Data breach notification
Conn. Gen. Stat. § 36a-701b sets a sixty day outer limit for telling Connecticut residents about a breach and requires notice to the Attorney General no later than the residents are told.
Connecticut defines a breach of security as unauthorized access to or unauthorized acquisition of electronic files, media, databases or computerized data containing personal information, when access to it has not been secured by encryption or another method that renders it unreadable or unusable.
Access alone is enough under that wording; the data does not have to have been taken.
The definition pairs a first name or first initial and last name with any of these:
A user name or email address with a password or security question and answer that would permit access to an online account is personal information without a name attached.
| Question | Connecticut answer |
|---|---|
| Deadline for residents | Without unreasonable delay but not later than sixty days after the discovery of the breach, unless federal law requires a shorter time |
| Attorney General | Notice to the Attorney General not later than the time notice is provided to the resident |
| Threshold for the Attorney General | Any breach that requires notice to residents |
| Harm exception | No notice if, after an appropriate investigation, the person reasonably determines the breach will not likely result in harm |
| Encrypted data | Data secured by encryption or a method rendering it unreadable or unusable is outside the breach definition |
Where Social Security numbers or taxpayer identification numbers are involved, the owner of the data must offer at least two years of identity theft prevention services at no cost to the resident. That obligation is easy to miss when the focus is on the letter itself.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
A room's watermark is on unless someone switches it off for that room. Recipients confirm their email with a six-digit code and need no account, so the log ties each action to a confirmed reader. Every view, upload, download, invitation and change goes into one chained record, which exports as CSV. When the question is which people opened a file holding tax ID numbers, that export is the place to start.
Checked against Connecticut's published law on November 2, 2026. This is general information, not legal advice.
