Data Breach Notification Statutes – Connecticut

Last Updated: 02/28/2024

• Applicable Statute: Conn. Gen. Stat. § 36a-701b
• Attorney General Notice Required: Yes.
  • Timing: No later than notice is given to residents.
  • Method: Form located at https://portal.ct.gov/AG/Data-Breach-Form/Data-Breach-Report-Submission-Form
  • Content: See above re form.
• Consumer Notice Requirements:
  • Timing: Must be made without unreasonable delay but no later than 60 days after discovery of the breach, unless shorter time is required by federal law. If, following 60 days after the discovery of a breach, additional Connecticut residents are identified whose personal information was breached or reasonably believed to have been breached, notification must be made as expediently as possible.
  •  Content: If Social Security numbers or tax identification numbers were or are reasonably believed to have been breached, notice to affected residents must contain an offer of appropriate identity theft prevention services and, if applicable, identity theft mitigation services at no cost for a period of not less than 24 months. Must also provide all information necessary for affected residents to enroll in such services as well as on how to place a credit freeze on the affected resident’s credit file.
  •  If a resident’s username or email address, in combination with a password or security question and answer that would permit access to an online account was affected, notice must direct the resident to promptly change any password or security question and answer, or to take other appropriate steps to protect the affected online account and all other online accounts for which the resident uses the same username or email address and password or security question and answer.
  •  Method: Notice to an affected resident may be by written, telephonic, or electronic if consistent with the provisions regarding electronic records and signatures set forth in E-SIGN. Substitute notice may be available under certain circumstances.
  •  If a resident’s email account provided by the subject entity was breached or reasonably believed to have been breached, notice cannot be made to that same email address unless the subject entity can reasonably verify the affected resident’s receipt of such notice.