Governance, risk & compliance

Connecticut Data Privacy Act (CTDPA) Conn. Gen. Stat. 42-515 et seq.; in force 1 July 2023; 2025 changes from 1 July 2026

The Connecticut Data Privacy Act (CTDPA) is Connecticut General Statutes sections 42-515 and following (Public Act 22-15, signed 10 May 2022, in force 1 July 2023).

This framework follows the Attorney General’s CTDPA page and CY2025 enforcement report, because the statute site (cga. ct.

gov) could not be reached; section numbers not seen in those documents are marked “not re-read”. From 1 July 2026 the CTDPA applies to businesses that handle personal data of 35,000 consumers (down from 100,000), process any sensitive data, or sell any personal data, and it covers consumer health data controllers of any size.

Rights include access (with inferences), correction, deletion, a portable copy, a list of the third parties that bought the data, and opt-outs of sale, targeted advertising and profiling, with a right to contest profiling decisions. Sensitive data (now including neural data, disability, and some financial and government identifiers) needs opt-in consent.

Opt-out preference signals have been mandatory since 1 January 2025. Minors under 18 have extra protections: from 1 July 2026 no targeted advertising or sale of their data and no features that extend use.

Controllers must disclose whether data trains large language models, run data protection assessments, and complete impact assessments when they profile. A 2026 act reported for 1 October 2026 adds facial recognition rules and bans selling precise geolocation.

The Attorney General enforces under CUTPA with penalties up to $5,000 per violation and no private right of action; the mandatory cure period has ended. Not read: the statute text, the 2025 and 2026 public act numbers, and the 2026 act.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Connecticut Data Privacy Act (CTDPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Connecticut Data Privacy Act (CTDPA) compliance

Most of Connecticut Data Privacy Act (CTDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Connecticut Data Privacy Act (CTDPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Connecticut Data Privacy Act (CTDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Connecticut Data Privacy Act (CTDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.