Data Breach Notice to Residents and State Authorities in Connecticut
At a glance
| Covered entity and service provider | Owner, licensee, or maintainer of computerized PI notifies residents; nonowner maintainer also tells owner/licensee immediately after discovery (§ 36a-701b(b)(1),(c)) |
|---|---|
| Breach and covered information | Unauthorized access OR acquisition of unsecured electronic PI; name plus listed ID, financial, health, biometric, or geolocation data, or online credentials (§ 36a-701b(a)) |
| Risk screen or notice exception | No resident notice after appropriate investigation reasonably finds harm unlikely; public information excluded from PI (§ 36a-701b(a)(2),(b)(1)) |
| Individuals who receive notice | CT residents whose PI was or reasonably is believed breached; later identified residents notified as expediently as possible (§ 36a-701b(b)(1)) |
| Individual notice deadline and clock | Without unreasonable delay, no later than 60 days after discovery, subject to shorter federal limit or police delay (§ 36a-701b(b)(1),(d)) |
| Regulator threshold and deadline | AG whenever resident notice required, no later than resident notice; no population threshold; substitute trigger demonstrated in AG notice (§ 36a-701b(b)(2)(A),(e)(4)) |
| Consumer-reporting-agency notice | No separate nationwide consumer-reporting-agency report in § 36a-701b; SSN or taxpayer-ID breach instead triggers at least two years of free identity-theft services (§ 36a-701b(b)(2)(B)) |
| Individual delivery and content | Writing, telephone, qualifying electronic notice; credential breach may use password-reset directions, with special rule for compromised email accounts (§ 36a-701b(e)-(f)) |
| Substitute notice conditions and channels | Cost over $250,000, affected class over 500,000, or insufficient contacts: email where available AND website if maintained AND major statewide media (§ 36a-701b(e)(4)) |
| Delays and alternate compliance | Requested law-enforcement delay until clearance; timely own-policy, regulator-policy, or HIPAA/HITECH routes retain applicable AG notice (§ 36a-701b(d),(g)-(h)) |
Requirements one by one
Trigger and risk decision
Conn. Gen. Stat. § 36a-701b(a) reaches unauthorized access to or acquisition of unsecured electronic personal information. Covered data include a name paired with specified identity, financial, health, biometric, or precise geolocation information, plus online account credentials. Publicly available information is excluded. Under subsection (b)(1), notice is unnecessary if an appropriate investigation supports a reasonable determination that the breach is unlikely to harm the people whose information was accessed or acquired.
Resident, owner, and Attorney General notice
Under § 36a-701b(b)(1), a holder notifies residents whose information was or is reasonably believed breached without unreasonable delay and within 60 days after discovery, subject to a shorter federal limit and the law-enforcement rule below. Residents identified after day 60 must be notified as expediently as possible. Under subsection (c), a maintainer that does not own the information must also tell its owner or licensee immediately following discovery.
The Attorney General receives notice no later than the resident notice under § 36a-701b(b)(2)(A); the statute sets no affected-person threshold. Section 36a-701b does not add a nationwide consumer-reporting-agency report. If a resident's Social Security or taxpayer identification number was breached, subsection (b)(2)(B) requires the owner or licensee to offer at least two years of free identity-theft prevention services and, if applicable, mitigation services, plus credit-freeze information.
Delivery and content
Section 36a-701b(e) allows writing, telephone, or qualifying electronic notice. Substitute notice is available when direct notice would cost over $250,000, the affected class exceeds 500,000, or contact information is insufficient. The holder must demonstrate the trigger in its AG notice and use email where available, a conspicuous website posting if it has a site, and major statewide media.
For a credential-only breach, § 36a-701b(f) permits directions to change the password or security answer and protect reused credentials. A provider of the breached email account cannot rely on notice to that account without reasonably verifying receipt; it must use another statutory method or the specified conspicuous online notice.
What trips people up
A police delay requires a request. Under § 36a-701b(d), law enforcement must determine that notice would impede a criminal investigation and request a delay. Notice follows once the agency determines it will not compromise the investigation and informs the holder.
Alternative procedures retain state reporting. Section 36a-701b(g) recognizes timely own-policy or primary-regulator procedures, but still requires applicable AG notice no later than resident notice. Subsection (h) recognizes HIPAA/HITECH compliance on stated conditions, including applicable AG notice and the identity-theft-service rule.
Common questions
Does every unauthorized access require a letter?
No. Section 36a-701b(b)(1) permits a no-notice decision after an appropriate investigation reasonably finds harm unlikely.
Can the resident deadline be extended simply to finish an investigation?
The ordinary outer limit in § 36a-701b(b)(1) is 60 days after discovery. The statute expressly addresses later identified residents and a requested law-enforcement delay.
Statutes and sources
- Conn. Gen. Stat. § 36a-701b — breach definition and notices.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Connecticut law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Connecticut law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace