Connecticut Data Privacy Act (CTDPA)

Under the Connecticut Data Privacy Act (CTDPA) compliance, Controllers must follow strict rules to protect people’s information and make sure they’re following the law.

1. Data Minimization
   Controllers must only collect the personal data that is adequate, relevant, and reasonably necessary considering the purposes for which their data is processed as disclosed to the consumer.
2. Purpose Specification
   Controllers should not process personal data for purposes that are neither reasonably necessary to, nor compatible with, the disclosed purposes for which such personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer’s consent.
3. Transparency
   A controller shall provide consumers with reasonably accessible, clear, and meaningful privacy notice that includes:
   • The categories and purpose of personal data processed by the controller;
   • How consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision about the consumer’s request;
   • The categories of personal data that the controller shares with third parties, if any;
   • The categories of third parties, if any, with which the controller shares personal data; and
   • An active electronic mail address that the consumer may use to contact the controller.
4. Security 
   The controller must establish, implement, maintain and update reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity and accessibility relevant to the volume and nature of the personal data at issue.
5. Opt-in Consent
   Controllers should not process sensitive data concerning a consumer without obtaining the consumer’s consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with Children’s Online Privacy Protection Act.Additionally, controllers are required to “provide an effective mechanism” for consumers to revoke consent that is at least as easy as the mechanism used to provide it.
6. Non-Discrimination
   A controller may not discriminate against a consumer for exercising a right by denying a good or service to the consumer or charging the consumer a different price.
7. Data protection assessments
   Controllers are required to perform and document Data Protection Impact Assessments for each processing activity “that presents a heightened risk of harm” to consumers.