1. Home
  2. State breach laws
  3. Connecticut

Connecticut data breach notification law

What Connecticut requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Conn. Gen. Stat. § 36a-701b.

60 days
Notification deadline
Required
AG notification
No
Private right of action
Limits punitive damages
Liability protection

What this means if you sell security services

Connecticut's 60-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits. Connecticut also limits punitive damages in breach lawsuits for organizations with a qualifying security program, a concrete state-law reason for a prospect to build and document one.

See recent Connecticut breach filings →

Requirements in detail

Statute
Conn. Gen. Stat. § 36a-701b
Deadline to notify residents
Without unreasonable delay, but no later than 60 days after discovering the breach, unless federal law requires a shorter time. Notice can be delayed while a law enforcement agency says it would impede a criminal investigation, and additional residents identified after 60 days must be notified as quickly as possible.
Attorney General notification
Yes, for every breach that requires notice to residents, no later than when residents are notified. There is no minimum number of residents. The statute does not require notice to consumer reporting agencies.
Penalties
Failure to comply is an unfair trade practice under the Connecticut Unfair Trade Practices Act, enforced by the Attorney General. Willful violations carry civil penalties of up to $5,000 per violation. Entities must also offer at least 24 months of free identity theft prevention services when Social Security numbers or taxpayer identification numbers are breached.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Connecticut's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
Connecticut (2021) bars courts from awarding punitive damages in breach lawsuits against businesses that maintained a cybersecurity program conforming to a recognized framework, unless the business was grossly negligent or acted willfully or wantonly. These protections limit lawsuits; they don't change the duty to notify. Conn. Gen. Stat. § 42-901
Recent changes
None to § 36a-701b in 2024–2026. The last amendment was Public Act 23-98 (2023), which added precise geolocation data to the definition of personal information. In a related change, Public Act 26-51 (effective October 1, 2026) requires Connecticut banks, credit unions, and Banking Department licensees to notify the Department of Banking within three business days of certain data security incidents.

Connecticut breach notification FAQ

What is the data breach notification deadline in Connecticut?

Without unreasonable delay, but no later than 60 days after discovering the breach, unless federal law requires a shorter time. Notice can be delayed while a law enforcement agency says it would impede a criminal investigation, and additional residents identified after 60 days must be notified as quickly as possible. The governing law is Conn. Gen. Stat. § 36a-701b.

Does Connecticut require notifying the Attorney General of a data breach?

Yes, for every breach that requires notice to residents, no later than when residents are notified. There is no minimum number of residents. The statute does not require notice to consumer reporting agencies.

What are the penalties for failing to report a data breach in Connecticut?

Failure to comply is an unfair trade practice under the Connecticut Unfair Trade Practices Act, enforced by the Attorney General. Willful violations carry civil penalties of up to $5,000 per violation. Entities must also offer at least 24 months of free identity theft prevention services when Social Security numbers or taxpayer identification numbers are breached.

Can individuals sue over a data breach in Connecticut?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Connecticut?

Connecticut's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Connecticut limit breach lawsuits for companies with a cybersecurity program?

Connecticut (2021) bars courts from awarding punitive damages in breach lawsuits against businesses that maintained a cybersecurity program conforming to a recognized framework, unless the business was grossly negligent or acted willfully or wantonly. These protections limit lawsuits; they don't change the duty to notify.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Connecticut Attorney General before relying on them.

Other states with a 60-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →