The Connecticut Data Privacy Act: Part 2

In this article, we’re going to revisit the Connecticut Data Privacy Act again, this time looking at part 2, for lack of a better term.

To begin, our obligatory disclaimer:

We are not lawyers. What we present in this article does not equate to legal advice or a legal opinion. Please seek a qualified attorney who is knowledgeable in the following matters, if you have questions.

With that said, we’re going to talk very briefly about part 2 of the Connecticut Data Privacy Act (CTDPA)

We’ve already written about this law here and here. We’ve also written about cybersecurity frameworks, which are integral to complying with any cybersecurity/data privacy law, or regulation. You can read that article here.

Part 2 of the CTDPA, if your organization is required to comply with the law, must be in place no later than January 1st 2025.

The gist of it is, you must allow a consumer to opt-out of any processing of their personal data if it’s being used for targeted advertising, or if you are selling their personal data. There must be a way for you to receive the opt-out signal, with the consumer’s consent, through a platform, technology, or mechanism that indicates the consumer’s intent to opt-out of the processing or sale of their personal data. This is a super high level view of this section, as there’s more to it, which is why we recommend that you read the FULL TEXT of the law and consult with a knowledgeable attorney on these matters. If you need an attorney to help you, we’re happy to make a recommendation.

How We Help

If you are required to comply with the CTDPA, or even if your organization isn’t required to, we help with:

• External cyber risk/threat assessments
• Advising on cybersecurity frameworks
• Custom cybersecurity awareness training

Reach out to us in the form below to learn more or to schedule a free strategy call. And while you’re here sign up for our cybersecurity and OSINT newsletter. You’ll get tips, tricks, tools, and news in your inbox.