Agencies may enter into contracts to hold personal data but no such contract shall relieve the agency of its

obligations under 950 CMR 33.00. Every such contract shall include such provisions as are necessary to ensure compliance with these regulations and the Attorney General may treat the violation of any such provisions as a violation of M.G.L. c. 214, § 3B.