Connecticut Data Privacy Act

CTDPA Grade

Answer a few questions about how your business handles Connecticut consumers' personal data and get graded against the Connecticut Data Privacy Act — as amended effective July 1, 2026. The amendments pulled thousands of smaller businesses into scope, and Connecticut's guaranteed cure period is gone: the Attorney General can enforce without giving you a chance to fix violations first. Your grade updates as you go, and we flag exactly what still needs work. Items marked New 2026 were added by the 2026 amendments.

First: does the CTDPA apply to you?

The law applies if you do business in Connecticut (or target CT residents) and meet any one of the triggers below. Two of the three have no minimum volume.

We conduct business in Connecticut or offer products or services targeted to Connecticut residents. In the preceding calendar year, we controlled or processed personal data of 35,000 or more Connecticut consumers (excluding data processed solely to complete a payment). We process any sensitive data of Connecticut consumers — health information, biometrics, precise geolocation, government IDs, immigration status, data about children, and more. No minimum volume. We offer consumers' personal data for sale in trade or commerce — including exchanges for non-monetary consideration. No minimum volume.

Your gaps to close

Ranked by priority. Tackle the red items first.

No open gaps. Every item you've answered is fully in place.

Turn these gaps into a finished program

Nwaj Tech builds and runs privacy and security compliance programs for Connecticut dealerships, practices, and firms — from data mapping and privacy notices to consent workflows, vendor contracts, and the assessments the law now requires.

888.788.ZERO · nwajtech.com

And more is coming October 1, 2026. A second Connecticut law adds a ban on selling precise geolocation data, data broker registration, surveillance-pricing restrictions, and new facial recognition and genetic data rules. If any of those touch your business, the runway is short — talk to us now.

About this tool. This grade is an educational self-assessment based on the Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515 through 42-525), including the amendments effective July 1, 2026 (with profiling impact assessments applying to processing created or generated on or after August 1, 2026). Each item is weighted equally; items marked "Doesn't apply" are excluded from your score. The applicability screener is informational only. A high grade is a strong signal, not a legal determination, and this tool does not constitute legal advice or guarantee compliance. Exemptions (such as HIPAA-covered data) and edge cases matter — for a formal assessment of your obligations, talk to Nwaj Tech and your legal counsel.