The civic record
Read. Follow. Verify.Connecticut requires financial institutions to adopt data security safeguards and report security breaches
Last action · March 24, 2026: File Number 133Sponsors: Travis Simms and 3 others
Track this bill to get notified when it advances a stage. One tap to stop, anytime.
What This Bill Proposed
Banks, credit unions, and other financial licensees must adopt written data security safeguard programs and report security breaches to the Department of Banking within three business days, starting October 1, 2026.
Financial institutions face mandatory compliance standards and strict three-day reporting deadlines for cyber incidents that compromise customer data or disrupt operations.
Who It Would Have Affected
Groups the bill's text would have affected, as described in the record. Being affected is not a position for or against it.
Banks and Credit Unions
Banks and credit unions must adopt written data security safeguard programs and submit mandatory incident notifications to the Department of Banking within three business days.
Department of Banking
The department receives and processes data security incident notifications submitted by financial institutions and licensees.
Financial Consumers
Consumers receive enhanced data security safeguards for their personal and financial information, with provisions favoring greater customer protection in case of legal conflicts.
Key Facts
- Covered financial institutions must adopt a written program setting forth standards for developing, implementing, and maintaining reasonable data security safeguards.
- Institutions required to adopt security programs include banks, Connecticut credit unions, federal credit unions, out-of-state banks and trust companies with branches in the state, and title 36a and 36b licensees.
- Licensees, Connecticut banks, and Connecticut credit unions must notify the Department of Banking not later than three business days after knowing or having reason to know of a qualifying data security incident.
- A qualifying data security incident includes any incident that materially impacts operations, causes significant customer service disruption, or involves unauthorized access to personal information.
Show all 6 facts
- Where state data security requirements conflict with existing financial records disclosure laws under sections 36a-41 to 36a-44, the provisions affording greater customer protection control.
- Covered entities must comply with Subtitle A of Title V of the Gramm-Leach-Bliley Financial Modernization Act of 1999 and associated regulations including 12 CFR Part 364 Appendix B, 12 CFR Part 748 Appendix A, and 16 CFR Part 314.
Frequently Asked Questions
Which financial entities must comply with the new data security program rules?
How quickly must a financial institution report a data security incident to the state?
What triggers the mandatory breach notification to the Department of Banking?
What else do you want to know?
News Coverage
Follow the record
Votes, people, money & the original sourceWhere This Stands
This bill did not become law - Died at adjournment · on the House floor.
Procedural history
9 actions- Mar 24, 2026Connecticut General AssemblyFile Number 133
- Mar 24, 2026HouseHouse Calendar Number 113
- Mar 24, 2026HouseFavorable Report, Tabled for the Calendar, House
- Mar 24, 2026Connecticut General AssemblyReported Out of Legislative Commissioners' Office
- Mar 18, 2026Connecticut General AssemblyReferred to Office of Legislative Research and Office of Fiscal Analysis 03/23/26 5:00 PM
- Mar 10, 2026Connecticut General AssemblyFiled with Legislative Commissioners' Office
Show 3 earlier actions
- Mar 10, 2026Connecticut General AssemblyJoint Favorable Substitute
- Feb 19, 2026Connecticut General AssemblyPublic Hearing 02/24
- Feb 18, 2026Connecticut General AssemblyCommitteeReferred to Joint Committee on Banking
Version history
Only one version on file - nothing to compare yet. As later stages (committee substitute, engrossed, enrolled) are captured, the redline appears here.
View official text →Lobbying Activity
No state lobbying filings in our records match this bill. Federal lobbying reports (LDA) cover Congress, so they are not listed on state bills.
Full breakdown
Who this bill affects and the strongest case for and against it, written only from the bill’s own text.
Sponsors
Discoveries
Patterns POLISCOPE noticed across the record. These are observations to investigate, not conclusions.
Establishment of State-Level Breach Notification Window
The legislation establishes a strict three-day reporting window for financial institutions to notify the Department of Banking of qualifying data security incidents.
Connected Entities
Sources
cga.ct.gov
Analysis Score
0–100- Significance20Lowered because this bill did not pass (its text scored 65)
- Controversy10Intensity of disagreement among stakeholders
- Entertainment5Compellingness for a non-policy-wonk reader
- Buzz25Current news / social attention level
Publisher tools