HB 5210 — AN ACT ESTABLISHING VARIOUS DATA SECURITY REQUIREMENTS APPLICABLE TO CERTAIN FINANCIAL INSTITUTIONS.

House of Representatives General Assembly RaisedFile Bill No.

5210133 February Session, 2026 LCOSubstitute House Bill No.

15785210 ReferredHouse toof Representatives, March 24, 2026 The Committee on BANKINGBanking Introducedreported by:through REP.

(BA)DOUCETTE ANof ACTthe ESTABLISHING13th VARIOUSDist., DATAChairperson SECURITYof REQUIREMENTSthe APPLICABLECommittee TOon CERTAINthe FINANCIALpart INSTITUTIONS.of the House, that the substitute bill ought to pass.

AN ACT ESTABLISHING VARIOUS DATA SECURITY REQUIREMENTS APPLICABLE TO CERTAIN FINANCIAL INSTITUTIONS.

(a) EachAs financialused institution that is a bank, a Connecticut credit union, a federal credit union, an out-of-state bank that maintains a branch in this state,section: an out-of-state trust company or an out-of-state credit union that maintains an office in this state [,] or a licensee under this title, [or] and any person subject to the jurisdiction of the commissioner under title 36b shall (1) adopt, in writing, a program setting forth standards for developing, implementing and maintaining reasonable data security safeguards to protect the security, confidentiality and integrity of customer information, and (2) comply with all provisions of Subtitle A of Title V of the Gramm-Leach-Bliley Financial Modernization Act of 1999, 15 USC 6801 et seq., and the regulations promulgated thereunder that apply to such financial LCO No.

1578(1) 1"Data security incident" means any unauthorized access to or unauthorized acquisition, destruction or corruption of 2electronic Raisedfiles, Billmedia, No.databases or computerized data containing (A) personal information of an individual, or (B) supervisory, financial, operational or business information of any (i) licensee under this title, (ii) Connecticut bank, or (iii) Connecticut credit union;

5210(2) institution"Financial orinstitution" person,has exceptthe tosame themeaning extentas thatprovided thisin [section]Section subsection509 isinconsistentof withtheprovisionsofsections36a-41tothe 36a-44,inclusive,Gramm-Leach-Bliley inFinancial whichModernization caseAct theof provisions1999, that15 affordUSC 6809, and the customerregulations greaterpromulgated protectionthereunder, shallas control.said sHB5210 / File No.

For133 purposes1 ofsHB5210 thisFile [section]No. subsection, "financial institution" has the meaning given to that term in Section 509 of the Gramm-Leach-Bliley Financial Modernization Act of 1999, 15 USC 6809, and the regulations promulgated thereunder, as said act and such regulations may be amended from time to time.

(b)133 Eachact licenseeand undersuch thisregulations titlemay thatbe maintains customer information for any consumer in this state shall comply with all applicable provisions of 16 CFR Part 314, as amended from time to time.time;

(c) Each licensee under this title, bank, Connecticut credit union and federal(3) credit"Personal unioninformation" shall file a written report with the Department of Banking, in a form and manner prescribed by the Banking Commissioner, not later than three business days after such licensee, bank or credit union knows, or has reason to know, of the occurrencesame ofmeaning anyas dataprovided security incident that (1) affects its ability to do business, or (2) involves, or potentially involves, any unauthorized access to the personal information of any consumer in thissection state.36a-701b.

(b) Each financial institution that is a bank, a Connecticut credit union, a federal credit union, an out-of-state bank that maintains a branch in this state, an out-of-state trust company or out-of-state credit union that maintains an office in this state [,] or a licensee under this title, [or any] and each person subject to the jurisdiction of the commissioner under title 36b, shall (1) adopt, in writing, a program setting forth standards for developing, implementing and maintaining reasonable data security safeguards to protect the security, confidentiality and integrity of customer information, and (2) comply with all provisions of Subtitle A of Title V of the Gramm-Leach-Bliley Financial Modernization Act of 1999, 15 USC 6801 et seq., and the regulations promulgated thereunder that apply to such financial institution [, except to] or person, including, but not limited to, the applicable provisions of 12 CFR Part 364, Appendix B, 12 CFR Part 748, Appendix A and 16 CFR Part 314, as said act and such regulations may be amended from time to time.

To the extent that this [section] subsection is inconsistent with the provisions of sections 36a-41 to 36a- 44, inclusive, [in which case] the provisions that afford the customer greater protection shall control.

[For purposes of this section, "financial institution" has the meaning given to that term in Section 509 of the Gramm-Leach-Bliley Financial Modernization Act of 1999, 15 USC 6809, and the regulations promulgated thereunder.] (c) Each licensee under this title, Connecticut bank and Connecticut credit union shall file a notification with the Department of Banking, in a form and manner prescribed by the Banking Commissioner, not later than three business days after such licensee, Connecticut bank or Connecticut credit union knows, or has reason to know, of the occurrence of any data security incident that may (1) materially impact its ability to operate in a safe and sound manner or comply with applicable laws and regulations, (2) cause significant disruption in sHB5210 / File No.

133 2 sHB5210 File No.

133 customer services, or (3) involve any unauthorized access to the personal information of any individual.

Section 1 October 1, 2026 36a-44a StatementBA ofJoint Purpose:Favorable Subst.

TosHB5210 establish/ variousFile dataNo. security requirements applicable to certain financial institutions.

that133 when3 thesHB5210 entireFile text of a bill or resolution or a section of a bill or resolution is new, it is not underlined.] LCO No.

1578133 2The following Fiscal Impact Statement and Bill Analysis are prepared for the benefit of 2the members of the General Assembly, solely for purposes of information, summarization and explanation and do not represent the intent of the General Assembly or either chamber thereof for any purpose.

In general, fiscal impacts are based upon a variety of informational sources, including the analyst’s professional knowledge.

Whenever applicable, agency data is consulted as part of the analysis, however final products do not necessarily reflect an assessment from any specific department.

OFA Fiscal Note State Impact:

None Municipal Impact:

None Explanation The bill, which requires certain financial institutions to adopt data security safeguards and to notify the Department of Banking of certain data security incidents, results in no fiscal impact to the state as the department has sufficient resources to receive the notifications.

sHB5210 / File No.

133 4 sHB5210 File No.

133 OLR Bill Analysis sHB 5210 AN ACT ESTABLISHING VARIOUS DATA SECURITY REQUIREMENTS APPLICABLE TO CERTAIN FINANCIAL INSTITUTIONS.

SUMMARY This bill requires the following entities and individuals to adopt written programs with standards on developing, implementing, and maintaining reasonable data security safeguards to protect the security, confidentiality, and integrity of customer information:

banks, Connecticut credit unions, federal credit unions, out-of-state banks with a branch in Connecticut, out-of-state trust companies or credit unions with an office in Connecticut, licensees under Connecticut banking law, and those who are subject to the Department of Banking’s (DOB) jurisdiction under Connecticut securities law.

Under the bill, to the extent that this requirement conflicts with existing state law on financial records disclosure, the provisions giving customers the greater protection control.

The bill also requires DOB licensees and Connecticut banks and credit unions to notify the department within three business days after they know, or have reason to know, of certain data security incidents.

The reporting requirement is triggered by any incident that may (1) materially impact the ability to operate safely and soundly or comply with applicable laws and regulations, (2) significantly disrupt customer services, or (3) involve unauthorized access to an individual’s personal information (see BACKGROUND).

Under existing law, the same entities and individuals that the bill requiresto adopt awrittenprogramonprotecting customer information mustcomplywiththefinancialprivacyprovisionsoftheGramm-Leach- Bliley Financial Modernization Act of 1999 and associated regulations sHB5210 / File No.

133 5 sHB5210 File No.

133 (see BACKGROUND).

The bill specifies that this includes required compliance with the applicable provisions of three associated federal regulations on standards for developing, implementing, and maintaining safeguards to protect customer information.

Lastly, the bill makes technical and conforming changes.

EFFECTIVE DATE:

October 1, 2026 DATA SECURITY INCIDENT Under the bill, a “data security incident” is unauthorized access to or unauthorized acquisition, destruction, or corruption of certain electronic files, media, databases, or computerized data.