Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Connecticut |
|---|---|
| Statute citation | Conn. Gen. Stat. § 36a-701b (Banking Law of Connecticut - Breach of Security re Computerized Data) (amended 2023) |
| Individual notice timing | 60 days Connecticut requires businesses/persons to notify affected residents without unreasonable delay |
| Attorney general notice | Yes Connecticut requires AG notification no later than the time notice is provided to affected residents for |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | Yes |
| Breach definition (excerpt) | In Connecticut 'breach of security' means unauthorized access to or unauthorized acquisition of electronic files, media, databases or computerized data, containing personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. 1 |