Obligations United States Massachusetts
What a Massachusetts business has to have in writing
Massachusetts is the state that made the written information security program a legal artifact: 201 CMR 17.00 requires anyone holding personal information about a Massachusetts resident to keep a written, documented WISP with a named owner, vendor contracts and encryption rules, and it applies whether or not the business is located here.
On the employment side the Commonwealth stacks written obligations too, with a distributed anti-harassment policy at six employees, a written CORI policy at five background checks a year, PFML notice with a signed acknowledgment, and wage ranges in postings at twenty-five employees.
Any programme licensed, certified or funded by the health and human services secretariat also needs a written workplace violence prevention and crisis response plan. The state OSHA plan covers only public employers, so private employers stay under federal OSHA.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
MassachusettsHandbook 2026acknowledged by name
Massachusetts on Recordwith AllyMatter
Cover Massachusetts the Modern WayEvery policy Massachusetts makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Massachusetts on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Massachusetts rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Security breach notification lawAI-compiledM.G.L. c. 93HAny person or business that owns or licenses data including personal information about a Massachusetts residentDistribute
Notice
Notify the Attorney General and the Office of Consumer Affairs and Business Regulation as soon as practicable and without unreasonable delay, saying what happened, how many residents are affected, what steps were taken and whether a written information security program was in place. Send residents a separate notice that must not describe the nature of the breach or the number affected, and that tells them how to get a police report and place a security freeze. If Social Security numbers were involved, offer at least 18 months of credit monitoring free of charge.
From the first employee
Massachusetts Attorney General; Office of Consumer Affairs and Business Regulation
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Standards for the Protection of Personal Information of Residents of the CommonwealthAI-compiled201 CMR 17.00; M.G.L. c. 93H § 2Any person or business anywhere that owns or licenses personal information about a Massachusetts resident, in paper or electronic formWrite
Written program
Write and maintain a comprehensive Written Information Security Program scaled to the size of the business and the data it holds. It must name one or more employees who own it, document the risk assessment, set rules for employee handling and discipline, require written contracts obliging third-party service providers to protect the data, limit collection and retention, restrict physical and system access, encrypt personal information on laptops and other portable devices and in transit across public networks, and require documented post-incident review after any breach. Review the program at least annually and whenever the business changes materially.
From the first employee
Massachusetts Office of Consumer Affairs and Business Regulation; Attorney General
Harassment Prevention 1A written policy, and in some states annual training, on harassment
LawProduceWhat it requiresTriggerEnforced by
Written sexual harassment policy requirementAI-compiledM.G.L. c. 151B § 3AEmployers with six or more employeesWrite + ack
Written policy
Adopt a written policy against sexual harassment that says harassment and retaliation are unlawful, gives examples, names the person who takes internal complaints, describes the investigation process and the possible consequences, and explains how to file with the Commission Against Discrimination and the EEOC with the filing deadlines. Hand every new employee a copy at hire and give every employee a copy once a year. MCAD publishes a model policy and a required workplace poster.
6+ employees
Massachusetts Commission Against Discrimination (MCAD)
Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
Massachusetts State Plan (public employers only)AI-compiledM.G.L. c. 149 § 6 1/2; 454 CMR 25.00; 29 CFR 1956 (Massachusetts State Plan)State and municipal employers in Massachusetts; private employers remain under federal OSHAPost
Posting
Public employers follow the OSHA standards adopted by the Department of Labor Standards, post the state job safety and health notice, keep injury and illness records and report severe incidents to DLS. Private employers post the federal OSHA notice and keep federal OSHA records instead; DLS offers free on-site consultation to both.
From the first employee
Massachusetts Department of Labor Standards (public sector); federal OSHA (private sector)
Workplace Violence Prevention 1A written plan for preventing and responding to workplace violence
LawProduceWhat it requiresTriggerEnforced by
Workplace Violence Prevention and Crisis Response PlanAI-compiled101 CMR 19.00Any program operated, licensed, certified or funded by an agency of the Executive Office of Health and Human Services that provides direct services to clientsWrite
Written policy
The program must hold a written workplace violence prevention and crisis response plan meeting the criteria in 101 CMR 19.04, covering every human service worker including contracted staff, interns and volunteers, and every location where they are on duty.
From the first employee
Executive Office of Health and Human Services
Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Earned Sick Time lawAI-compiledM.G.L. c. 149 § 148C; 940 CMR 33.00Every employer with employees in Massachusetts; sick time is paid at 11 or more employees and unpaid below thatWrite + ack
Written policy
Let employees accrue one hour of sick time for every 30 hours worked, up to 40 hours a year, and allow carryover. Post the Attorney General's earned sick time notice and either give every employee a copy of that notice or put the sick time terms in the employee handbook. If a change in headcount flips leave from paid to unpaid or back, give employees 30 days written notice.
From the first employee
Massachusetts Attorney General, Fair Labor Division
Paid Family and Medical Leave (PFML)AI-compiledM.G.L. c. 175M; 458 CMR 2.00Every Massachusetts employer, with contribution shares differing above and below 25 covered individualsDistribute + ack
Notice
Display the Department of Family and Medical Leave workplace poster and give every new hire a written notice of PFML benefits, contribution rates, job protection and anti-retaliation within 30 days, then collect a signed acknowledgment of receipt or a record of the refusal to sign. Employers remit quarterly contributions or run an approved private plan, and reissue notice when rates change.
From the first employee
Massachusetts Department of Family and Medical Leave
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required workplace postersAI-compiledM.G.L. c. 149 (various); M.G.L. c. 151B § 3A; M.G.L. c. 175M; M.G.L. c. 152Every Massachusetts employerPost
Posting
Post the Commonwealth's current notice set where employees can see it: wage and hour law, minimum wage, earned sick time, paid family and medical leave, sexual harassment, fair employment practices, parental leave, workers' compensation insurance carrier, unemployment insurance and the federal OSHA poster. The state publishes the posters free.
From the first employee
Massachusetts Attorney General, Fair Labor Division; Department of Labor Standards
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Wage Transparency Act (Act Relative to Salary Range Transparency)AI-compiledM.G.L. c. 149 § 105F (St. 2024, c. 141)Employers with 25 or more employees in Massachusetts for posting duties; employers with 100 or more employees also file annual wage data reportsDistribute
Notice
State a good-faith pay range in every posting for a position, give the range to any applicant or employee who asks and to any employee offered a promotion or transfer, and keep the range realistic rather than an artificially wide band. Employers with 100 or more employees separately file their federal EEO wage and workforce data with the Secretary of the Commonwealth each year.
25+ employees
Massachusetts Attorney General; Executive Office of Labor and Workforce Development
Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business registration (Corporations Division)AI-compiledM.G.L. c. 156D (corporations); M.G.L. c. 156C (LLCs); M.G.L. c. 110 § 5 (business certificates)Any corporation, LLC, partnership, nonprofit or out-of-state entity transacting business in Massachusetts; sole proprietors file a local business certificateFile
Filing / record
File organizing or foreign-qualification documents with the Secretary of the Commonwealth's Corporations Division, keep a resident agent on record and file the annual report each year to stay in good standing. Employers register separately for withholding, unemployment insurance and workers' compensation coverage.
From the first employee
Massachusetts Secretary of the Commonwealth, Corporations Division
Retail food establishment permit (State Sanitary Code Chapter X)AI-compiled105 CMR 590.000; M.G.L. c. 94 § 305ARestaurants, retail food stores, caterers, mobile units and other food establishments in MassachusettsFile
Filing / record
Get a permit from the local board of health before operating and renew it annually, keep a certified food protection manager on staff and have all food employees complete allergen awareness training, and put in place the written procedures the Retail Food Code requires, including an employee health reporting agreement and a HACCP plan for specialized processes.
From the first employee
Massachusetts Department of Public Health, Food Protection Program; local boards of health
Home Improvement Contractor registrationAI-compiledM.G.L. c. 142A; 201 CMR 18.00Contractors and subcontractors soliciting, bidding on or performing home improvement work on owner-occupied residential property of one to four unitsFile
Filing / record
Register as a Home Improvement Contractor through the state contractor portal before contracting, pay into the Guaranty Fund and renew every two years. Home improvement work over the statutory threshold needs a written contract carrying the registration number, the scope, the total price, the payment schedule, start and completion dates and the required notice of the arbitration and Guaranty Fund rights.
From the first employee
Massachusetts Office of Consumer Affairs and Business Regulation
Other Written Policies 4Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Written CORI policy for employers running background checksAI-compiled803 CMR 2.00; M.G.L. c. 6 §§ 167-178Any employer or organization that conducts five or more criminal background investigations a year, whether through the state CORI system or a consumer reporting agencyWrite + ack
Written policy
Maintain a written CORI policy covering who may request and view records, how results are used in hiring decisions, how an applicant is told about an adverse decision and given a copy of the record and a chance to dispute it, and how records are stored and destroyed. Use the state CORI Acknowledgment Form before any check, train everyone with access and keep the secondary dissemination log. DCJIS publishes a model policy employers may adopt.
From the first employee
Massachusetts Department of Criminal Justice Information Services (DCJIS); Attorney General
Domestic violence leave noticeAI-compiledM.G.L. c. 149 § 52EEmployers with 50 or more employeesDistribute
Notice
Give employees up to 15 days of leave in a 12-month period for issues arising from domestic violence, sexual assault, stalking or kidnapping affecting them or a family member, and notify employees in writing of the right to that leave and how to request it. Documentation an employee supplies is confidential and cannot be kept in the personnel file.
50+ employees
Massachusetts Attorney General, Fair Labor Division
Pregnant Workers Fairness Act noticeAI-compiledM.G.L. c. 151B § 4(1E)Employers with six or more employeesDistribute
Notice
Give employees written notice of the right to reasonable accommodation for pregnancy and related conditions, including lactation, in a handbook or similar document, and repeat it to new hires and to any employee who tells the employer she is pregnant. Handle accommodation requests through an interactive process rather than a blanket rule.
6+ employees
Massachusetts Commission Against Discrimination (MCAD)
Noncompetition Agreement ActAI-compiledM.G.L. c. 149 § 24LAny Massachusetts employer that uses noncompete agreements with employees or independent contractorsDistribute + ack
Notice
Put the noncompete in writing, sign it with the employee, and give it to a new hire with the formal offer or at least 10 business days before the start date, whichever is earlier. The agreement must state that the employee may consult a lawyer, cannot run longer than a year, must be supported by garden leave pay or other agreed consideration, and cannot be used at all with hourly, student or terminated-without-cause workers.
From the first employee
Massachusetts courts; Attorney General
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Massachusetts on top
Small businessFederal + industry, with Massachusetts on topConstruction contractorsFederal + industry, with Massachusetts on topHealthcare practicesFederal + industry, with Massachusetts on topFood and beverage businessesFederal + industry, with Massachusetts on topTax and accounting firmsFederal + industry, with Massachusetts on topRegistered investment advisersFederal + industry, with Massachusetts on topInsurance agenciesFederal + industry, with Massachusetts on topRetail and e-commerceFederal + industry, with Massachusetts on topTrucking and logistics carriersFederal + industry, with Massachusetts on topNonprofitsFederal + industry, with Massachusetts on topFederal contractorsFederal + industry, with Massachusetts on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Mass.gov - 201 CMR 17.00Mass.gov - 201 CMR 17.00 Compliance ChecklistMass.gov - 201 CMR 17.00 regulation text (PDF)Mass.gov - Requirements for Data Breach NotificationsMass.gov - Reporting data breaches to OCABRMassachusetts Legislature - M.G.L. c. 93H § 3Mass.gov - MCAD Guidelines, Model Policies, and PostersMCAD - Model Sexual Harassment Policy (PDF)Mass.gov - About Harassment in the WorkplaceMass.gov - Pay Transparency in MassachusettsMassachusetts Attorney General - Wage Transparency Act guidance (PDF)Mass.gov - Massachusetts workplace poster requirementsMassachusetts Attorney General - Earned Sick Time FAQs (PDF)Massachusetts Attorney General - Earned Sick Time Notice of Employee Rights (PDF)Mass.gov - Employer's Introduction to Paid Family and Medical LeaveMass.gov - PFML frequently asked questions for employersOSHA - Massachusetts State PlanMass.gov - Corporations DivisionSecretary of the Commonwealth - Corporate DatabaseMass.gov - 105 CMR 590.000 Retail Food CodeMass.gov - Retail Food Code FAQs (PDF)Mass.gov - Guidance for Stakeholders Regarding the Retail Food CodeMass.gov - Home Improvement Contractor ProgramMass.gov - 201 CMR 18.00 Home Improvement Contractor RegistrationMass.gov - HIC Contractor ResourcesMass.gov - 803 CMR 2.00 Criminal Offender Record InformationDCJIS - Model CORI Policy (PDF)Mass.gov - CORI FormsMassachusetts Legislature - M.G.L. c. 149 § 52EMass.gov - Overview of Anti-Discrimination Laws Enforced by the MCADMassachusetts Legislature - M.G.L. c. 149 § 24LMass.gov - Massachusetts law about sexual harassment and employment law pagesMass.gov, 101 CMR 19.00Mass.gov, Implementing human service workers safety regulations