Connecticut Data Breach Notification Law

The Connecticut data breach notification law's 60-day rule

Discovery starts a 60-day count, and the letters should not wait for the last day: the standard inside the window is without unreasonable delay ¹. Any federal rule with a shorter clock takes over. People you identify only after day 60 get their letters as fast as possible once found ².

Three more features shape the plan:

• An Attorney General filing for every notifiable breach. No headcount threshold; the filing goes no later than the resident letters ².
• Two years of identity protection. If Social Security or taxpayer ID numbers were involved, affected people must be offered identity theft prevention services, plus mitigation services where applicable, at no cost for at least 24 months ².
• A broad data list, set out next.

Data covered by the Connecticut law

Beyond the usual name-plus-number combinations, the statute protects ²:

• Taxpayer ID numbers, including an IRS identity protection PIN
• Passport and military ID numbers
• A credit or debit card number on its own, with no security code needed
• Medical and health insurance information
• Biometric data
• Precise geolocation, added by Public Act 23-98 in 2023
• Login credentials for an online account

The bare card number entry catches shops, restaurants and clinics with card numbers sitting in an old point-of-sale export. A hijacked email login counts too, though few owners think of a phished password as a reportable breach.

The no-harm exception and the encryption rule

An appropriate investigation that leads to a reasonable conclusion that harm is not likely lets a business skip the letters ². Connecticut does not demand that conclusion on paper or a copy to the Attorney General. Write it up anyway and have counsel sign off, because a skipped notice is the call most likely to be questioned later.

Encryption works by definition: only access to data not secured by encryption or a similar unreadable-or-unusable method is a breach ². A stolen key is not mentioned. If it went with the files, treat the data as exposed and get advice.

Who enforces the Connecticut law

Noncompliance is an unfair trade practice under the Connecticut Unfair Trade Practices Act, enforced by the Attorney General ². The breach section carries no penalty number of its own.

CUTPA has a separate private action clause, and the breach statute does not say whether it covers notice failures. Assume a customer lawsuit is possible.

A payroll service, IT provider or other firm holding your records must tell you immediately after discovering a breach ². Put that duty in plain words in your managed IT contract.

Responding to a Connecticut breach

Mid-attack, a Connecticut policyholder notifies the carrier first, reports the crime through the FBI's IC3 portal, and stops anyone from wiping a server until a forensic copy is made ³⁴⁵. If the policy assigns counsel, let it. The checks carriers run before and after a claim are covered separately.

Then:

1. Put your IT company or an outside containment team on the intrusion.
2. Pin down the data and list people by home state. Staff commuting from New York or Massachusetts are protected by those states' laws, and the comparison of all state deadlines shows which are shorter.
3. Line up the identity protection vendor early when SSNs or taxpayer IDs were taken, because the offer has to appear in the letter.
4. File with the Attorney General no later than the resident mailing.

Clinics also work under HIPAA's patient notice rule. Local support pricing is on our Hartford and Stamford pages.

Section 36a-701b was compared with this text on October 13, 2026. We explain the law here; legal advice on your facts, including any shorter federal deadline, has to come from Connecticut counsel.