Privacy Map

Connecticut. Breach notification. Act

CT breach lawConnecticut data breach notification law (Conn. Gen. Stat. § 36a-701b)

In force
Partly verifiedMedium confidence. CUTPA penalty figure from general provision; 2025 amendments to the breach statute not checked (search budget exhausted).

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Connecticut residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay, no later than 60 days after discovery. Covered data: name plus SSN, ID numbers, card/account numbers, taxpayer ID, IRS IP PIN, passport/military ID, medical and health insurance data, biometric data, precise geolocation; online credentials.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

AG notice for every notifiable breach, no threshold; mandatory 24 months of free identity theft prevention services where SSNs or taxpayer IDs are exposed; includes precise geolocation data.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Connecticut requires the maintaining entity to notify the owner immediately after discovering a breach. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals without unreasonable delay, no later than 60 days after discovery; AG no later than individuals (any breach requiring notice)
DPO
No
Cross-border transfers
None
Maximum penalty
Unfair trade practice under CUTPA; civil penalties up to $5,000 per wilful violation plus restitution

§3Dates

Key dates
  • Adopted
  • In force
  • Amended 2021 (PA 21-59: 60-day deadline) and SB 1058 / PA 23-98 (eff. 2023-10-01) adding precise geolocation

§4Text and authority

Text
Authority
Connecticut Attorney General

§5Where it applies

Domestic law of
Connecticut

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. CUTPA penalty figure from general provision; 2025 amendments to the breach statute not checked (search budget exhausted).