Connecticut Data Privacy Act

Non-profit organizations, higher education institutes, national securities associations, financial institutions subject to the Gramm–Leach–Bliley Act (GLBA), and state bodies, authorities, boards, bureaus, commissions, districts, and agencies are exempt from the CTDPA;

CTDPA does not apply to certain information such as protected health information, patient identification, information used for public health activities, personal data regulated by Family Educational Rights and Privacy Act, and data processed and controlled under Farm Credit Act, etc.;

A controller must respond to all consumer rights requests without undue delay but not later than forty-five (45) days after receiving the request;

The controller may request forty-five (45) additional days extension if reasonably necessary to respond to consumer rights requests;

A controller may charge the consumer a reasonable fee to cover the administrative costs of complying with consumer requests if they are manifestly unfounded, excessive, or repetitive;

All controllers are required to have a privacy policy on their website that includes the categories of personal data processed by the controller, the purpose for processing personal data, how consumers may exercise their consumer rights, the categories of personal data that the controller shares with third parties, the categories of third parties, if any, with which the controller shares personal data, and an active electronic mail address or other online mechanisms that the consumer may use to contact the controller;

All controllers must conduct and document a data protection assessment for each of the controller's processing activities that presents a heightened risk of harm to a consumer;

During the period beginning on July 1, 2023, and ending on December 31, 2024, the Attorney General shall, before initiating any action for a violation of the CTDPA, issue a notice of violation to the controller if the Attorney General determines that a cure is possible;

The controller will have sixty (60) days from the receipt of the notice to cure any violation.