Connecticut Broadens Data Privacy Act Requirements Effective July 1, 2026

Key Takeaways

• Amendments to the Connecticut Data Privacy Act (the “CTDPA”) take effect July 1, 2026, bringing more businesses under the law and updating requirements for sensitive data, consumer rights, privacy notices, and more.
• The lowered applicability thresholds and elimination of a guaranteed cure period significantly increase enforcement risk, exposing more businesses to penalties and scrutiny.
• Organizations should update data governance, consent practices, and privacy disclosures now to ensure compliance ahead of the July 2026 deadline and prepare for further obligations under SB 4 later in the year.

Revised Applicability Scope and Exemptions

Effective July 1, 2026, the CTDPA’s existing applicability thresholds are reduced, resulting in the CTDPA covering businesses processing personal data of at least 35,000 Connecticut residents or selling personal data of at least one resident. Notably, a business “sells” personal data under the CTDPA when it exchanges such data for