Skip to Primary Navigation

Connecticut Data Privacy Act (CTDPA)

Establishes comprehensive privacy rights for Connecticut residents and obligations for businesses handling personal data.

Rule Overview

Jurisdiction: Connecticut

Regulator: Connecticut Attorney General's Office

Topic: Data Protection

Public Act No. 22-15
Overview
Latest News
Further Reading

The CTDPA grants individuals the right to:

  • Confirm whether a business processes their personal data and to access that information.
  • Correct inaccuracies in their personal data.
  • Have personal data deleted.
  • Obtain a portable copy of their data.
  • Opt-out of the sale of personal data, targeted advertising, and profiling.

The CTDPA requires covered entities to:

  • Limit data collection to what is strictly “adequate, relevant, and necessary” for disclosed purposes.
  • Obtain explicit, affirmative opt-in consent before processing sensitive data.
  • Recognize browser-based or device-based opt-out signals.
  • Conduct formal data protection assessments for high-risk activities like targeted advertising or profiling.
View More News