Law / United States / 
Connecticut
Breach of security re computerized data containing personal information
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A breach notification rule binding public and private bodies.
As of 2 September 2026.
What it requires
- Notify each affected Connecticut resident of a breach of security involving personal information without unreasonable delay and no later than 60 days after discovery, unless federal law requires a shorter time.
- Expect a breach-notice violation to expose you to a private suit for damages under CUTPA, section 42-110g, even though CTDPA itself bars a private right of action.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Because a breach-notice violation is enforced as an unfair trade practice under Conn. Gen. Stat. sec. 42-110b, the Attorney General may petition to recover, on the state's behalf, a civil penalty of up to $5,000 per wilful violation under CUTPA's general civil-penalty provision (sec. 42-110o(b)); the Commissioner of Consumer Protection may separately impose a civil penalty up to the same amount, or order restitution below $10,000, after an administrative hearing (sec. 42-110d).
- Rule
- Per violation only
- As of
- 2 September 2026
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Statutory damages
A prevailing plaintiff recovers actual ascertainable loss; the court may award punitive damages in its discretion, but CUTPA sets no fixed or minimum per-person amount (Conn. Gen. Stat. sec. 42-110g(a)). Class actions on behalf of similarly situated Connecticut residents are authorized (sec. 42-110h).
- As of
- 2 September 2026
- Class action available
- Yes
Who enforces it
Enforcement body
Connecticut Attorney General; a violation is deemed an unfair trade practice under sec. 42-110b, which also arms a private plaintiff through CUTPA's own private right of action (sec. 42-110g).
What it reaches
Obligation class
Breach notice
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A person who owns, licenses, or maintains computerized data including personal information must notify each affected Connecticut resident of a breach without unreasonable delay, and no later than 60 days after discovery unless federal law requires a shorter time. 'Personal information' excludes publicly available information lawfully made available to the general public from government records or widely distributed media.
Unlike CTDPA, which bars a private right of action outright, this breach-notification section deems a violation an unfair trade practice under section 42-110b, and CUTPA's own private-action provision, section 42-110g, lets any person who suffers an ascertainable loss from a practice prohibited by section 42-110b sue for damages, so a breach-notice violation carries indirect private-plaintiff exposure that the comprehensive act does not.
This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
official Connecticut statute text, Chapter 669, Connecticut General Statutes
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.