Applicability

What it requires

Applies to any person that meets one of three independent triggers. Under Public Act No. 25-113 (signed June 24, 2025, effective July 1, 2026), the prior 100,000/25,000-consumer thresholds are replaced by: (1) conducting business in Connecticut, or producing products or services targeted to Connecticut residents, and processing the personal data of at least 35,000 consumers in the preceding calendar year; (2) controlling or processing consumers' sensitive data in any amount, with no consumer-count floor; or (3) offering consumers' personal data for sale in trade or commerce, also with no consumer-count floor. A business can therefore fall in scope solely by touching sensitive data or selling personal data, regardless of how many consumers' records it processes. On the linked 2026 Supplement page, the version in force from July 1, 2026 follows the superseded text in the section's entry.

Statute text

The provisions of sections 42-515 to 42-525, inclusive, apply to persons that: (1) Conduct business in this state, or produce products or services that are targeted to residents of this state, and during the preceding calendar year controlled or processed the personal data of not fewer than thirty-five thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; (2) control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction; or (3) offer consumers' personal data for sale in trade or commerce.

Connecticut Data Privacy Act, § 42-516Read the full section from Connecticut Office of the Attorney General