Law / United States / 
Connecticut
Connecticut Data Privacy Act (CTDPA), general applicability and controller/processor duties
Conn. Gen. Stat. §§ 42-515, 42-524
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Confirm you conduct business in Connecticut, or produce a product or service targeted at Connecticut residents, and process or sell personal data before relying on CTDPA's scope in compliance planning.
- Reassess your applicability threshold against the 2026 amendments (S.B. 1295) rather than the original 2023 thresholds; secondary reporting describes a lower consumer-count trigger effective .
- Do not sell a consumer's precise geolocation data, whether as a controller or as a third party.NIST Privacy FrameworkCT.PO-P1
- If you use facial recognition technology on your premises to prevent, detect or respond to security incidents, fraud or similar activity, use it only to match images against a database you maintain, and post signage at each entrance, other than an entrance to an area restricted to authorized employees, that links to your facial recognition technology policy.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Connecticut (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act
- Guidance body
- Office of the Attorney General of Connecticut
- Open questions
- Does a business produce a product or service 'targeted to residents of this state' under Conn. Gen. Stat. § 42-516 when it offers a nationwide online service that is not directed at Connecticut in particular?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer: targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of injury, and the processing of sensitive data. The assessment weighs the benefits of the processing to the controller, the consumer, other stakeholders and the public against the risks to the consumer, as mitigated by safeguards, with the use of de-identified data and consumers' reasonable expectations factored in. The Attorney General may require the controller to disclose any assessment relevant to an investigation, and the assessment stays confidential and exempt from the Freedom of Information Act. The section sets no period for keeping the assessment. Section 42-521 separately has the processor give the controller the information needed to conduct and document assessments, make available on reasonable request the information that shows its compliance, and allow reasonable assessments of its policies; that processor-side duty is a request between the two parties and is not a record the controller keeps. The row's citation lists sections 42-515 and 42-524 and its summary describes the controller and processor duties as sections 42-515 to 42-524, so sections 42-516, 42-520, 42-521 and 42-522 were read. Section 42-520 (data security practices, privacy notice) names no log or record. The Public Act 25-113 amendment adding an impact assessment for profiling is not in the chapter text read for this row.
- Kind
- Explicit
- As of
- Provision
- Conn. Gen. Stat. 42-522(a)
- Trigger
- personal_data_processing
What this law does
CTDPA governs private-sector processing of Connecticut residents' personal data. Enacted as Public Act 22-15 (S.B. 6, 2022), effective . Controller and processor duties are allocated at sections 42-515 to 42-524. S.B. 1295, enacted as Public Act 25-113 (approved ), substantially amended the Act, with amendments effective , including a lower applicability threshold and an expanded profiling opt-out.
The base chapter as published at cga.ct.gov's 'current' text has not yet folded this Public Act in, directing readers to a separate 2026 Supplement instead; the effective date and the amendment's substance are confirmed against the enrolled Public Act 25-113 text itself. Public Act 26-64 (Senate Bill 4) was approved on . Its section 12 amends section 42-515 with effect from . From that date no controller may sell any consumer's precise geolocation data.
No third party may sell any consumer's precise geolocation data either. A controller that uses facial recognition technology on its premises to prevent, detect or respond to security incidents, fraud or similar activity must use it exclusively to match images against a database that the controller itself maintains.
That controller must also post signage at each entrance to the premises, other than an entrance to an area restricted to authorized employees, that links to its facial recognition technology policy. The definition of publicly available information is rewritten and excludes, among other things, an intimate image known to be nonconsensual.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .