Connecticut Data Privacy Act, controller duties (sensitive data), as amended by P.A. 25-113 from 1 July 2026 (Conn. Gen. Stat. 42-520(a)(1)(D) (2026 Supp.))
Since 1 July 2026 sensitive data (now including neural data, financial account and government ID numbers) may be processed only when reasonably necessary for the purpose and with the consumer's opt-in consent.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(D) not process sensitive data concerning a consumer unless such processing is reasonably necessary in relation to the purposes for which such sensitive data are processed and without obtaining the consumer's consent”
Where it was read
Also read from the same source
- Connecticut Data Privacy Act, definitions (sale of personal data) (Conn. Gen. Stat. 42-515(38) (2026 Supp.))
- Connecticut Data Privacy Act, definitions (de-identified data) (Conn. Gen. Stat. 42-515(16) (2026 Supp.))
- Connecticut Data Privacy Act, effective dates (P.A. 22-15; P.A. 25-113) (Conn. Gen. Stat. 42-515, history note (2026 Supp.))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide