Data Protection Impact Assessment (DPIA) (CT) - Connecticut
CONNECTICUT DATA PROTECTION IMPACT ASSESSMENT
Controller: [________________________________]
Assessment ID and version: [________________________________]
Processing activity, online service or feature: [________________________________]
Owner and assessment date: [________________________________]
Launch or material change date: [________________________________]
1. Applicability and assessment scope
Connecticut nexus and coverage. Record the underlying facts and the basis for the conclusion. Under Conn. Gen. Stat. § 42-516, effective July 1, 2026, coverage routes include the preceding-year 35,000-consumer threshold (excluding payment-only processing), processing consumers' sensitive data other than payment-only processing, and offering consumers' personal data for sale in trade or commerce. Review exemptions separately before deciding whether this controller is covered.
| Question | Findings and evidence |
|---|---|
| Business in Connecticut or products/services targeted to Connecticut residents | [________________________________] |
| Prior-calendar-year Connecticut consumers and payment-only exclusions | [________________________________] |
| Sensitive data processed and purpose | [________________________________] |
| Personal data offered for sale in trade or commerce | [________________________________] |
| Applicable exemption or data exclusion, with current authority | [________________________________] |
| Covered controller? Decision, reviewer and date | [________________________________] |
Data protection assessment trigger. Section 42-522 covers targeted advertising, sale of personal data, sensitive-data processing, and profiling with a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical or reputational injury, offensive intrusion, or other substantial injury. Its data protection assessment requirement applies to processing activities created or generated after July 1, 2023.
☐ Targeted advertising: [________________________________]
☐ Sale of personal data: [________________________________]
☐ Profiling with a listed reasonably foreseeable risk: [describe risk and evidence]
☐ Sensitive-data processing: [________________________________]
☐ No listed trigger; basis: [________________________________]
Additional impact assessment routes. Under § 42-522(c), profiling used to make a decision with a legal or similarly significant effect concerning a consumer calls for an impact assessment; § 42-522(g)(2) applies that requirement to activities created or generated on or after August 1, 2026. Under § 42-529b, an online service, product or feature offered to consumers known, or wilfully disregarded, to be minors calls for a data protection assessment; profiling based on those minors' data also calls for an impact assessment. Complete sections 6 and 7 where applicable.
☐ Significant-effect decision profiling: [decision, role of profiling, creation date]
☐ Online service for minors covered by § 42-529b: [service, age evidence, creation date]
☐ Profiling based on those minors' data: [purpose and decision process]
☐ Neither additional route; reason: [________________________________]
2. Processing and data flow
Purpose and intended use cases: [________________________________]
Consumers affected, approximate number, and relationship to controller: [________________________________]
Data categories, including any sensitive data, and sources: [________________________________]
Collection, analysis, inference, disclosure and deletion steps: [________________________________]
Recipients, processors and onward transfers: [________________________________]
Retention period and deletion trigger: [________________________________]
Data-flow diagram or system inventory reference: [________________________________]
3. Necessity, benefits and expectations
| Balancing factor under § 42-522(b)(2) | Findings and evidence |
|---|---|
| Direct and indirect benefits to controller | [________________________________] |
| Benefits to consumers, other stakeholders and public | [________________________________] |
| Consumer expectations and processing context | [________________________________] |
| Relationship between controller and consumer | [________________________________] |
| Less intrusive alternatives and de-identified data | [________________________________] |
| Why the proposed data, volume, recipients and retention are needed | [________________________________] |
4. Consumer risks and safeguards
Describe each reasonably foreseeable risk to consumer rights, the evidence, safeguards, and residual risk. Address the heightened-risk trigger selected above.
| Risk to consumers | Likelihood and impact | Safeguard, owner and evidence | Residual risk |
|---|---|---|---|
| [________________________________] | [____________] | [________________________________] | [____________] |
| [________________________________] | [____________] | [________________________________] | [____________] |
| [________________________________] | [____________] | [________________________________] | [____________] |
Security and access controls: [________________________________]
Data minimization, retention and deletion controls: [________________________________]
Consumer notice, choice and rights handling relevant to this activity: [________________________________]
Processor instructions, oversight and contract status: [________________________________]
Testing performed, results and open issues: [________________________________]
5. Benefits and risks weighed
Benefits after considering alternatives: [________________________________]
Potential risks to consumer rights before safeguards: [________________________________]
How safeguards change those risks: [________________________________]
Reasoned balance of benefits against mitigated risks: [________________________________]
Decision and conditions for proceeding: [approve / revise / do not proceed; details]
Mitigation tasks, owners and due dates: [________________________________]
6. Significant-effect profiling impact assessment, if applicable
Complete this section for § 42-522(c) profiling using information reasonably known or available to the controller.
| Assessment topic | Findings and evidence |
|---|---|
| Purpose, intended use cases, deployment context and benefits | [________________________________] |
| Known or reasonably foreseeable heightened harm and mitigation | [________________________________] |
| Main categories of personal-data inputs and profiling outputs | [________________________________] |
| Main data categories used to customize the profiling | [________________________________] |
| Performance metrics and known limitations | [________________________________] |
| Transparency measures, including disclosures during profiling | [________________________________] |
| Post-deployment monitoring, oversight, use and learning safeguards | [________________________________] |
7. Online service for minors, if applicable
For § 42-529b, record the service's purpose, minors' data categories, processing purposes and reasonably foreseeable heightened harm. If it profiles minors, complete the additional impact analysis. Review this assessment when material processing or profiling operations change.
Service or feature and purpose: [________________________________]
Categories and uses of minors' personal data: [________________________________]
Foreseeable heightened harm to minors: [________________________________]
Profiling inputs, outputs, customization and transparency: [________________________________]
Profiling risk, mitigation, monitoring and safeguards: [________________________________]
Plan to mitigate or eliminate any heightened risk found: [owner, action, date]
Documentation retention for this minors assessment: the longer of three years after the operations cease or while the service is offered (§ 42-529b(c)(2)). [location and retention date]
Next review trigger and documentation location: [________________________________]
8. Approval and record
Comparable operations covered by this assessment: [________________________________]
Related assessment used under another law and scope comparison, if any: [________________________________]
Supporting records and evidence location: [________________________________]
Privacy lead — name, decision, date: [________________________________]
Security lead — name, decision, date: [________________________________]
Legal reviewer — name, decision, date: [________________________________]
Business owner — name, decision, date: [________________________________]
Final approval and conditions — name, title, date: [________________________________]
Sources and References
- Connecticut General Statutes, 2026 Supplement, Chapter 743jj, §§ 42-516, 42-522 and 42-529b (amended text effective July 1, 2026).
About this template
- Last updated
- September 27, 2026
- Citations checked
- September 27, 2026
- Jurisdiction
- Connecticut
- Category
- Compliance & Regulatory
Legal authority
- Conn. Gen. Stat. § 42-516
- Conn. Gen. Stat. § 42-522
- Conn. Gen. Stat. § 42-529b
Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.
Not legal advice
This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Checked against the law it cites
A reviewer verified this template's legal citations against the official source on September 27, 2026.
Conn. Gen. Stat. § 42-516 (checked September 27, 2026): "The provisions of sections 42-515 to 42-525, inclusive, apply to persons that: (1) Conduct business in this state, or produce products or services that are targeted to residents of this state, and during the preceding calendar year controlled or processed the personal data of not fewer than thirty-five thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; (2) control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction; or (3) offer consumers' personal data for sale in trade or commerce."
Conn. Gen. Stat. § 42-522 (checked September 27, 2026): "A controller shall conduct and document a data protection assessment for each of the controller's processing activities that presents a heightened risk of harm to a consumer."
Conn. Gen. Stat. § 42-529b (checked September 27, 2026): "Each controller that offers any online service, product or feature to consumers whom such controller has actual knowledge, or wilfully disregards, are minors shall conduct a data protection assessment for such online service, product or feature"
Draft your Data Protection Impact Assessment (DPIA) (CT) in the editor
Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.