Connecticut Expands Data Breach Notification Requirements And Establishes A Cybersecurity "Safe Harbor"

On June 16 and July 6, 2021, Connecticut Governor Ned Lamont signed two new cybersecurity laws that continue the national trend of expanding cyber incident disclosure obligations, shortening notification timelines, and incentivizing the implementation of recognized cybersecurity standards. Both laws take effect on October 1, 2021.

"An Act Concerning Data Privacy Breaches" Amends Connecticut's Existing Data Breach Law

The amended data breach law includes three key changes:

• The time businesses have to notify affected Connecticut residents and the Office of the Attorney General of a data breach has been shortened from 90 days to no later than 60 days after discovery of the breach;