Massachusetts data security regulation (201 CMR 17.00)
Any business that holds certain personal information on Massachusetts residents (a name combined with a Social Security, driver's licence or financial account number) must keep a written information security program, whatever its size. A standard contact form doesn't collect those fields, but online payments or application forms can. Your attorney confirms whether it applies to you.