Connecticut Data Privacy Act (CTDPA)

United States — Connecticut

v2022 (effective 2023)

6 domains

27 controls

The Connecticut Data Privacy Act (CTDPA), signed into law in June 2022 and effective July 1, 2023, establishes comprehensive consumer privacy rights for Connecticut residents. It provides rights to access, delete, correct, and opt out of the sale of personal data and targeted advertising. The law applies to any entity that conducts business in Connecticut or processes the personal data of Connecticut residents, regardless of where the entity is located.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

CTDPA: Consumer Rights (42-518)

8 controls

Controls in the CTDPA: Consumer Rights (42-518) domain of Connecticut Data Privacy Act (CTDPA) — 8 controls
Code	Title	Description
CTDPA-42-518-ACCESS	Right to Confirm and Access	Consumers may confirm whether a controller is processing their personal data and access that data.
CTDPA-42-518-AUTHAGENT	Authorized Agents	Consumers may designate an authorized agent (including via technology) to exercise the opt-out right on their behalf.
CTDPA-42-518-CORRECT	Right to Correct	Consumers may correct inaccuracies in their personal data, taking into account the nature and purpose of processing.
CTDPA-42-518-DELETE	Right to Delete	Consumers may delete personal data provided by or obtained about them.
CTDPA-42-518-OPTOUT	Right to Opt Out	Consumers may opt out of processing for targeted advertising, the sale of personal data, or profiling in furtherance of...
CTDPA-42-518-PORT	Right to Data Portability	Consumers may obtain a portable, readily usable copy of personal data they previously provided.
CTDPA-42-518-RESPONSE	Response Timeline and Appeal	Controllers must respond within 45 days (extendable by 45), provide information free of charge up to twice annually, and...
CTDPA-42-518-UOOM	Universal Opt-Out Mechanism	By 1 January 2025 controllers must recognise an opt-out preference signal (universal opt-out mechanism) for targeted adv...

CTDPA: Controller Duties (42-520)

9 controls

Controls in the CTDPA: Controller Duties (42-520) domain of Connecticut Data Privacy Act (CTDPA) — 9 controls
Code	Title	Description
CTDPA-42-520-CHILDREN	Children's and Minors' Data	Controllers must not process the personal data of a consumer known to be a child except per COPPA, nor (per PA 23-56) pr...
CTDPA-42-520-CONSENTREVOKE	Consent and Revocation (No Dark Patterns)	Consent must be a clear affirmative act, freely given, specific, informed and unambiguous (not via dark patterns); contr...
CTDPA-42-520-NONDISCRIM	Non-Discrimination	Controllers may not process personal data in violation of anti-discrimination laws and may not discriminate against cons...
CTDPA-42-520-PRIVNOTICE	Privacy Notice	Controllers must provide a reasonably accessible, clear and meaningful privacy notice (data categories, purposes, rights...
CTDPA-42-520-PURPLIMIT	Purpose Limitation and Data Minimization	Controllers must limit collection to what is adequate, relevant and reasonably necessary for the disclosed purposes.
CTDPA-42-520-SALEDISC	Sale and Targeted-Advertising Disclosure	Where a controller sells personal data to third parties or processes for targeted advertising, it must clearly and consp...
CTDPA-42-520-SECONDARY	No Secondary Use Without Consent	Controllers may not process personal data for purposes not reasonably necessary to or compatible with the disclosed purp...
CTDPA-42-520-SECURITY	Reasonable Security Practices	Controllers must establish, implement and maintain reasonable administrative, technical and physical data-security pract...
CTDPA-42-520-SENSITIVE	Sensitive Data Opt-In Consent	Controllers may not process sensitive data without the consumer's consent (or, for a known child, in accordance with COP...

CTDPA: Data Protection Assessments (42-522)

1 controls

Controls in the CTDPA: Data Protection Assessments (42-522) domain of Connecticut Data Privacy Act (CTDPA) — 1 controls
Code	Title	Description
CTDPA-42-522-DPA	Data Protection Assessments	Controllers must conduct and document data protection assessments for processing that presents a heightened risk of harm...

CTDPA: Definitions, Scope and Exemptions (42-515 to 517)

3 controls

Controls in the CTDPA: Definitions, Scope and Exemptions (42-515 to 517) domain of Connecticut Data Privacy Act (CTDPA) — 3 controls
Code	Title	Description
CTDPA-42-515	Definitions	Defines consumer (Connecticut resident acting in individual/household context, not commercial/employment), controller, p...
CTDPA-42-516	Applicability Thresholds	Applies to persons conducting business in Connecticut or targeting CT residents that, in the preceding year, controlled/...
CTDPA-42-516-EXEMPT	Entity and Data Exemptions	Exempts certain entities and data (state bodies, nonprofits in some cases, higher-education institutions, GLBA financial...

CTDPA: Enforcement and Amendments (42-525; PA 23-56)

4 controls

Controls in the CTDPA: Enforcement and Amendments (42-525; PA 23-56) domain of Connecticut Data Privacy Act (CTDPA) — 4 controls
Code	Title	Description
CTDPA-42-525-AGENFORCE	Exclusive Attorney General Enforcement	The Connecticut Attorney General has exclusive authority to enforce the CTDPA; a violation is an unfair trade practice u...
CTDPA-42-525-CHD	Consumer Health Data (PA 23-56)	Connecticut's 2023 amendment adds protections for consumer health data, including consent for processing and restriction...
CTDPA-42-525-CURE	Cure Period (Sunset 31 Dec 2024)	The Attorney General provided a 60-day right-to-cure for violations until 31 December 2024, after which cure is discreti...
CTDPA-42-525-GEOFENCE	Geofencing Prohibition Near Health Facilities (PA 23-56)	Prohibits establishing a geofence within 1,750 feet of a mental-health or reproductive/sexual-health facility to identif...

CTDPA: Processor and De-identified Data (42-521/523)

2 controls

Controls in the CTDPA: Processor and De-identified Data (42-521/523) domain of Connecticut Data Privacy Act (CTDPA) — 2 controls
Code	Title	Description
CTDPA-42-521-DEIDENT	De-identified and Pseudonymous Data	Controllers in possession of de-identified data must take reasonable measures to prevent re-identification, publicly com...
CTDPA-42-521-PROCESSOR	Processor Obligations and Contracts	Processing by a processor must be governed by a contract setting out instructions, nature/purpose, data types, duration,...

Your Compliance Coverage

If you comply with Connecticut Data Privacy Act (CTDPA), you already cover:

GDPR

33%

9 controls mapped

Compare →

CCPA/CPRA

33%

9 controls mapped

Compare →

COPPA

1 controls mapped

Compare →

See all 3 mapped frameworks ↓

Maps to 3 other frameworks

27 total controls

GDPR

9 source controls mapped|7 target controls covered

33%

CCPA/CPRA

9 source controls mapped|6 target controls covered

33%

COPPA

1 source controls mapped|2 target controls covered

Compare Connecticut Data Privacy Act (CTDPA) with GDPR

Frequently Asked Questions

What is Connecticut Data Privacy Act (CTDPA)?

Connecticut Data Privacy Act (CTDPA) is a compliance framework from United States — Connecticut with 6 domains and 27 controls. The Connecticut Data Privacy Act (CTDPA), signed into law in June 2022 and effective July 1, 2023, establishes comprehensive consumer privacy rights for Connecticut residents. It provides rights to access, delete, correct, and opt out of the sale of personal data and targeted advertising. The law applies to any entity that conducts business in Connecticut or processes the personal data of Connecticut residents, regardless of where the entity is located. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Connecticut Data Privacy Act (CTDPA) have?

Connecticut Data Privacy Act (CTDPA) has 27 controls organised across 6 domains. The largest domains are CTDPA: Controller Duties (42-520) (9 controls), CTDPA: Consumer Rights (42-518) (8 controls), CTDPA: Enforcement and Amendments (42-525; PA 23-56) (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Connecticut Data Privacy Act (CTDPA) map to?

Connecticut Data Privacy Act (CTDPA) maps to 3 other compliance frameworks. The top mapping partners are GDPR (33% coverage), CCPA/CPRA (33% coverage), COPPA (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with Connecticut Data Privacy Act (CTDPA) compliance?

Start your Connecticut Data Privacy Act (CTDPA) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Connecticut Data Privacy Act (CTDPA) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 27 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required