Lion Cipher Lab

Does Connecticut's Data Privacy Act (CTDPA) apply to you? Run the three-trigger applicability test, map the consumer rights, and flag what needs a Data Protection Assessment

• GRC / Compliance
• Intermediate
• ~75 min
• Free · no account required

Why it matters

Connecticut is worth learning precisely because it just moved. Its privacy law used to look like Virginia's and Colorado's - a 100,000-consumer prong and a 25,000-plus-selling prong. Then SB 1295, effective 1 July 2026, rewrote the front door: the count dropped to 35,000, and the old revenue prong was replaced by two triggers with NO volume floor at all - process any sensitive data, or sell any personal data, and you are in. That makes Connecticut the broadest of the five regimes this series covers, and it flips the instinct a California- or Virginia-trained analyst reaches for. In Virginia…

What you'll learn

• running the CURRENT CTDPA applicability test as THREE independent triggers - 35,000 consumers, OR processing any sensitive data, OR selling any personal data - and seeing that meeting ANY ONE puts you in scope
• understanding what the SB 1295 (2025) overhaul changed on 1 July 2026: the consumer count dropped from 100,000 to 35,000, and the old 25%-revenue-from-sale prong was replaced by two NO-VOLUME triggers (processing sensitive data; selling any personal data)
• explaining why Connecticut is now the BROADEST of the five state regimes: a company far too small for Virginia or Colorado, and one that might dodge Texas as an SBA small business, can be squarely IN in Connecticut
• knowing there is NO small-business carve-out in the CTDPA, and using the entity- and data-level exemptions (government, nonprofits, GLBA, HIPAA, higher education) instead
• applying the permanent B2B and HR/employee carve-out that removes commercial and employment data from scope
• recognizing sensitive data and knowing it needs opt-IN consent before processing, not merely a right to limit
• mapping the Connecticut consumer rights onto an intake-to-response workflow with the 45-day clock, the single 45-day extension, and the mandatory 60-day appeal step
• getting the broadened PROFILING opt-out right - SB 1295 removed 'solely', so it now covers profiling in furtherance of ANY automated decision with a legal or similarly significant effect
• wiring a recognized opt-out preference signal into a programme and dating the duty correctly to 1 January 2025
• listing the kinds of processing that force a Data Protection Assessment, and dating the assessment duty to activities created or generated on or after 1 August 2026

Steps in this lab

1. The vocabulary, the citation, and who enforces this
2. Set up the worksheet - four tabs, named now, filled as you go
3. The applicability test - THREE triggers, and the surprise is how far it just widened
4. No small-business escape hatch - the no-volume triggers, sensitive data, and the exemptions
5. The consumer rights and the workflow - the 45-day clock and the mandatory 60-day appeal
6. The obligations - the privacy notice, the recognized opt-out signal, and the DPA triggers
7. CTDPA vs CCPA vs VCDPA vs CPA vs TDPSA - the differences that change your answer (aside)
8. The pro move - build to the multi-state matrix, not one law at a time

Open the full interactive lab →