For three years a small Connecticut business could settle the state privacy law in one sentence: we’re nowhere near 100,000 people, and we don’t sell anybody’s data. Those were the two ways in. For most small businesses the sentence was true, and the meeting moved on to something else.
On July 1, 2026 the test changed. It was a good sentence while it lasted.
What the test says now
The Connecticut Data Privacy Act now applies to a business that fits any one of three descriptions:
- It handled the personal data of at least 35,000 consumers in the previous calendar year.
- It controls or processes consumers’ sensitive data.
- It offers consumers’ personal data for sale.
The first still has a number, about a third of the old one. The second and third have no number in them at all. Data handled only to complete a payment is left out of the first two, so the card reader at the register is its own, smaller question.
For most small businesses the second line is the one worth reading twice.
What “sensitive” covers
Longer than people expect. The definition includes government-issued ID numbers, and it names them: Social Security, driver’s license, passport, state ID. It includes data revealing a physical or mental health condition, diagnosis or treatment. It includes a financial account or card number when it sits with the code or password that opens the account. Precise location, biometric and genetic data, immigration status, and status as a crime victim are on the list too, along with several more.
Now hold that against an ordinary filing cabinet. The property manager with Social Security numbers on every rental application. The repair shop that photocopies a driver’s license before handing over the loaner. The gym with a health questionnaire in each member folder. All three are a long way from 35,000 customers, and all three are holding something the definition names.
Whether that puts any of them inside the act is a separate step, and the next section is why.
Who is still outside
A “consumer” is a Connecticut resident, and the definition leaves out a person acting in a commercial or employment context. Your contact at a supplier is there on business. Records you keep about your own applicants, employees and contractors, in that role, are exempt as well, so the personnel drawer is its own matter.
Whole kinds of organization are exempt too: nonprofits, colleges, state agencies, HIPAA covered entities and their business associates, insurers and insurance agents, banks and credit unions that meet certain conditions, and registered broker-dealers and investment advisers. (The act’s separate section on consumer health data keeps its own, shorter list. If health information is your business, raise that section with your lawyer by name.)
One exemption got narrower, and it matters to anyone who was told years ago that they were covered by it. The old text exempted a financial institution subject to the Gramm-Leach-Bliley Act, as a business. The new text exempts the data subject to that law and no longer names the business holding it. If “we’re a financial institution, so we’re exempt” is the answer in your files, it was written for the old wording.
Then there is what the exemption list leaves out. Small businesses do not appear on it. There is no headcount test and no revenue test anywhere in the applicability section. Law firms and accounting firms are not named either.
What to bring your lawyer
We are an IT firm. Whether the act reaches your business turns on definitions and exemptions that belong to your own counsel, and this page stops short of that answer on purpose. What we can tell you is how to make that conversation short. Walk in with five things written down:
- Which kinds of sensitive data you hold, using the list above.
- Roughly how many Connecticut residents you held any personal data about last calendar year, sensitive or otherwise.
- Whether you sell personal data to anyone, in any form.
- Where the sensitive records live. Name the system, the shared folder, the cabinet, the vendor.
- Who can open them.
Most owners can do the first three from memory. The fourth is where the afternoon goes, because the honest answer usually includes an old laptop, somebody’s inbox, and a scanner that saves to a folder nobody has opened since it was set up.
The list earns its keep whichever way your lawyer answers. Two older Connecticut statutes have no size test in them at all. One tells any person in possession of someone else’s personal information to safeguard it. The other requires notice after a breach of security involving computerized personal information. Each has its own definitions, and the amendment left both untouched. (What “reasonable security” means for a Connecticut law firm walks through both; the statutes apply the same way outside a law office.)
If the “where it lives” column is the one you would rather not fill in alone, that part is our kind of work: book a call.