The original Jan. 1 deadline for complying with Massachusetts' data security law has been extended until May 1, 2009.