---
title: "Connecticut privacy law (CTDPA): processors"
canonical: "https://dposchool.com/state-privacy-laws/state/connecticut/processors"
source: "https://www.cga.ct.gov/current/pub/chap_743jj.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Connecticut Data Privacy Act (An Act Concerning Personal Data Privacy and Online Monitoring)

# Connecticut privacy law (CTDPA): processors

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

A processor must follow the controller's instructions and help with consumer requests, security, breach notice, and data protection and impact assessments. A binding contract must set out instructions, nature and purpose, data types, duration and rights and obligations, and require confidentiality, deletion or return, compliance information, subcontractor flow-down after a chance to object, and assessments. From 1 October 2026 the assistance duties sit in § 42-521(a)(1) and third parties may not sell precise geolocation data.

## Key points

1. Processor assists with rights requests, security and breach notice, and data protection and impact assessments.

   Section: [Conn. Gen. Stat. § 42-521(a)](https://www.cga.ct.gov/current/pub/chap_743jj.htm)

2. Binding contract with instructions, nature and purpose, data types, duration, and rights and obligations.

   Section: [Conn. Gen. Stat. § 42-521(b)](https://www.cga.ct.gov/current/pub/chap_743jj.htm)

3. Confidentiality, deletion or return at the end, and compliance information on request.

   Section: [Conn. Gen. Stat. § 42-521(b)(1) to (3)](https://www.cga.ct.gov/current/pub/chap_743jj.htm)

4. Subcontractors only after the controller can object, under a written flow-down contract.

   Section: [Conn. Gen. Stat. § 42-521(b)(4)](https://www.cga.ct.gov/current/pub/chap_743jj.htm)

5. Assessments by the controller or an independent assessor arranged by the processor.

   Section: [Conn. Gen. Stat. § 42-521(b)(5)](https://www.cga.ct.gov/current/pub/chap_743jj.htm)

6. A processor that sets purposes and means becomes a controller.

   Section: [Conn. Gen. Stat. § 42-521(d)](https://www.cga.ct.gov/current/pub/chap_743jj.htm)

## Sources

- [Public Act 25-113 (Substitute SB 1295), approved 24 June 2025](https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF)
- [Public Act 26-64 (Substitute SB 4), approved 27 May 2026](https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF)

[Compare processors across all states](https://dposchool.com/state-privacy-laws/topic/processors)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 28: Processor](https://dposchool.com/gdpr/article/28) (processors)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Connecticut statute](https://www.cga.ct.gov/current/pub/chap_743jj.htm)

Reference material, not legal advice.

## Other topics for Connecticut

- [Applicability](https://dposchool.com/state-privacy-laws/state/connecticut/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/connecticut/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/connecticut/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/connecticut/controller-duties)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/connecticut/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut) / Processors

Previous: [Controller duties](https://dposchool.com/state-privacy-laws/state/connecticut/controller-duties)

Next: [Enforcement](https://dposchool.com/state-privacy-laws/state/connecticut/enforcement)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents