Connecticut CTDPA

Connecticut Data Privacy Act - controller duties, consumer rights, sensitive data limits.


Short name	CT CTDPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CT CTDPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for CT CTDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for CT CTDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CT-CTDPA-6-SEC` Data Security Safeguards	Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices proportionate to the data processed; integrity-verifiable software is a baseline technical practice (CTDPA, P.A. 22-15 § 6 controller duties)	Scan
`CT-CTDPA-6-MIN` Minimisation and Purpose Limitation Accountability	Personal data collection must be limited to what is adequate, relevant and reasonably necessary; a named processing platform with an enumerated component inventory is the evidentiary basis for that limitation (CTDPA, P.A. 22-15 § 6 controller duties)	Scan
`CT-CTDPA-7` Processor Contract Obligations	Processors are bound by contract to follow controller instructions, ensure personnel confidentiality, and impose the same duties on subcontractors; the third-party software chain must therefore be attributable to named suppliers (CTDPA, P.A. 22-15 § 7)	Scan
`CT-CTDPA-8` Data Protection Assessment Readiness	Data protection assessments are required for heightened-risk processing such as targeted advertising, sale, profiling and sensitive data; risk cannot be assessed unless the versions of the processing software are recorded (CTDPA, P.A. 22-15 § 8)	Scan
`CT-CTDPA-4` Consumer Rights Fulfilment	Consumers may access, correct, delete and port their data and opt out of targeted advertising, sale and profiling; fulfilling requests across systems requires those systems' components to be unambiguously identifiable (CTDPA, P.A. 22-15 § 4)	Scan
`CT-CTDPA-NOTICE` Privacy Notice Documentation	Controllers must provide a reasonably accessible, clear and meaningful privacy notice covering categories processed and shared; underlying documentation should be identified and timestamped so the notice remains verifiably current (CTDPA privacy-notice provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PA-22-15-Sec4`	Consumer Rights: Access, Correction, Deletion & Portability
`PA-22-15-Sec4(5)`	Opt-Out of Sale, Targeted Advertising & Profiling
`PA-22-15-Sec4(6)`	Universal Opt-Out Mechanism Recognition (from Jan 2025)
`PA-22-15-Sec5`	Sensitive Data Consent
`PA-22-15-Sec8`	Data Protection Assessment
`PA-22-15-Sec9`	Processor Contracts
`PA-22-15-Sec6`	Privacy Notice Requirements
`PA-22-15-Sec4(4)`	Consumer Appeals Process
`PA-22-15-Sec7`	Non-Discrimination for Exercising Rights

Policy templates

Written for CT CTDPA:

Connecticut CTDPA State Privacy Notice
Connecticut CTDPA Consumer Rights Request Handling Procedure
Connecticut CTDPA Data Protection Assessment Procedure

And 22 from the standard set, adapted to CT CTDPA.