Services / Privacy Compliance / Connecticut
Breach and consumer notification laws in Connecticut — what a business must do when personal information is lost or exposed.
Did you know? Every state sets its own rules for when a breach is reportable, who must be told and how. In Connecticut:
There are specific considerations when determining if a breach is reportable
Education-sector vendor contracts must include breach of security obligations
Appropriate identity theft prevention services — and mitigation services where applicable — are mandatory
Sector statutes differ: entities regulated by the Insurance Commissioner have a 5-day deadline; student data statutes range from 48 hours to 60 days
Notifications may only be given by specific methods
Notification must be given to the State Attorney General
If a vendor is breached, they must report it to the data owner, who is responsible for reporting and consumer notification
If your breach affects residents of other states, you must notify them under that state’s rules
Violating the statutes constitutes an unfair trade practice
Connecticut has additional laws protecting personal data to prevent a breach
Federal laws, industry regulations and out-of-country laws may also apply
Please note
This summary of regulations is provided for information purposes only. No action based on this summary alone should be undertaken. Each individual or entity must obtain appropriate guidance for its specific circumstances.
© 2018 CSR. All rights reserved. CSR refers to the corporation CSR Professional Services, Inc.
Readiness Pro
CSR Readiness Pro and the Breach Reporting Service handle the reporting and notification rules for you.
Mon – Fri · 8:00am – 5:30pm
Privacy compliance
Get started
Secure, scheduled shredding is the simplest way to keep paper records out of a breach report. Save 10% on your initial shred.
Mon – Fri · 8:00am – 5:30pm
