What is the data breach notification deadline in Connecticut?

Connecticut requires notice to affected individuals 60 calendar days from discovery (Conn. Gen. Stat. §36a-701b).

Do you have to notify the Connecticut Attorney General of a data breach?

Yes. Connecticut Attorney General must be notified.

← All jurisdictions

CT · data breach notification

Connecticut

med

Conn. Gen. Stat. §36a-701b

Individual deadline

60 days

Trigger standard

Qualified

AG / regulator

Required

Notice to individuals	60 calendar days from discovery
Risk-of-harm standard	notice not required if, after investigation and consultation with law enforcement, entity reasonably determines breach will likely not result in harm
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	Connecticut Attorney General, required for any affected resident; no later than the time notice is provided to residents Web form (cannot save mid-form)
Credit reporting agencies	No CRA-notice requirement.
Credit monitoring	24 months of identity-theft prevention services required when SSN or taxpayer ID exposed
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	No, enforcement by the state.
Penalties	CUTPA enforcement by AG

Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a Connecticut breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →