Applicability of the Connecticut Data Privacy Act (CDPA)

Connecticut has established a data protection framework to regulate the processing of personal data. The primary role of this framework is governed by an Act Concerning Personal Data Privacy and Online Monitoring.

The act was adopted on May 10, 2022 and became effective on July 1, 2023. The latest amendment is the 2025 Amendment (Senate Bill 1295) - broad applicability, sensitive data, minors, exemptions, consumer rights adopted on June 24, 2025 and effective on July 1, 2026.

Material Applicability

The CDPA's material scope is determined by several key factors:

• Number of Data Subjects
• Revenue-Based Applicability
• Sectoral Exceptions
• Government and Public Agency Exemption
• Higher Education Institution Exemption
• Nonprofit Organization Exemption
• Benefit Administration Data Exemption
• Exemption for Specific Purposes of Processing

Number of Data Subjects

CDPA Sec.2(1):

"The provisions of sections 1 to 11, inclusive, of this act apply to persons that [...] during the preceding calendar year: (1) Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction"

CDPA Sec.2(2):

"[...] controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data"

Revenue-Based Threshold

CDPA Sec.2(2):

"[...] derived more than twenty-five per cent of their gross revenue from the sale of personal data"

Exemptions for Organizations

CDPA Sec.3(a):

"The provisions [...] do not apply to any: (1) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (2) nonprofit organization; (3) institution of higher education"

Benefit Administration Data Exemption

CDPA Sec.3(b)(15):

"[...] data processed or maintained [...] that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information"

Territorial Applicability

The CDPA's territorial scope is based on two main factors:

• Doing Business in Connecticut
• Offering Goods and Services to Connecticut Residents

CDPA Sec.2:

"The provisions [...] apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state"

Key Exemptions

Sectoral Exceptions

The CDPA exempts various sectors and data types, including:

CDPA Sec.3(a)(5-6):

"[...] (5) financial institution or data subject to Title V of the Gramm-Leach-Bliley Act [...] (6) covered entity or business associate, as defined in 45 CFR 160.103"

Research and Specific Purposes

CDPA Sec.3(b)(5):

"[...] personal data used or shared in research, as defined in 45 CFR 164.501, that is conducted in accordance with the standards set forth in this subdivision"