What is CTDPA?

The Connecticut Data Privacy Act (CTDPA) is a new state privacy law effective July 1, 2023. It applies to companies doing business in Connecticut that collect or sell Connecticut residents’ personal data.

The law grants Connecticut residents rights over their personal data held by companies, including:

• Right to know about their data
• Right to access their data
• Right to correct inaccuracies
• Right to delete their data
• Right to opt out of data sales or targeted ads

Companies must inform consumers about these rights in an easy-to-understand privacy policy.

The law also sets duties for companies handling Connecticut residents’ data, such as:

• Collect only necessary personal data
• Provide detailed privacy notice disclosure
• Get clear consent for using sensitive data
• Have reasonable security for protecting people’s information
• Address consumer requests within 45 days
• Do risk assessments for high-risk data activities like profiling
• Not discriminate against people exercising their privacy rights

Violations may result in fines of up to $5,000 per violation by the State Attorney General.

Check out how you can comply with CTDPA.