Skip to content
Network USA

CT · Breach notification statute

Connecticut data breach notification law

A summary of the Connecticut breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

Conn. Gen. Stat. § 36a-701b (Banking Law of Connecticut - Breach of Security re Computerized Data) (amended 2023)

Last amended
2023 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

60 days Connecticut requires businesses/persons to notify affected residents without unreasonable delay

Attorney general notice

Yes Connecticut requires AG notification no later than the time notice is provided to affected residents for

What counts as a breach

In Connecticut 'breach of security' means unauthorized access to or unauthorized acquisition of electronic files, media, databases or computerized data, containing personal information when access to the personal information has not been secured by encryption or by any other method or technology that renders the personal information unreadable or unusable. 1

What counts as personal information

In Connecticut 'personal information' means an individual's first name or first initial and last name in combination with any one or more of the following data: Social Security number; taxpayer identification number; identity protection PIN from IRS; driver's license, state ID, passport, military ID, or other government ID number; credit or debit card number; financial account number with security code/password; medical information; health insurance information; biometric data; or precise geoloc

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredYes

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Connecticut

146 reports to HHS OCR affecting 11,380,761 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Connecticut.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Yale New Haven Health SystemHealthcare Provider5,556,702Apr 11, 2025Hacking/IT IncidentArchive (closed)
Community Health Center, Inc.Healthcare Provider1,060,936Jan 30, 2025Hacking/IT IncidentArchive (closed)
Aetna ACEHealth Plan484,157Dec 22, 2020Hacking/IT IncidentArchive (closed)
CareCentrix, Inc.Healthcare Provider467,621Jul 11, 2019Hacking/IT IncidentArchive (closed)
United Healthcare Services, Inc. Single Affiliated Covered EntityHealth Plan398,319Jul 28, 2023Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must Connecticut businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Connecticut timing rule as: "60 days Connecticut requires businesses/persons to notify affected residents without unreasonable delay". (Source: PRC 2026 survey extract.)

Does Connecticut require notice to the attorney general?

The PRC 2026 extract notes: "Yes Connecticut requires AG notification no later than the time notice is provided to affected residents for". (Source: PRC 2026 survey extract.)

Does the Connecticut law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the Connecticut breach law.

Does the Connecticut law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the Connecticut breach law.

Does the Connecticut law cover paper records?

No. The PRC 2026 survey records the Connecticut law as covering computerised data only, not paper records.

Is there a private right of action in Connecticut?

Yes. The PRC 2026 survey records a private right of action under the Connecticut breach law.

Is credit monitoring required in Connecticut?

Yes. The PRC 2026 survey records a credit monitoring requirement in Connecticut.

How does the Connecticut law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Connecticut statute, and see our HIPAA vs state breach notification laws guide.

Sources