960 CMR, § 2.12
Each agency shall maintain as an audit trail records which show any disclosure of personal data the agency holds. In the case of personal data systems in which personal data is stored, in whole or in part, in a computer or in electronically controlled or accessible files, the audit trail shall include a complete and accurate record of every disclosure of personal data, including the identity of all persons and organizations to whom such disclosure has been made and their declared intentions regarding the use of the personal data disclosed. In the case of all other personal data systems, the audit trail shall include such information to the maximum extent feasible. The audit trail shall be deemed part of the data to which it relates for all purposes under 960 CMR 2.00.
960 CMR, § 2.12