Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)
Connecticut privacy law (CTDPA): processors
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
A processor must follow the controller's instructions and help with consumer requests, security, breach notice, and data protection and impact assessments. A binding contract must set out instructions, nature and purpose, data types, duration and rights and obligations, and require confidentiality, deletion or return, compliance information, subcontractor flow-down after a chance to object, and assessments. From 1 October 2026 the assistance duties sit in § 42-521(a)(1) and third parties may not sell precise geolocation data.
Key points
Processor assists with rights requests, security and breach notice, and data protection and impact assessments.
Section: Conn. Gen. Stat. § 42-521(a)
Binding contract with instructions, nature and purpose, data types, duration, and rights and obligations.
Section: Conn. Gen. Stat. § 42-521(b)
Confidentiality, deletion or return at the end, and compliance information on request.
Subcontractors only after the controller can object, under a written flow-down contract.
Section: Conn. Gen. Stat. § 42-521(b)(4)
Assessments by the controller or an independent assessor arranged by the processor.
Section: Conn. Gen. Stat. § 42-521(b)(5)
A processor that sets purposes and means becomes a controller.
Section: Conn. Gen. Stat. § 42-521(d)
Sources
Compare processors across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 28: Processor (processors)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Connecticut statute
Reference material, not legal advice.