pricing →

Massachusetts rules for a 15–19 person general business

We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether Massachusetts has a rule of its own on top. The federal rules every employer carries follow the Massachusetts rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by
Security breach notification lawAccessed and verified  2026-10-01M.G.L. c. 93H #Any person or business that owns or licenses data including personal information about a Massachusetts residentDistribute
Notice
Notify the Attorney General and the Office of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay, saying what happened, how many residents are affected, what steps were taken and whether a written information security program was in place. Send residents a separate notice that must not describe the nature of the breach or the number affected, and that tells them how to get a police report and place a security freeze. If Social Security numbers were involved, offer at least 18 months of credit monitoring free of charge.
From the first employee
Massachusetts Attorney General; Office of Consumer Affairs and Business Regulation
AuthorityMass.gov - Requirements for Data Breach NotificationsMass.gov - Reporting data breaches to OCABRMassachusetts Legislature - M.G.L. c. 93H § 3Report an error

Data Security Program 1A written safeguards program the state requires before anything goes wrong

LawProduceWhat it requiresTriggerEnforced by
Standards for the Protection of Personal Information of Residents of the CommonwealthAccessed and verified  2026-10-01201 CMR 17.00; M.G.L. c. 93H § 2 #Any person or business anywhere that owns or licenses personal information about a Massachusetts resident, in paper or electronic formWrite
Written program
Write and maintain a comprehensive Written Information Security Program scaled to the size of the business and the data it holds. It must name one or more employees who own it, document the risk assessment, set rules for employee handling and discipline, require written contracts obliging third-party service providers to protect the data, limit collection and retention, restrict physical and system access, encrypt personal information on laptops and other portable devices and in transit across public networks, and require documented post-incident review after any breach. Review the program at least annually and whenever the business changes materially.
From the first employee
Massachusetts Office of Consumer Affairs and Business Regulation; Attorney General
AuthorityMass.gov - 201 CMR 17.00Mass.gov - 201 CMR 17.00 Compliance ChecklistMass.gov - 201 CMR 17.00 regulation text (PDF)Report an error

Harassment Prevention 1A written policy, and in some states annual training, on harassment

LawProduceWhat it requiresTriggerEnforced by
Written sexual harassment policy requirementM.G.L. c. 151B § 3A #Employers with six or more employeesWrite + ack
Written policy
Adopt a written policy against sexual harassment that says harassment and retaliation are unlawful, gives examples, names the person who takes internal complaints, describes the investigation process and the possible consequences, and explains how to file with the Commission Against Discrimination and the EEOC with the filing deadlines. Hand every new employee a copy at hire and give every employee a copy once a year. MCAD publishes a model policy and a required workplace poster.
6+ employees
Massachusetts Commission Against Discrimination (MCAD)
AuthorityMass.gov - MCAD Guidelines, Model Policies, and PostersMCAD - Model Sexual Harassment Policy (PDF)Mass.gov - About Harassment in the WorkplaceReport an error

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by
Massachusetts State Plan (public employers only)M.G.L. c. 149 § 6 1/2; 454 CMR 25.00; 29 CFR 1956 (Massachusetts State Plan) #State and municipal employers in Massachusetts; private employers remain under federal OSHAPost
Posting
Public employers follow the OSHA standards adopted by the Department of Labor Standards, post the state job safety and health notice, keep injury and illness records and report severe incidents to DLS. Private employers post the federal OSHA notice and keep federal OSHA records instead; DLS offers free on-site consultation to both.
From the first employee
Massachusetts Department of Labor Standards (public sector); federal OSHA (private sector)
AuthorityOSHA - Massachusetts State PlanMass.gov - Massachusetts workplace poster requirementsReport an error

Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice

LawProduceWhat it requiresTriggerEnforced by
Earned Sick Time lawM.G.L. c. 149 § 148C; 940 CMR 33.00 #Every employer with employees in Massachusetts; sick time is paid at 11 or more employees and unpaid below thatWrite + ack
Written policy
Let employees accrue one hour of sick time for every 30 hours worked, up to 40 hours a year, and allow carryover. Post the Attorney General's earned sick time notice and either give every employee a copy of that notice or put the sick time terms in the employee handbook. If a change in headcount flips leave from paid to unpaid or back, give employees 30 days written notice.
From the first employee
Massachusetts Attorney General, Fair Labor Division
AuthorityMassachusetts Attorney General - Earned Sick Time FAQs (PDF)Massachusetts Attorney General - Earned Sick Time Notice of Employee Rights (PDF)Mass.gov - Massachusetts workplace poster requirementsReport an error
Paid Family and Medical Leave (PFML)M.G.L. c. 175M; 458 CMR 2.00 #Every Massachusetts employer, with contribution shares differing above and below 25 covered individualsDistribute + ack
Notice
Display the Department of Family and Medical Leave workplace poster and give every new hire a written notice of PFML benefits, contribution rates, job protection and anti-retaliation within 30 days, then collect a signed acknowledgment of receipt or a record of the refusal to sign. Employers remit quarterly contributions or run an approved private plan, and reissue notice when rates change.
From the first employee
Massachusetts Department of Family and Medical Leave
AuthorityMass.gov - Employer's Introduction to Paid Family and Medical LeaveMass.gov - PFML frequently asked questions for employersMass.gov - Massachusetts workplace poster requirementsReport an error

Required Postings 1The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by
Required workplace postersM.G.L. c. 149 (various); M.G.L. c. 151B § 3A; M.G.L. c. 175M; M.G.L. c. 152 #Every Massachusetts employerPost
Posting
Post the Commonwealth's current notice set where employees can see it: wage and hour law, minimum wage, earned sick time, paid family and medical leave, sexual harassment, fair employment practices, parental leave, workers' compensation insurance carrier, unemployment insurance and the federal OSHA poster. The state publishes the posters free.
From the first employee
Massachusetts Attorney General, Fair Labor Division; Department of Labor Standards
AuthorityMass.gov - Massachusetts workplace poster requirementsMass.gov - MCAD Guidelines, Model Policies, and PostersReport an error

Pay Transparency 1Salary ranges in job posts and pay disclosure on request

LawProduceWhat it requiresTriggerEnforced by
Wage Transparency Act (Act Relative to Salary Range Transparency)Accessed and verified  2026-10-07M.G.L. c. 149 §§ 105E and 105F (St. 2024, c. 141) #Employers with 25 or more employees in Massachusetts for posting duties; employers with 100 or more employees also file annual wage data reportsDistribute
Notice
State the good-faith pay range the employer reasonably expects to pay in every posting for a position, including postings placed through a third party; give the range to any applicant or employee who asks about a specific position and to any employee offered a promotion or transfer to a new position with different responsibilities. Employers with 100 or more employees in Massachusetts that are subject to the federal wage data reports (EEO-1) also file them with the Secretary of the Commonwealth each year.
25+ employees
Massachusetts Attorney General, with a warning for a first offense and fines of up to $500 and $1,000 for later ones
AuthorityMass.gov - Pay Transparency in MassachusettsMassachusetts Attorney General - Wage Transparency Act guidance (PDF)Mass.gov - Massachusetts workplace poster requirementsReport an error

Licensing and Certifications 1Registrations, licenses and certifications a business or its staff must hold

LawProduceWhat it requiresTriggerEnforced by
Business registration (Corporations Division)M.G.L. c. 156D (corporations); M.G.L. c. 156C (LLCs); M.G.L. c. 110 § 5 (business certificates) #Any corporation, LLC, partnership, nonprofit or out-of-state entity transacting business in Massachusetts; sole proprietors file a local business certificateFile
Filing / record
File organizing or foreign-qualification documents with the Secretary of the Commonwealth's Corporations Division, keep a resident agent on record and file the annual report each year to stay in good standing. Employers register separately for withholding, unemployment insurance and workers' compensation coverage.
From the first employee
Massachusetts Secretary of the Commonwealth, Corporations Division
AuthorityMass.gov - Corporations DivisionSecretary of the Commonwealth - Corporate DatabaseReport an error

Other Written Policies 4Any other document the state makes an employer write or hand out

LawProduceWhat it requiresTriggerEnforced by
Written CORI policy for employers running background checks803 CMR 2.00; M.G.L. c. 6 §§ 167-178 #Any employer or organization that conducts five or more criminal background investigations a year, whether through the state CORI system or a consumer reporting agencyWrite + ack
Written policy
Maintain a written CORI policy covering who may request and view records, how results are used in hiring decisions, how an applicant is told about an adverse decision and given a copy of the record and a chance to dispute it, and how records are stored and destroyed. Use the state CORI Acknowledgment Form before any check, train everyone with access and keep the secondary dissemination log. DCJIS publishes a model policy employers may adopt.
From the first employee
Massachusetts Department of Criminal Justice Information Services (DCJIS); Attorney General
AuthorityMass.gov - 803 CMR 2.00 Criminal Offender Record InformationDCJIS - Model CORI Policy (PDF)Mass.gov - CORI FormsReport an error
Domestic violence leave noticeM.G.L. c. 149 § 52E #Employers with 50 or more employeesDistribute
Notice
Give employees up to 15 days of leave in a 12-month period for issues arising from domestic violence, sexual assault, stalking or kidnapping affecting them or a family member, and notify employees in writing of the right to that leave and how to request it. Documentation an employee supplies is confidential and cannot be kept in the personnel file.
50+ employees
Massachusetts Attorney General, Fair Labor Division
AuthorityMassachusetts Legislature - M.G.L. c. 149 § 52EMass.gov - Massachusetts workplace poster requirementsReport an error
Pregnant Workers Fairness Act noticeM.G.L. c. 151B § 4(1E) #Employers with six or more employeesDistribute
Notice
Give employees written notice of the right to reasonable accommodation for pregnancy and related conditions, including lactation, in a handbook or similar document, and repeat it to new hires and to any employee who tells the employer she is pregnant. Handle accommodation requests through an interactive process rather than a blanket rule.
6+ employees
Massachusetts Commission Against Discrimination (MCAD)
AuthorityMass.gov - Overview of Anti-Discrimination Laws Enforced by the MCADMass.gov - MCAD Guidelines, Model Policies, and PostersReport an error
Noncompetition Agreement ActM.G.L. c. 149 § 24L #Any Massachusetts employer that uses noncompete agreements with employees or independent contractorsDistribute + ack
Notice
Put the noncompete in writing, sign it with the employee, and give it to a new hire with the formal offer or at least 10 business days before the start date, whichever is earlier. The agreement must state that the employee may consult a lawyer, cannot run longer than a year, must be supported by garden leave pay or other agreed consideration, and cannot be used at all with hourly, student or terminated-without-cause workers.
From the first employee
Massachusetts courts; Attorney General
AuthorityMassachusetts Legislature - M.G.L. c. 149 § 24LMass.gov - Massachusetts law about sexual harassment and employment law pagesReport an error

Because You Are in Construction 1Industry layer

LawProduceWhat it requiresTriggerEnforced by
Home Improvement Contractor registrationM.G.L. c. 142A; 201 CMR 18.00 #Contractors and subcontractors soliciting, bidding on or performing home improvement work on owner-occupied residential property of one to four unitsFile
Filing / record
Register as a Home Improvement Contractor through the state contractor portal before contracting, pay into the Guaranty Fund and renew every two years. Home improvement work over the statutory threshold needs a written contract carrying the registration number, the scope, the total price, the payment schedule, start and completion dates and the required notice of the arbitration and Guaranty Fund rights.
From the first employee
Massachusetts Office of Consumer Affairs and Business Regulation
AuthorityMass.gov - Home Improvement Contractor ProgramMass.gov - 201 CMR 18.00 Home Improvement Contractor RegistrationMass.gov - HIC Contractor ResourcesReport an error

Because You Are in Healthcare 1Industry layer

LawProduceWhat it requiresTriggerEnforced by
Workplace Violence Prevention and Crisis Response Plan101 CMR 19.00 #Any program operated, licensed, certified or funded by an agency of the Executive Office of Health and Human Services that provides direct services to clientsWrite
Written policy
The program must hold a written workplace violence prevention and crisis response plan meeting the criteria in 101 CMR 19.04, covering every human service worker including contracted staff, interns and volunteers, and every location where they are on duty.
From the first employee
Executive Office of Health and Human Services
AuthorityMass.gov, 101 CMR 19.00Mass.gov, Implementing human service workers safety regulationsReport an error

Because You Are in Food & Beverage 1Industry layer

LawProduceWhat it requiresTriggerEnforced by
Retail food establishment permit (State Sanitary Code Chapter X)105 CMR 590.000; M.G.L. c. 94 § 305A #Restaurants, retail food stores, caterers, mobile units and other food establishments in MassachusettsFile
Filing / record
Get a permit from the local board of health before operating and renew it annually, keep a certified food protection manager on staff and have all food employees complete allergen awareness training, and put in place the written procedures the Retail Food Code requires, including an employee health reporting agreement and a HACCP plan for specialized processes.
From the first employee
Massachusetts Department of Public Health, Food Protection Program; local boards of health
AuthorityMass.gov - 105 CMR 590.000 Retail Food CodeMass.gov - Retail Food Code FAQs (PDF)Mass.gov - Guidance for Stakeholders Regarding the Retail Food CodeReport an error

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Your business type, with Massachusetts on top

Small businessFederal + industry, with Massachusetts on topConstruction contractorsFederal + industry, with Massachusetts on topHealthcare practicesFederal + industry, with Massachusetts on topFood and beverage businessesFederal + industry, with Massachusetts on topTax and accounting firmsFederal + industry, with Massachusetts on topRegistered investment advisersFederal + industry, with Massachusetts on topInsurance agenciesFederal + industry, with Massachusetts on topRetail and e-commerceFederal + industry, with Massachusetts on topTrucking and logistics carriersFederal + industry, with Massachusetts on topNonprofitsFederal + industry, with Massachusetts on topFederal contractorsFederal + industry, with Massachusetts on top

For another state

Alabama12Alaska12Arizona11Arkansas14California24Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine15Maryland19Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Advertise Here

Sources

Mass.gov - 201 CMR 17.00Mass.gov - 201 CMR 17.00 Compliance ChecklistMass.gov - 201 CMR 17.00 regulation text (PDF)Mass.gov - Requirements for Data Breach NotificationsMass.gov - Reporting data breaches to OCABRMassachusetts Legislature - M.G.L. c. 93H § 3Mass.gov - MCAD Guidelines, Model Policies, and PostersMCAD - Model Sexual Harassment Policy (PDF)Mass.gov - About Harassment in the WorkplaceMass.gov - Pay Transparency in MassachusettsMassachusetts Attorney General - Wage Transparency Act guidance (PDF)Mass.gov - Massachusetts workplace poster requirementsMassachusetts Attorney General - Earned Sick Time FAQs (PDF)Massachusetts Attorney General - Earned Sick Time Notice of Employee Rights (PDF)Mass.gov - Employer's Introduction to Paid Family and Medical LeaveMass.gov - PFML frequently asked questions for employersOSHA - Massachusetts State PlanMass.gov - Corporations DivisionSecretary of the Commonwealth - Corporate DatabaseMass.gov - 105 CMR 590.000 Retail Food CodeMass.gov - Retail Food Code FAQs (PDF)Mass.gov - Guidance for Stakeholders Regarding the Retail Food CodeMass.gov - Home Improvement Contractor ProgramMass.gov - 201 CMR 18.00 Home Improvement Contractor RegistrationMass.gov - HIC Contractor ResourcesMass.gov - 803 CMR 2.00 Criminal Offender Record InformationDCJIS - Model CORI Policy (PDF)Mass.gov - CORI FormsMassachusetts Legislature - M.G.L. c. 149 § 52EMass.gov - Overview of Anti-Discrimination Laws Enforced by the MCADMassachusetts Legislature - M.G.L. c. 149 § 24LMass.gov - Massachusetts law about sexual harassment and employment law pagesMass.gov, 101 CMR 19.00Mass.gov, Implementing human service workers safety regulations

About this data

Pages on this site are compiled by AllyMatter and checked against one or more sources, two or more where available. Each record shows its stage and date. Nothing here is legal, audit or tax advice, and policyandcompliance.com and AllyMatter, Inc. accept no responsibility for errors or for decisions made on it. Read the source, then decide.
How we compile and verify →

Think something is wrong?

[email protected]
Tell us the page and what you found. We check it against the source and fix it.

Want to advertise here?

[email protected]
Consultant listings, tool listings, press releases and the primary spot, flat fee, paid in advance. Prices and rules · Design examples · Press releases.