The deadline has been a moving target but come March 1, Massachusetts’ new data protection law is finally slated to take effect. 201 CMR 17.00, along with Nevada’s 603A, which took effect in January, represent a new class of state regulations that require organizations to deploy specific controls to protect personal identifying information from unauthorized access. Massachusetts and Nevada have established a new standard for personal data protection and appear to have set the stage for more prescriptive laws at the federal level.