Compliance Briefing — July 1, 2023
Connecticut's Data Privacy Act now governs controllers serving state residents, pressing boards to institutionalise privacy governance, deliver verifiable opt-out and consent workflows, and build mature DSAR operations ahead of Attorney General oversight.
Executive briefing: Connecticut’s Data Privacy Act (CTDPA), codified at Public Act 22-15, is enforceable as of 1 July 2023. The statute captures controllers that conduct business in the state or target its residents and either process data for at least 100,000 consumers in a year (excluding strictly payment transactions) or process data for 25,000 consumers while deriving 25 percent of gross revenue from the sale of personal data. Financial institutions subject to the Gramm-Leach-Bliley Act, covered entities and business associates regulated by HIPAA, and nonprofit organisations are exempt, yet most digital platforms, retailers, and data-driven service providers serving Connecticut households must now operate with an enterprise-grade privacy programme.
The CTDPA imports many familiar requirements from the Colorado Privacy Act and Virginia Consumer Data Protection Act but introduces Connecticut-specific expectations around board-level accountability, documented implementation roadmaps, and appealable data subject request (DSAR) handling. The Attorney General (AG) retains exclusive enforcement authority and can seek civil penalties under the Connecticut Unfair Trade Practices Act, with a discretionary 60-day cure period that remains available until 31 December 2024. Enterprises therefore need auditable governance controls in place now, because the grace period will sunset before universal opt-out signals become mandatory on 1 January 2025.
Governance checkpoints for directors and privacy leaders
- Board reporting cadence. Directors should mandate quarterly privacy risk reporting that summarises CTDPA compliance posture, DSAR backlogs, opt-out metrics, and remediation activity. Minutes should document how the board reviews AG guidance updates, confirms funding for privacy operations, and tracks cross-jurisdictional harmonisation.
- Charter updates. Audit or risk committee charters need explicit references to CTDPA oversight so that management’s privacy impact assessments (PIAs) and data protection assessments (DPAs) are escalated for review. Embedding CTDPA duties in committee charters demonstrates reasonable governance if the AG questions programme adequacy.
- Policy ownership. The board should confirm that the chief privacy officer (CPO) or general counsel owns written policies on sensitive data approval, DSAR triage, vendor onboarding, and record retention. Policies must cite CTDPA definitions (for example, “sale” includes exchanges for monetary or other valuable consideration) and identify accountable executives.
- Training oversight. Directors should verify that privacy, marketing, customer service, and engineering teams receive role-specific CTDPA training. Maintaining signed acknowledgements and learning completion dashboards reduces enforcement risk where human error causes DSAR delays.
Implementation blueprint for controllers
Operationalising CTDPA requirements demands more than legal memos. Controllers should develop an execution roadmap that sequences inventory, technical builds, and third-party governance. Programme milestones include:
- Data inventory refresh. Catalogue personal data elements, purposes, retention periods, and system dependencies. Connecticut’s statute expects controllers to know whether data supports targeted advertising, profiling, or sale so that DPAs can be scoped precisely. The inventory also anchors the privacy notice disclosures required by §5 of the Act.
- Purpose and minimisation review. Map each processing activity to a documented purpose and evaluate whether the same outcome can be achieved with less data. CTDPA’s duty of data minimisation mirrors GDPR Article 5; regulators will expect evidence that controllers reject unnecessary data collection, particularly for biometric identifiers and precise geolocation.
- Consent and opt-out architecture. Build a unified preference centre that honours opt-outs for targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects. Controllers targeting consumers aged 13–15 must obtain opt-in consent before serving targeted advertising or selling data, while processing sensitive categories (such as health, racial or ethnic origin, religious beliefs, or children’s data) always requires consent. Product and engineering teams should record workflows for capturing, storing, and revoking consent across web, mobile, and connected devices.
- Universal opt-out readiness. Although the requirement to recognise user-enabled global privacy controls begins in 2025, build detection logic now. Engineering should document how the browser signals will be parsed, mapped to consumer profiles, and propagated to advertising technology and downstream processors within 15 days.
- Processor contract remediation. Refresh vendor agreements so that processors must adhere to confidentiality, assist with DSAR fulfilment, enable audits, and delete or return data at contract termination. Connecticut specifies these contractual terms in §6, and boards should track remediation progress for high-risk vendors handling targeted advertising or analytics workloads.
- Security alignment. CTDPA requires reasonable administrative, technical, and physical safeguards. Security and privacy teams should align CTDPA control narratives with existing NIST CSF or ISO 27001 frameworks, especially around incident response and identity access management to prevent unauthorised disclosures.
DSAR operating model and service-level management
Connecticut consumers can submit authenticated requests to access, correct, delete, and obtain copies of their data in a portable format, and can opt out of targeted advertising, sale of personal data, or profiling. Controllers must acknowledge and fulfil requests within 45 days, with a single 45-day extension when reasonably necessary. Meeting this standard requires a disciplined operating model:
- Intake channels. Provide at least two secure submission methods—such as an online portal and toll-free number—and clearly describe them in the privacy notice. Capture metadata at intake (request type, identity verification status, channel, and sensitive data flag) to support reporting.
- Identity verification. Deploy risk-based verification that adapts to data sensitivity. For access or portability requests, require multi-factor verification or knowledge-based authentication. For opt-outs, a one-click authenticated dashboard may suffice.
- Workflow automation. Route DSARs through a ticketing platform that integrates with data discovery tools (for example, data catalogues, CRM exports, marketing databases). Maintain system connectors that can search, redact, and extract personal data with minimal manual handling.
- Appeals management. CTDPA compels controllers to offer an appeals process when requests are denied. Build an appeal escalation path to privacy leadership, respond within 60 days, and inform consumers about contacting the AG if dissatisfied. Log the rationale for denials—such as security exemptions or inability to verify identity—so that repeat issues trigger control improvements.
- Children’s data safeguards. For requests involving minors, embed parental consent verification and document compliance with the federal Children’s Online Privacy Protection Act (COPPA). Denials should cite the statutory basis and outline remediation steps.
- Metrics and testing. Track mean time to fulfilment, backlog aging, appeal reversal rates, and opt-out execution latency. Quarterly tabletop exercises that simulate high-volume DSAR waves prepare teams for AG inquiries or coordinated advocacy campaigns.
Documentation and assessment requirements
Connecticut mandates data protection assessments for processing activities that present a heightened risk of harm, including targeted advertising, sale of personal data, profiling that produces legal effects, the processing of sensitive data, and any processing presenting a heightened risk. Assessments should catalogue processing purposes, benefits, risks to consumers, mitigation controls, and a comparison to benefits. Boards should require management to store assessments for at least three years and retrieve them promptly if the AG issues a civil investigative demand. Integrating CTDPA assessment templates with existing GDPR DPIA tooling reduces duplication.
Privacy notices must describe processed categories, purposes, how consumers can exercise rights, the categories of personal data shared with third parties, and the categories of third parties receiving the data. Notices must also state how consumers may appeal a refusal. Marketing teams should align Connecticut disclosures with California Consumer Privacy Act (CCPA) and Colorado CPA statements while preserving CT-specific references to profiling opt-outs and universal opt-out signals.
Enforcement watchlist and cross-jurisdiction alignment
The AG has published FAQs emphasising enforcement priorities: transparent notices, working DSAR portals, prompt opt-out execution, and substantiated data protection assessments. Controllers should monitor AG press releases for investigative themes, such as deceptive advertising, children’s privacy, and biometric data misuse. Because Connecticut’s law largely harmonises with Colorado and Virginia, establishing a multi-state privacy steering committee helps coordinate policies, share tooling, and maintain consistent records of processing activities.
Companies subject to sectoral regulations—such as financial institutions, utilities, or healthcare providers—should map CTDPA obligations to overlapping frameworks. For example, aligning DSAR verification with Gramm-Leach-Bliley Act customer authentication, or ensuring HIPAA authorisation workflows feed into CTDPA deletion responses, prevents contradictory actions.
Action plan for the next 90 days
- Week 1–2: Convene a cross-functional steering committee, approve a governance charter, and review current inventories, notices, and DSAR statistics. Document board oversight expectations.
- Week 3–6: Refresh data maps, identify gaps in consent capture, and remediate processor contracts. Design DSAR intake enhancements and appeals routing, and begin universal opt-out signal testing.
- Week 7–10: Finalise privacy notice revisions, publish preference centre updates, and deploy targeted staff training. Execute tabletop exercises covering complex DSAR scenarios, including combined access and deletion requests involving backup systems.
- Week 11–13: Complete data protection assessments for high-risk processing, deliver a dashboard to the board or audit committee summarising compliance metrics, and record remediation evidence to leverage the AG’s cure period if issues surface.
Zeph Tech supports controllers with Connecticut-ready governance frameworks, privacy engineering sprints, and DSAR automation accelerators that align with Attorney General expectations.
Continue in the Compliance pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Third-Party Risk Oversight Playbook — Zeph Tech
Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.
-
Compliance Operations Control Room — Zeph Tech
Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.
-
SOX Modernization Control Playbook — Zeph Tech
Modernize Sarbanes-Oxley (SOX) compliance by aligning PCAOB AS 2201, SEC management guidance, and COSO 2013 controls with data-driven testing, automation, and board reporting.