Each state’s law applies only to the extent that the plan fiduciaries maintain personal information about a resident of that particular state. If the plan does not process any personal information of a Massachusetts resident and will not be sending any Massachusetts information to a service provider, then Massachusetts law will not apply. However, even then, there is no question that it has become a generally accepted practice and an advisable risk mitigation tool for companies—in any industry—to implement a data-related service provider management program that meets these obligations.