Law / United States / 
Connecticut
Data security incidents: initial notification to the Department of Banking within three business days by banks, credit unions and licensees
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- If you are a licensee under title 36a of the Connecticut General Statutes, a Connecticut bank or a Connecticut credit union, file an initial notification with the Department of Banking, in the form and manner the Banking Commissioner prescribes, not later than three business days after you know, or have reason to know, of a data security incident that may materially impact your ability to operate in a safe and sound manner or comply with applicable laws and regulations, cause significant disruption in customer services, or involve unauthorized access to the personal information of any individual (section 36a-44a(c)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Subsection (c) requires a licensee, Connecticut bank or Connecticut credit union to file an initial notification with the Department of Banking within three business days of knowing or having reason to know of a data security incident of the kind it describes, and lets the Banking Commissioner request more information afterward. A notification is a filing with the regulator and no clause tells the entity to keep a record of an incident, a log, a retention period or an audit.
- Kind
- None
- As of
What this law does
Each licensee under title 36a of the Connecticut General Statutes, each Connecticut bank and each Connecticut credit union must file an initial notification with the Department of Banking, in a form and manner the Banking Commissioner prescribes, not later than three business days after it knows, or has reason to know, of the occurrence of a data security incident of the kind the subsection describes.
The incidents that call for the notification are those that may materially impact the entity's ability to operate in a safe and sound manner or comply with applicable laws and regulations, cause significant disruption in customer services, or involve unauthorized access to the personal information of any individual.
A data security incident is any unauthorized access to or unauthorized acquisition, destruction or corruption of electronic files, media, databases or computerized data containing personal information of an individual, or supervisory, financial, operational or business information of a licensee under title 36a, a Connecticut bank or a Connecticut credit union. Personal information has the meaning given in section 36a-701b of the general statutes.
The Banking Commissioner may request additional information about an occurrence after the initial notification is filed. Section 1 of Public Act 26-51, which rewrites section 36a-44a, takes effect on . Public Act 26-51 was approved on .
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .