Connecticut Expands Breach Reporting And Creates Cybersecurity Safe Harbor

On October 1, 2021, two Acts overhauling data privacy and cybersecurity in Connecticut took effect-the latest instance of stronger state breach reporting requirements with a safe harbor protection from litigation for businesses that implement cybersecurity measures. The still relatively new safe harbor incentive system may be further validated by this development and continue to spread to other states.

Expanding Breach Notification Requirements

The first Act (PA 21-59), signed on June 16, 2021, modifies Connecticut's existing breach notification by (1) expanding the types of information protected, (2) shortening the notification timeline from 90 days to "without unreasonable delay, but not later than 60 days," from the day of breach discovery and (3) expanding coverage beyond those businesses that use personal information in "the ordinary course of business in Connecticut."¹