Connecticut Data Privacy Act, definitions (de-identified data) (Conn. Gen. Stat. 42-515(16) (2026 Supp.))
De-identified status requires all three steps: reasonable measures, a public commitment not to re-identify, and contracts passing both duties to every recipient.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(16) “De-identified data” means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual, if the controller that possesses such data (A) takes reasonable measures to ensure that such data cannot be associated with an individual, (B) publicly commits to process such data only in a de-identified fashion and not attempt to re-identify such data, and (C) contractually obligates any recipients of such data to satisfy the criteria set forth in subparagraphs (A) and (B) of this subdivision.”
Where it was read
Also read from the same source
- Connecticut Data Privacy Act, definitions (sale of personal data) (Conn. Gen. Stat. 42-515(38) (2026 Supp.))
- Connecticut Data Privacy Act, controller duties (sensitive data), as amended by P.A. 25-113 from 1 July 2026 (Conn. Gen. Stat. 42-520(a)(1)(D) (2026 Supp.))
- Connecticut Data Privacy Act, effective dates (P.A. 22-15; P.A. 25-113) (Conn. Gen. Stat. 42-515, history note (2026 Supp.))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide