Data security regulations introduced by the Massachusetts Office of Consumer Affairs and Business Regulation (“OCABR”) have garnered attention this year for a couple reasons.  First, the Regulations are broadly written, covering any company that handles “personal information” of Massachusetts customers or employees (as you may have guessed, this will include companies located outside of Massachusetts).  Next, the Regulations continue to make headlines as the Massachusetts OCABR makes revisions and extends the compliance deadline.  The current compliance deadline is March 1, 2010.

You can check here for the OCABR’s updated list of FAQs (including differences between the latest version of the Regulations and the version issued in February 2009).

A hearing will be held on September 22, 2009 to discuss the proposed Regulations.  While the recent revisions and the scheduled hearing indicate that Massachusetts OCABR is making efforts to try and keep the Regulations (somewhat) in line with Federal laws and also minimize the impact on certain small businesses, entities with customers or employees in Massachusetts should monitor developments.  The Regulations could definitely impact existing information security policies and/or existing data management programs.