Material Applicability

The CDPA's material scope is determined by several key factors:

• Number of Data Subjects
• Revenue-Based Applicability
• Sectoral Exceptions
• Government and Public Agency Exemption
• Higher Education Institution Exemption
• Nonprofit Organization Exemption
• Benefit Administration Data Exemption
• Exemption for Specific Purposes of Processing

Number of Data Subjects

CDPA Sec.2(1):

"The provisions of sections 1 to 11, inclusive, of this act apply to persons that [...] during the preceding calendar year: (1) Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction"

CDPA Sec.2(2):

"[...] controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data"

Revenue-Based Threshold

CDPA Sec.2(2):

"[...] derived more than twenty-five per cent of their gross revenue from the sale of personal data"

Exemptions for Organizations

CDPA Sec.3(a):

"The provisions [...] do not apply to any: (1) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (2) nonprofit organization; (3) institution of higher education"

Benefit Administration Data Exemption

CDPA Sec.3(b)(15):

"[...] data processed or maintained [...] that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information"

Territorial Applicability

The CDPA's territorial scope is based on two main factors:

• Doing Business in Connecticut
• Offering Goods and Services to Connecticut Residents

CDPA Sec.2:

"The provisions [...] apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state"

Key Exemptions

Sectoral Exceptions

The CDPA exempts various sectors and data types, including:

CDPA Sec.3(a)(5-6):

"[...] (5) financial institution or data subject to Title V of the Gramm-Leach-Bliley Act [...] (6) covered entity or business associate, as defined in 45 CFR 160.103"

Research and Specific Purposes

CDPA Sec.3(b)(5):

"[...] personal data used or shared in research, as defined in 45 CFR 164.501, that is conducted in accordance with the standards set forth in this subdivision"