B
Boring DSAR

DSAR Requirements in Connecticut (CTDPA)

Connecticut DSAR requirements: consumer rights, response deadlines, identity verification, and penalties under the CTDPA.

Last updated: 2026-02-08

Consumer Rights That Trigger DSARs

Connecticut consumers can submit requests to:

  • Access all personal data you hold about them
  • Correct inaccurate personal data
  • Delete personal data you collected
  • Port their data in a portable, machine-readable format
  • Opt out of the sale of personal data
  • Opt out of targeted advertising
  • Opt out of profiling that produces legal or similarly significant effects

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Consult a qualified attorney for guidance specific to your business.

Response Deadline

45 days from receipt. You can extend by an additional 45 days if reasonably necessary — but you must notify the consumer of the extension and the reason within the initial 45-day window.

Identity Verification

Required before fulfilling any request. The CTDPA does not prescribe a specific verification method.

Appeal Process

If you deny a request, the consumer can appeal within 60 days. You must provide notice of their right to contact the Connecticut Attorney General if the appeal is denied.

Penalties

  • $5,000 per violation under the Connecticut Unfair Trade Practices Act
  • Cure period expired December 31, 2024
  • No private right of action — only the Attorney General can enforce

Enforced by the Connecticut Attorney General.

Threshold Changes Coming July 2026

Connecticut is lowering its threshold from 100K consumers to 35K consumers on July 1, 2026. This will bring significantly more businesses into scope.

DSAR-Specific Exemptions

You may decline or limit a request when the data is needed to:

  • Comply with a legal obligation
  • Detect security incidents or protect against fraud
  • Complete a transaction the consumer requested

Sensitive data (racial/ethnic origin, religious beliefs, health data, sexual orientation, biometric data, children's data) requires opt-in consent before processing.

Who This Applies To

Through June 30, 2026: 100K+ Connecticut consumers OR 25K+ consumers with revenue from data sales. From July 1, 2026: 35K+ consumers (significantly lower threshold).

For the full Connecticut privacy law guide, see boringgovernance.com.

Related Guides