Connecticut 2026 Session Status: Passed Senate 1 R cosponsors

SB 117 — AN ACT CONCERNING BREACHES OF SECURITY INVOLVING ELECTRONIC PERSONAL INFORMATION.

Last action — HOUSE CALENDAR NUMBER 529

Track this bill free

No card. One bill, free forever — alerts when it moves.

  1. ✓
    Introduced
  2. ✓
    In Committee
  3. 3
    Passed Senate
  4. 4
    Passed House
  5. 5
    To Executive
  6. 6
    Enacted

This bill has passed the Senate. Introduced February 10, 2026. It now moves to the second chamber.

Next likely step: consideration and a floor vote in the House.

Prognosis

Stalled 28% · moderate confidence

Where this bill stands today.

Odds of enactment

High

How often bills like it became law.

  • Passed Senate

    Current position in the legislative process.

  • 1 sponsor

    1 primary, 0 co-sponsors signed on.

  • Single-party support

    Sponsorship is currently within one party (1 R).

Prognosis reads this bill's own signals — stage, sponsorship breadth, committee status, recorded votes and cross-state momentum. Odds come from a model trained on which bills have become law.

Bill Text

What changed in the latest version

20 added · 175 removed

Plain-language change summary

The recent amendments to Bill SB 117 involved changing the term "resident" to "affected resident" in one section of the bill. This change clarifies that the legislation specifically addresses those residents impacted by the issues at hand, rather than all residents in the area. This distinction is important because it ensures that resources and protections are directed toward those who need them most, making the bill more effective in addressing specific concerns.

→
Previous
Latest
Senate General Assembly File No.
General Assembly Substitute Bill No.
340 February Session, 2026 Substitute Senate Bill No.
117 February Session, 2026 AN ACT CONCERNING BREACHES OF SECURITY INVOLVING ELECTRONIC PERSONAL INFORMATION.
117 Senate, April 2, 2026 The Committee on General Law reported through SEN.
MARONEY of the 14th Dist., Chairperson of the Committee on the part of the Senate, that the substitute bill ought to pass.
AN ACT CONCERNING BREACHES OF SECURITY INVOLVING ELECTRONIC PERSONAL INFORMATION.
[and (2) "personal information"] (2) "Massive breach of security" means a breach of security where (A) the personal information of at least one hundred thousand residents of sSB117 / File No.
[and (2) "personal information"] (2) "Massive breach of security" means a breach of security where (A) the personal information of at least one hundred thousand residents of this state has been breached or is likely to have been breached, and (B) the breach of security occurred due to any unauthorized access to, or any unauthorized use of, a computer or computer network;
340 1 sSB117 File No.
and (3) "Personal information" means an individual's (A) first name or first initial and last name in combination with any one, or more, of the LCO 1 of 9 Substitute Bill No.
340 this state has been breached or is likely to have been breached, and (B) the breach of security occurred due to any unauthorized access to, or any unauthorized use of, a computer or computer network;
117 following data:
and (3) "Personal information" means an individual's (A) first name or first initial and last name in combination with any one, or more, of the following data:
Such notice shall be made without unreasonable delay but not later than sixty days after the discovery of sSB117 / File No.
Such notice shall be made without unreasonable delay but not later than sixty days after the discovery of such breach, unless a shorter time is required under federal law, subject to the provisions of subsection (d) of this section.
340 2 sSB117 File No.
If the person identifies additional residents of this state whose personal information was breached or reasonably believed to have been breached following sixty daysafterthediscovery ofsuchbreach,thepersonshallproceed ingood LCO 2 of 9 Substitute Bill No.
340 such breach, unless a shorter time is required under federal law, subject to the provisions of subsection (d) of this section.
117 faith to notify such additional residents as expediently as possible.
If the person identifies additional residents of this state whose personal information was breached or reasonably believed to have been breached following sixty daysafterthediscovery ofsuchbreach,thepersonshallproceed ingood faith to notify such additional residents as expediently as possible.
(c) Any person [that] who maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the personal information of any breach of the security of the data immediately following its discovery, if the personal information of a resident of this state was breached or is reasonably sSB117 / File No.
(c) Any person [that] who maintains computerized data that includes personal information that the person does not own shall notify the owner or licensee of the personal information of any breach of the security of the data immediately following its discovery, if the personal information of a resident of this state was breached or is reasonably believed to have been breached.
340 3 sSB117 File No.
(d) Any notification required by this section shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law LCO 3 of 9 Substitute Bill No.
340 believed to have been breached.
117 enforcement agency has made a request that [the] such notification be delayed.
(d) Any notification required by this section shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that [the] such notification be delayed.
(B) conspicuous posting of the notice on the web site of the person if the sSB117 / File No.
(B) conspicuous posting of the notice on the web site of the person if the person maintains one;
340 4 sSB117 File No.
340 person maintains one;
(f) (1) In the event of a breach of login credentials under subparagraph (B) of subdivision [(2)] (3) of subsection (a) of this section, notice to a resident may be provided in an electronic or other form that directs the resident whose personal information was breached, or is reasonably believed to have been breached, to promptly change any password or security question and answer, as applicable, or to take other appropriate steps to protect the affected online account and all other online accounts for which the resident uses the same user name or electronic mail address and password or security question and answer.
(f) (1) In the event of a breach of login credentials under subparagraph (B) of subdivision [(2)] (3) of subsection (a) of this section, LCO 4 of 9 Substitute Bill No.
117 notice to a resident may be provided in an electronic or other form that directs the resident whose personal information was breached, or is reasonably believed to have been breached, to promptly change any password or security question and answer, as applicable, or to take other appropriate steps to protect the affected online account and all other online accounts for which the resident uses the same user name or electronic mail address and password or security question and answer.
Any person [that] who maintains such a sSB117 / File No.
Any person [that] who maintains such a securitybreachprocedurepursuanttotherules,regulations,procedures or guidelines established by the primary or functional regulator, as defined in 15 USC 6809(2), as amended from time to time, shall be deemed to be in compliance with the security breach notification requirements of this section, provided (1) such person notifies, as LCO 5 of 9 Substitute Bill No.
340 5 sSB117 File No.
117 applicable, such residents of this state, owners [,] and licensees required to be notified under, and in accordance with, the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of security, and (2) if notice is given to a resident of this state in accordance with subdivision (1) of this subsection regarding a breach of security, such person also notifies the Attorney General, in a form and manner prescribed by the Attorney General, not later than the time when notice is provided to the resident.
340 securitybreachprocedurepursuanttotherules,regulations,procedures or guidelines established by the primary or functional regulator, as defined in 15 USC 6809(2), as amended from time to time, shall be deemed to be in compliance with the security breach notification requirements of this section, provided (1) such person notifies, as applicable, such residents of this state, owners [,] and licensees required to be notified under, and in accordance with, the policies or the rules, regulations, procedures or guidelines established by the primary or functional regulator in the event of a breach of security, and (2) if notice is given to a resident of this state in accordance with subdivision (1) of this subsection regarding a breach of security, such person also notifies the Attorney General, in a form and manner prescribed by the Attorney General, not later than the time when notice is provided to the resident.
(i) (1) Notwithstanding the provisions of subsections (g) and (h) of this section, any person who owns, licenses or maintains computerized data that includes personal information shall, subject to the provisions of subsection (d) of this section, (A) immediately following the discovery of any unauthorized access to, or any unauthorized use of, a computer or computer network that will likely result in a massive breach of security, retain a third party who has experience performing sSB117 / File No.
(i) (1) Notwithstanding the provisions of subsections (g) and (h) of this section, any person who owns, licenses or maintains computerized data that includes personal information shall, subject to the provisions of subsection (d) of this section, (A) immediately following the discovery of any unauthorized access to, or any unauthorized use of, a computer or computer network that will likely result in a massive breach of security, retain a third party who has experience performing forensic examinations and analyses of computers or computer networks to (i) perform a forensic examination and analysis of the computer or computer network that was the subject of such unauthorized access or use, and (ii) prepare a detailed forensic report disclosing, at a minimum, (I)theresultsoftheforensicexaminationandanalysis,and(II)howsuch LCO 6 of 9 Substitute Bill No.
340 6 sSB117 File No.
117 unauthorized access or use occurred, as well as the root causes of such unauthorized access or use, to the extent the forensic examination and analysis revealed such information, and (B) not later than sixty days following the discovery of any unauthorized access to, or any unauthorized use of, a computer or computer network that will likely result in a massive breach of security, submit to the Attorney General, in a form and manner prescribed by the Attorney General, a reasonable timeline to (i) prepare the detailed forensic report, and (ii) submit such report to the Attorney General upon request by the Attorney General.
340 forensic examinations and analyses of computers or computer networks to (i) perform a forensic examination and analysis of the computer or computer network that was the subject of such unauthorized access or use, and (ii) prepare a detailed forensic report disclosing, at a minimum, (I)theresultsoftheforensicexaminationandanalysis,and(II)howsuch unauthorized access or use occurred, as well as the root causes of such unauthorized access or use, to the extent the forensic examination and analysis revealed such information, and (B) not later than sixty days following the discovery of any unauthorized access to, or any unauthorized use of, a computer or computer network that will likely result in a massive breach of security, submit to the Attorney General, in a form and manner prescribed by the Attorney General, a reasonable timeline to (i) prepare the detailed forensic report, and (ii) submit such report to the Attorney General upon request by the Attorney General.
[(i)] (j) All documents, materials and information provided in response to an investigative demand issued pursuant to subsection (c) sSB117 / File No.
[(i)] (j) All documents, materials and information provided in response to an investigative demand issued pursuant to subsection (c) of section 42-110d in connection with the investigation of a breach of security, [as defined by this section] and all forensic reports prepared pursuant to subsection (i) of this section, shall be exempt from public disclosure under subsection (a) of section 1-210, provided the Attorney General may make such documents, materials, [or] information or LCO 7 of 9 Substitute Bill No.
340 7 sSB117 File No.
117 forensic reports available to third parties in furtherance of such investigation.
340 of section 42-110d in connection with the investigation of a breach of security, [as defined by this section] and all forensic reports prepared pursuant to subsection (i) of this section, shall be exempt from public disclosure under subsection (a) of section 1-210, provided the Attorney General may make such documents, materials, [or] information or forensic reports available to third parties in furtherance of such investigation.
Section 1 October 1, 2026 36a-701b sSB117 / File No.
Section 1 October 1, 2026 36a-701b GL Joint Favorable Subst.
340 8 sSB117 File No.
JUD Joint Favorable LCO 8 of 9 Substitute Bill No.
340 Statement of Legislative Commissioners:
117 LCO 9 of 9
In Subsec.
(f)(2), "resident" was changed to "affected resident" for internal consistency.
GL Joint Favorable Subst.
sSB117 / File No.
340 9 sSB117 File No.
340 The following Fiscal Impact Statement and Bill Analysis are prepared for the benefit of the members of the General Assembly, solely for purposes of information, summarization and explanation and do not represent the intent of the General Assembly or either chamber thereof for any purpose.
Show all 95 changed rows (55 more)
Previous
Latest
In general, fiscal impacts are based upon a variety of informational sources, including the analyst’s professional knowledge.
Whenever applicable, agency data is consulted as part of the analysis, however final products do not necessarily reflect an assessment from any specific department.
OFA Fiscal Note State Impact:
Agency Affected Fund-Effect FY 27 $ FY 28 $ Resources of the General Fund GF - Potential See Below See Below Revenue Gain Note:
GF=General Fund Municipal Impact:
None Explanation The bill requires a forensic examination for a massive breach of security and allows the Office of the Attorney General (OAG) to issue a civil penalty of up to $250,000 for noncompliance, resulting in a potential revenue gain to the General Fund to the extent violations occur.
The bill also makes violations an unfair trade practice enforced by the OAG resulting in no fiscal impact because the OAG has the resources and expertise to meet the requirements of the bill.
The Out Years The annualized ongoing fiscal impact identified above would continue into the future subject to the number of violations.
1The bill requires the person or entity who experiences a massive breach of security to pay for a third-party to conduct a forensic examination.
sSB117 / File No.
340 10 sSB117 File No.
340 OLR Bill Analysis sSB 117 AN ACT CONCERNING BREACHES OF SECURITY INVOLVING ELECTRONIC PERSONAL INFORMATION.
SUMMARY This bill requires a person or entity with computerized data that includes personal information to immediately retain a third party for a forensic examination after discovering a massive breach of security.
A “massive breach of security” is a breach or a likely breach of at least 100,000 residents’ personal information through unauthorized access to or use of a computer or computer network.
The law generally already requires these people and entities to notify affected individuals and the attorney general about any security breach and offer identity theft protection to certain affected individuals.
It also makes it a Connecticut Unfair Trade Practices Act (CUTPA) violation to violate these provisions.
Within 60 days of discovering a breach that likely results in a massive breach of security, the bill requires the person or entity to give the attorney general, in a way set by the attorney general, a reasonable timeline for (1) preparing the forensic report and (2) submitting it, if requested, to the attorney general.
If the person or entity does not submit a requested report in a way set by the attorney general, the attorney general can have a third party conduct the examination and produce a report.
The bill delays a required forensic examination if a law enforcement agency requests a delay because the examination will impede a criminal investigation.
The delay ends when the law enforcement agency issues notice that the examination will not compromise the investigation.
The bill exempts these forensic reports and other information related sSB117 / File No.
340 11 sSB117 File No.
340 to investigations under the bill from disclosure under the Freedom of Information Act (FOIA).
It also (1) makes violations of the bill a CUTPA violation that is enforced by the attorney general and (2) allows the attorney general to impose a civil penalty of up to $250,000 for failing to submit a requested forensic report to the attorney general.
The bill also makes minor, technical, and conforming changes, including that when the law requires certain security breach notices to the attorney general, they be in a form and manner set by the attorney general.
EFFECTIVE DATE:
October 1, 2016 FORENSIC EXAMINATION AND REPORT The bill requires the third party retained for a forensic examination underthebilltohaveexperienceinforensicexaminationsandanalyzing computers or computer networks.
The third party must produce a detailed forensic report that includes (1) the examination and analysis results and (2) how the unauthorized access or use occurred and its root causes, if known.
The person or entity discovering the massive breach of security must pay for the cost of the examination, analysis, and report, whether the third party is retained by the person or entity or the attorney general.
FOIA Under existing law, information provided as part of a response to an investigation of a CUTPA violation related to a security breach is exempt from disclosure under FOIA, but the attorney general may give this information to third parties as part of the investigation.
The bill extends this exemption to cover CUTPA investigations related to the bill’s provisions, exempts the bill’s required forensic reports from disclosure under FOIA, and allows the attorney general to make the reports available to third parties as part of a CUTPA investigation.
The bill specifies that submitting the forensic reports to the attorney general does not waive the attorney-client privilege or work product sSB117 / File No.
340 12 sSB117 File No.
340 protection, if it applies to specific information in the reports.
PENALTIES By law, it is a CUTPA violation, enforceable by the attorney general, for failing to comply with existing law’s security breach notice requirements.
The bill expandsthisto also include violationsofthebill’s requirements.
In addition to CUTPA penalties, the bill allows the attorney general to impose a civil penalty of up to $250,000 for failure to submit a requested forensic report.
The bill requires a court, presumably if reviewing the amount of the civil penalty on appeal, to consider whether the business is a (1) for profit small business with up to 500 employees, (2) independently owned and operated business with less than 50 full-time employees or less than $5 million in gross annual sales (a micro business), or (3) nonprofit entity employing up to 500 employees or less than 50 full-time employees.
As with civil penalties related to violating the law’s security breach notice requirements, the bill permits depositing civil penalties collected for violating the bill’s provisions in the privacy protection guaranty and enforcementaccount.Bylaw,thisaccountisusedtoenforcecertainlaws about safeguarding personal information and reimburses individuals hurt by violations of these provisions.
BACKGROUND Breach of Security By law, a “breach of security” is unauthorized access to, or acquisition of, electronic files, media, databases or computerized data containing personal information when access to that information has not been secured by encryption or alternate means rendering it unreadable or unusable.
Personal Information By law, “personal information” includes a person’s first name or first initial and last name combined with certain information such as a social sSB117 / File No.
340 13 sSB117 File No.
340 security, taxpayer identification, driver’s license, credit or debit card number;
medical or biometric information;
geolocation data;
or user name or email address combined with a password or security question and answer.
It does not include information that is lawfully available to the public from government or widely distributed media.
CUTPA By law, CUTPA prohibits businesses from engaging in unfair and deceptive acts or practices.
It allows the Department of Consumer Protection commissioner, under specified procedures, to issue regulations defining an unfair trade practice, investigate complaints, issue cease and desist orders, order restitution in cases involving less than $10,000, impose civil penalties of up to $5,000, enter into consent agreements, ask the attorney generalto seek injunctive relief, and accept voluntary statements of compliance.
It also allows individuals to sue.
Courts may issue restraining orders;
award actual and punitive damages, costs, and reasonable attorney’s fees;
and impose civil penalties of up to $5,000 for willful violations and up to $25,000 for a restraining order violation.
COMMITTEE ACTION General Law Committee Joint Favorable Substitute Yea 21 Nay 0 (03/16/2026) sSB117 / File No.
340 14
⬇ Download PDF
View plain text versions (4)

How this bill changes current law

7 changes Share ↗

AI-generated reading aid from the bill's amendatory text — verify against the official bill.

The bill updates the definition of security breaches and modifies notification requirements for breaches involving electronic personal information.

  • Section 36a-701b

    breach of security means unauthorized access to, or unauthorized acquisition of, electronic files, media, databases or computerized data, → Breach of security means unauthorized access to, or unauthorized acquisition of, electronic files, media, databases or computerized data,

    Clarifies the definition of 'breach of security'.

  • Section 36a-701b

    and (2) "personal information" → and (2) "Massive breach of security" means a breach of security where (A) the personal information of at least one hundred thousand residents of this state has been breached or is reasonably believed to have been breached, and (B) the breach of security occurred due to the unauthorized use of a computer or computer network;

    Introduces a new definition for 'Massive breach of security'.

  • Section 36a-701b

    Any person who owns, licenses or maintains computerized data that includes personal information, → Any person who owns, licenses or maintains computerized data that includes personal information shall provide notice of any breach of security, following the discovery of the breach, to any resident of this state whose personal information was breached or is reasonably believed to have been breached.

    Clarifies the notification obligation for breaches involving personal information.

  • Section 36a-701b

    such notice shall be made without unreasonable delay but not later than sixty days after the discovery of such breach, unless a shorter time is required under federal law, subject to the provisions of subsection (d) of this section. → Such notice shall be made without unreasonable delay but not later than sixty days after the discovery of such breach, unless a shorter time is required under federal law, subject to the provisions of subsection (d) of this section.

    Confirms the deadline for notifying individuals about data breaches.

  • Section 36a-701b

    If the person identifies additional residents of this state whose personal information was breached or reasonably believed to have been breached following sixty days after the discovery of such breach, → If the person identifies additional residents of this state whose personal information was breached or reasonably believed to have been breached following sixty days after the discovery of such breach, the person shall proceed in good faith to notify such additional residents as expediently as possible.

    Clarifies the need for continued notification after the initial breach discovery.

  • Section 36a-701b

    Such service or services shall be provided at no cost to such resident for a period of not less than two years. → Such services shall be provided at no cost to such resident for a period of not less than two years.

    Ensures that identity theft prevention services are offered at no cost.

  • Section 36a-701b

    Substitute notice shall consist of the following: (A) Electronic mail notice when the person has an electronic mail address for the affected persons; (B) conspicuous posting of the notice on the web site of the person if the person maintains one; and (C) notification to major state-wide media, including, but not limited to, newspapers, radio and television. → Substitute notice shall consist of the following: (A) Electronic mail notice when the person has an electronic mail address for the affected persons; (B) conspicuous posting of the notice on the website of the person if the person maintains one; and (C) notification to major state-wide media, including, but not limited to, newspapers, radio and television.

    Clarifies the requirements for substitute notice in breach situations.

Action History

  1. HOUSE CALENDAR NUMBER 529

  2. FAV. RPT., TABLED FOR HOUSE CALENDAR

  3. RULES SUSPENDED,TRANS.TO HOUSE

  4. SEN. PASSED, SEN. AMEND. SCH. A

  5. SEN. ADOPTED SEN. AMEND. SCH. A

  6. FAV. RPT., TAB. FOR CAL., SEN.

  7. NO NEW FILE BY COMM. ON Judiciary

  8. RPTD. OUT OF LCO

  9. FILED WITH LCO

  10. Joint Favorable

  11. IMMEDIATE TRANSMITTAL TO COMM. ON Judiciary

  12. FILE NO. 340

  13. SENATE CALENDAR NUMBER 226

  14. FAV. RPT., TAB. FOR CAL., SEN.

  15. RPTD. OUT OF LCO

  16. REFERRED TO Office of Legislative Research AND Office of Fiscal Analysis 04/01/26

  17. FILED WITH LCO

  18. Joint Favorable Substitute

  19. PUBLIC HEARING 0218

  20. REF. TO JOINT COMM. ON General Law

Sponsors

Sponsorship breakdown

Export CSV (upgrade) →

1 sponsors · 0 co-sponsors · 186 not signed on

Sponsors (1)

Co-sponsors (0)

None.

Not signed on (186)

186 members have not signed on to this bill.

Show all 186 →

"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.

Whip count is in markup. Polling the chamber and every recorded vote this session. Only the first open is slow. It’s instant for you after this. Calling the roll · Tallying · Engrossing

Subjects

public-safety technology
Cross-referencing the record. Reading this bill against every other bill in the corpus by meaning, not keywords. Only the first open is slow. It’s instant for you after this. Matching · Ranking · Engrossing

Frequently asked questions

Who sponsors SB 117?
SB 117 is sponsored by Jeff Gordon (Republican).
What is the current status of SB 117?
This bill has passed the Senate. Introduced February 10, 2026. It now moves to the second chamber.
Where can I track SB 117?
Track SB 117 free on One Click Politics — get push/email alerts when it moves.

Make your voice heard on SB 117

Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.

Find my representatives → Run a campaign

Stay ahead of SB 117

Last checked for changes 3 months ago · updated continuously

One Click Politics tracks every bill in Congress and all 50 states.

Track this bill →