Charter Data PrivacyJurisdictional Research
Home/Massachusetts

Massachusetts

state

State layer above federal baseline. The lightest of the multi-state layers: 603 CMR 23.00 plus FERPA is the operative K-12 student-data regime. MA has no comprehensive consumer privacy statute.

Applies to: MA Commonwealth Charter Schools (e.g., Roxbury Prep in Boston).

Layered legal regime

A charter in this jurisdiction is subject to all of the following layers stacked:

  1. Layer 1Federal Baseline— 5 laws
  2. Layer 2Massachusetts— 1 law

Massachusetts — Laws & Regulations

603 CMR 23.00

Massachusetts Student Records Regulations

Full detail →
Statute: 603 CMR 23.00 et seq.
Regs: M.G.L. c. 71, §§ 34D, 34E, 34F (statutory authority)

Foundational MA student-records regulation, harmonized with FERPA. Governs maintenance, access, amendment, security, retention, and destruction of student records held by MA public and charter schools. Drives operational retention behavior: the transcript is retained 60 years and the temporary record 7 years after graduation, transfer, or withdrawal.

School-side obligations

  • Provide annual written notice to parents and eligible students (603 CMR 23.10)
  • Maintain a log of all access to the student record (603 CMR 23.07)
  • Follow the retention schedule: transcript 60 years, temporary record 7 years (603 CMR 23.06)
  • Permit inspection and amendment of records
  • Maintain physical and electronic security of records

Vendor-side obligations

  • Not a regulatory mandate in 603 CMR; a vendor DPA is operational best practice
  • Support the school's access-log, retention, and security obligations for any handled records
Breach notification: M.G.L. c. 93H (the general MA breach law, implemented by 201 CMR 17.00) applies to PII broadly, including student data.
Enforcement: MA Department of Elementary and Secondary Education (BoESE).