Law note · Connecticut
Connecticut Data Privacy Act (CTDPA), general applicability and controller/processor duties
CTDPA governs private-sector processing of Connecticut residents' personal data. Enacted as Public Act 22-15 (S.B. 6, 2022), effective July 1, 2023. Controller and processor duties are allocated at sections 42-515 to 42-524. S.B. 1295, enacted as Public Act 25-113 (signed June 25, 2025), substantially amended the Act, with amendments effective July 1, 2026, including a lower applicability threshold and an expanded profiling opt-out.
The base chapter as published at cga.ct.gov's 'current' text had not yet folded this Public Act in as of this review, since that page directs readers to a separate 2026 Supplement; the July 1, 2026 effective date and the amendment's substance are confirmed against the enrolled Public Act 25-113 text itself, read during review.
What it asks of an app
- Confirm you conduct business in Connecticut, or produce a product or service targeted at Connecticut residents, and process or sell personal data before relying on CTDPA's scope in compliance planning.
- Reassess your applicability threshold against the 2026 amendments (S.B. 1295) rather than the original 2023 thresholds; secondary reporting describes a lower consumer-count trigger effective July 1, 2026.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Connecticut statute text, Chapter 743jj, Connecticut General Statutes