Connecticut Data Breach Law: Deadlines, Notice, and Penalties

Connecticut’s data breach notification law, codified at General Statutes § 36a-701b, requires any business that holds the personal information of Connecticut residents to notify affected individuals and the state Attorney General no later than 60 days after discovering a breach, offer at least 24 months of free identity theft protection when Social Security numbers or taxpayer ID numbers are exposed, and risk civil penalties of up to $5,000 per willful violation under the Connecticut Unfair Trade Practices Act.¹

What Counts as a Breach

A “breach of security” is unauthorized access to or acquisition of electronic files, databases, or computerized data that contains personal information, where the data was not protected by encryption or another method that made it unreadable.¹

Two exceptions keep an event out of the statute. The first is encryption: if the exposed data was properly encrypted and the key was not also exposed, there is no breach to report. If the key traveled with the data, the information is treated as if it had never been encrypted. The second is the harm exception. Even where unencrypted personal information was accessed, notification is not required if the organization conducts a real investigation and reasonably determines the breach will not likely result in harm to affected residents. This is not a quiet off-switch. The investigation and reasoning need to be documented, because the Attorney General can revisit that determination later.

Personal Information Covered by the Statute

The law protects a resident’s first name or first initial and last name when combined with any of the following:

Social Security numbers, taxpayer identification numbers, IRS identity protection PINs, driver’s license or state ID numbers, passport numbers, and military ID numbers
Credit or debit card numbers, and financial account numbers combined with any security code, access code, or password needed to use the account
Medical information about a person’s history, condition, or treatment, and health insurance policy or subscriber ID numbers
Biometric data such as fingerprints, voiceprints, or retina images used to verify identity
Precise geolocation data as defined by the Connecticut Data Privacy Act

A separate category stands on its own without a name attached: a username or email address paired with a password or security question that would unlock an online account.¹

Who Has to Comply

The statute applies to any person or business that owns, licenses, or maintains computerized data containing the personal information of Connecticut residents. Company size is not a factor. A multinational and a five-person accounting firm have the same obligations if they hold covered data.¹

When a third-party vendor experiences the breach, the obligation flows back to the data owner. The vendor must notify the business that owns the data, and that business then handles notification to residents and the Attorney General.

Federal Safe Harbors

Organizations subject to HIPAA and the HITECH Act are deemed compliant with Connecticut’s breach law as long as they meet their federal notification obligations. There is still a state hook: these entities must notify the Connecticut Attorney General no later than when they notify residents, if AG notification would otherwise be required.¹

Financial institutions regulated by a primary federal regulator under the Gramm-Leach-Bliley Act satisfy the state law by following their federal regulator’s breach procedures, but they too must notify the Connecticut Attorney General when they notify residents. The safe harbor removes duplicative procedures, not state oversight.

The 60-Day Deadline

Once a breach is discovered, residents must be notified no later than 60 days after discovery. If a shorter deadline applies under federal law, the federal deadline controls. The Attorney General must be notified no later than the time residents are, and in practice most businesses submit the AG report first or at the same time through the state’s online submission form.²

A law enforcement agency can ask that notification be delayed if it would impede a criminal investigation. The delay runs only as long as law enforcement says is necessary, and notices must go out once that hold is lifted.¹

If additional affected residents are identified after the 60-day window closes, the organization must act in good faith to notify them as expediently as possible. The statute does not set a hard second deadline, but the Attorney General can evaluate the pace of catch-up notices after the fact.

What the Notice Must Contain

The content requirements are built around giving residents something they can actually do.

When the breach involves a Social Security number or a taxpayer identification number, the organization must offer free identity theft prevention and mitigation services for at least 24 months. The notice must include everything the resident needs to enroll, along with instructions for placing a credit freeze.¹ The Attorney General’s office has confirmed the 24-month floor is tied specifically to these two data types.² For breaches involving other categories (driver’s license numbers, financial account data, medical records), the statute does not mandate a specific duration of identity theft services. Many businesses still offer them, but it is not required by this law.

When the breach involves online login credentials, the notice can be delivered electronically and should direct the resident to change the compromised password right away. It should also warn the resident to update any other accounts where the same credentials were reused.¹

How Notice Is Delivered

Notices can go out by written mail, telephone, or electronic communication, provided the resident previously consented to electronic notices under federal e-signature standards. If none of those methods is feasible, the statute allows substitute notice if the organization can show the Attorney General that individual notice would cost more than $250,000, the affected group is larger than 500,000 people, or the organization does not have enough contact information.¹

Substitute notice is not a single step. It requires all three of these: email notice to any affected individuals whose email addresses the organization has, conspicuous posting on the organization’s website, and notification to major statewide media including newspapers, radio, and television.

Penalties for Failing to Notify

The Connecticut Attorney General enforces § 36a-701b through the Connecticut Unfair Trade Practices Act (CUTPA). A failure to comply with the notification requirements is treated as an unfair trade practice.²

For willful violations, the Attorney General can seek a civil penalty of up to $5,000 per violation. A violation is “willful” when the party knew or should have known its conduct broke the law.³ In a breach touching thousands of residents, per-violation penalties can stack up quickly.

Can Residents Sue Directly?

No. The breach notification statute does not give individual residents a private right of action against a business that failed to notify them. Enforcement sits with the Attorney General’s office. Residents can file complaints with the AG, but they cannot bring their own lawsuits under this statute. A breach may still give rise to other claims (negligence, broader CUTPA consumer protection theories), but those are separate causes of action with their own requirements.

Other Rules That May Apply Alongside This Law

The breach notification statute is not the only obligation a Connecticut business may face after an incident. The Connecticut Data Privacy Act, which took effect in 2023, requires controllers to maintain reasonable administrative, technical, and physical data security practices and expressly requires processors to assist controllers with breach notification under § 36a-701b.⁴ Publicly traded companies also have an SEC obligation to file an Item 1.05 Form 8-K within four business days of determining that a cybersecurity incident is material, which runs on a separate track from the state’s 60-day window.⁵ Non-banking financial institutions, including tax preparers, mortgage brokers, and auto dealers that offer financing, also have breach obligations under the FTC Safeguards Rule.⁶ Meeting one of these does not satisfy the others.

1
Justia. Connecticut Code 36a-701b – Breach of Security re Computerized Data Containing Personal Information
2
Office of the Attorney General. Reporting a Data Breach
3
Connecticut General Assembly. Chapter 735a – Unfair Trade Practices
4
Connecticut General Assembly. Chapter 743jj – Data Privacy and Security
5
U.S. Securities and Exchange Commission. Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents
6
Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know