Obligations United States Connecticut
What a Connecticut business has to have in writing
Connecticut's OSHA state plan covers only state and municipal employees, so private employers answer to federal OSHA, but almost every other written-policy category is occupied. Any business that collects Social Security numbers must create and publicly display a privacy protection policy.
Employers with three or more people must run two hours of sexual harassment training and hand out written harassment and pregnancy accommodation notices, and every employer must give applicants and employees the wage range for a job.
The Connecticut Data Privacy Act brings notices, opt-out signals and data protection assessments, and insurance licensees certify a written security program to the Insurance Department each April.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
ConnecticutHandbook 2026acknowledged by name
Connecticut on Recordwith AllyMatter
Cover Connecticut the Modern WayEvery policy Connecticut makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Connecticut on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Connecticut rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Connecticut breach of security notification lawAI-compiledConn. Gen. Stat. § 36a-701bAny person or business that owns, licenses or maintains computerized personal information about Connecticut residentsDistribute
Notice
Notify affected Connecticut residents and the Attorney General no later than 60 days after discovering the breach, and offer at least 24 months of free identity theft prevention or mitigation services when Social Security numbers or taxpayer identification numbers are involved. If you learn of more residents after the first round, send follow-up notices, and if you only maintain the data for someone else, tell the owner as soon as you find out.
From the first employee
Connecticut Attorney General
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Safeguarding of Social Security numbers and the cybersecurity safe harborAI-compiledConn. Gen. Stat. § 42-471; Conn. Gen. Stat. §§ 42-901 to 42-905 (PA 21-119)Any person or business that collects Social Security numbers in the course of business; the safe harbor is open to any business that adopts a recognized cybersecurity frameworkWrite
Written policy
Create a privacy protection policy that says how Social Security numbers are protected, limits unnecessary disclosure and requires secure destruction of records holding them, and publish or display the policy publicly. Separately, a business that writes and maintains a cybersecurity program conforming to a recognized framework such as the NIST Cybersecurity Framework, ISO 27001 or the CIS Controls, scaled to its size and data, gains an affirmative defense against punitive damages in a Connecticut data breach claim.
From the first employee
Connecticut Attorney General
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Connecticut Data Privacy ActAI-compiledConn. Gen. Stat. §§ 42-515 to 42-525 (PA 22-15, amended by PA 23-56 and by SB 1295 of 2025)Businesses that target Connecticut residents and control or process personal data above the statutory thresholds; the 2025 amendment lowers the main trigger to 35,000 consumers from July 1, 2026, with lower triggers for selling data or processing sensitive dataWrite + ack
Written policy
Publish a privacy notice listing the categories of personal data collected and shared, the purposes, how a consumer submits and appeals a rights request, and an active email or online route for contacting you. Get opt-in consent before processing sensitive data or the data of a known teen, honor universal opt-out preference signals, sign data processing agreements with processors, and document a data protection assessment for targeted advertising, data sales, sensitive data and heightened-risk profiling. Consumer health data carries its own consent and access-restriction duties.
From the first employee
Connecticut Attorney General
Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data
LawProduceWhat it requiresTriggerEnforced by
Connecticut Data Privacy Act, biometric data as sensitive dataAI-compiledConn. Gen. Stat. 42-515 to 42-525 (CTDPA); applicability and exemptions at 42-517Controllers caught by the CTDPA thresholds. Connecticut has no standalone biometric privacy act of the Illinois BIPA kind, so biometric duties arrive through the sensitive-data rules of the general privacy lawWrite
Written policy
Treat genetic or biometric data, and information derived from it, as sensitive data. Get the consumer's consent before processing it, disclose it in the published privacy notice, and complete a data protection assessment before any processing that presents a heightened risk of harm, which includes sensitive-data processing. Keep the consent and assessment records; the Attorney General can demand the assessment.
From the first employee
Connecticut Attorney General
Harassment Prevention 1A written policy, and in some states annual training, on harassment
LawProduceWhat it requiresTriggerEnforced by
Sexual harassment prevention information, training and posting (Time's Up Act)AI-compiledConn. Gen. Stat. § 46a-54(15); PA 19-16Every employer must post the notice and give written harassment information; the two-hour training duty applies to employers with three or more employees, and to supervisors at any employerWrite + ack
Written policy
Post the Commission on Human Rights and Opportunities notice about the illegality of sexual harassment and the remedies available, and within three months of hire give every employee written information on the same points by email, links or hard copy. Deliver two hours of interactive training to all employees within six months of hire and to supervisors within six months of the supervisory role, with periodic supplemental training at least every ten years. Keep records showing who was trained and when.
3+ employees
Connecticut Commission on Human Rights and Opportunities
Workplace Violence Prevention 1A written plan for preventing and responding to workplace violence
LawProduceWhat it requiresTriggerEnforced by
Hospital workplace violence prevention programAI-compiledConn. Gen. Stat. § 19a-490qHospitals licensed by the Department of Public HealthWrite
Written program
Set up a workplace violence prevention and response committee, complete an annual risk assessment of the facility, and adopt a written workplace violence prevention plan built on that assessment. Record every act of workplace violence in a log, report incidents through the required channels, train staff on the plan, and review and update the plan each year.
From the first employee
Connecticut Department of Public Health
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
Connecticut Insurance Data Security LawAI-compiledConn. Gen. Stat. § 38a-38 (PA 19-117)Insurance licensees of the Connecticut Insurance Department; licensees with fewer than 10 employees, counting independent contractors, are exempt from the security program dutyCertify
Certification
Build and keep a comprehensive written information security program based on a documented risk assessment, with board or senior management oversight, third-party service provider due diligence and a written incident response plan. Domestic insurers, health care centers and fraternal benefit societies file a written certification of compliance with the Insurance Commissioner by April 15 each year. Any cybersecurity event must be reported to the Commissioner within three business days of determining it happened.
10+ employees
Connecticut Insurance Department
Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
Connecticut paid sick leave, as expanded by Public Act 24-8AI-compiledConn. Gen. Stat. §§ 31-57r to 31-57wEmployers with 25 or more employees from January 2025, 11 or more from January 2026, and one or more from January 2027Write + ack
Written policy
Let employees accrue an hour of paid sick leave for every 30 hours worked, up to 40 hours a year, with carryover. Give each employee written notice at hire of the entitlement, the amount and the terms of use, and display the Department of Labor paid sick leave poster, which satisfies the annual notice duty. Keep three years of records showing hours worked and leave accrued and used, and put the accrual and request rules in a written policy.
11+ employees
Connecticut Department of Labor, Wage and Workplace Standards Division
Connecticut Paid Leave and Connecticut FMLAAI-compiledConn. Gen. Stat. §§ 31-49e to 31-49t (Paid Leave); §§ 31-51kk to 31-51qq (CTFMLA)Every employer with at least one employee in Connecticut for the Paid Leave contribution and notice; CTFMLA job-protected leave applies at one or more employeesDistribute
Notice
Register the business with the Connecticut Paid Leave Authority, withhold the employee contribution from every paycheck and remit it quarterly, or get approval for an equivalent private plan. Give written notice of Paid Leave and CTFMLA rights at hire and once a year after that, covering the right to leave, how to apply for benefits, job protection and the ban on retaliation. Most employers state this in a handbook leave policy.
From the first employee
Connecticut Paid Leave Authority; Connecticut Department of Labor
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required state labor postingsAI-compiledConn. Gen. Stat. §§ 31-57r (paid sick leave), 31-71f (wage payment), 46a-54 (harassment), 31-40q (smoking policy), 31-284b (workers' compensation)Every Connecticut employerPost
Posting
Display the Department of Labor's state poster set - minimum wage and wage payment, paid sick leave, family and medical leave, Connecticut Paid Leave, sexual harassment, pregnancy discrimination, electronic monitoring, workers' compensation, unemployment and OSHA - where employees gather, and give equivalent notice to remote workers. Employers that monitor employees electronically must also post a written notice describing the types of monitoring used.
From the first employee
Connecticut Department of Labor; Commission on Human Rights and Opportunities
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Wage range disclosureAI-compiledConn. Gen. Stat. § 31-40z (PA 21-30)Every Connecticut employer with at least one employeeDistribute
Notice
Give an applicant the wage range for the position before or when you make an offer, and earlier if they ask. Give a current employee the wage range for their role when they are hired, when they change position, or whenever they ask. Employers usually record the range and its basis in writing because the burden of showing compliance sits with the employer.
From the first employee
Connecticut Department of Labor; private right of action
Licensing and Certifications 3Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity registration and annual reportAI-compiledConn. Gen. Stat. Title 33 (corporations); Title 34 (LLCs and partnerships); § 35-1 (trade names)Corporations, LLCs, LPs, nonprofits and out-of-state entities transacting business in Connecticut; anyone trading under an assumed nameFile
Filing / record
Register the entity through the Business One Stop portal, appoint a registered agent in Connecticut, file the trade name certificate with the town clerk if you use an assumed name, and file the annual report with the Secretary of the State each year. Register separately with the Department of Revenue Services for sales and withholding tax and with the Department of Labor for unemployment insurance.
From the first employee
Connecticut Secretary of the State, Business Services Division
Home improvement contractor and new home construction contractor registrationAI-compiledConn. Gen. Stat. §§ 20-418 to 20-432 (Home Improvement Act); §§ 20-417a to 20-417i (new home construction)Anyone contracting with a homeowner for residential improvement work, and anyone building new homes for saleCertify + ack
Certification
Register with the Department of Consumer Protection before contracting, carry at least $20,000 of general liability coverage, renew each year by the March 31 deadline, and register salespeople separately. Every home improvement contract must be in writing, signed by both sides, with start and completion dates, the registration number, a notice of the homeowner's three-day cancellation right and any deposit terms.
From the first employee
Connecticut Department of Consumer Protection
Food service licensing and Qualified Food Operator certificationAI-compiledConn. Gen. Stat. §§ 19a-36g to 19a-36j; Connecticut Public Health Code § 19-13-B42Class 2, 3 and 4 food establishments, catering businesses and itinerant food vendorsCertify
Certification
Get a food service license from the local health department before opening and renew it annually. Class 3 and 4 establishments must have a Qualified Food Operator who has passed one of the exams the Department of Public Health approves, with the certificate on file at the establishment and a substitute named when the operator is away. Establishments also keep written employee health reporting agreements and any required HACCP plan.
From the first employee
Connecticut Department of Public Health, Food Protection Program, with local health departments
Other Written Policies 3Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Workplace drug testing restrictions and written noticeAI-compiledConn. Gen. Stat. §§ 31-51t to 31-51aaAny employer that tests employees or applicants for drugs or alcoholWrite
Written policy
Tell applicants in writing at the time of application that a drug test is part of the hiring process, and give employees written notice of the testing policy. Current employees may be tested only on reasonable suspicion or where the law allows random testing for safety-sensitive or federally regulated roles, results must be confirmed by a second reliable method, and the results stay confidential. Most employers set the circumstances, procedures and consequences out in a written testing policy.
From the first employee
Connecticut Department of Labor; private right of action
MyCTSavings retirement savings programAI-compiledConn. Gen. Stat. §§ 31-71j to 31-71sEmployers that have paid five or more employees at least $5,000 in the prior calendar year and do not offer a qualified retirement planFile
Filing / record
Either certify an exemption because you already sponsor a qualified plan, or register with MyCTSavings, upload the employee roster, give employees the program information so they have the statutory window to opt out or change their contribution, and send payroll deductions each pay period.
5+ employees
Connecticut Office of the State Comptroller (MyCTSavings)
Pregnancy accommodation written noticeAI-compiledConn. Gen. Stat. § 46a-60(b)(7)Employers with three or more employeesDistribute
Notice
Give written notice of the right to be free from pregnancy discrimination and to request a reasonable accommodation to every new hire, to all existing employees once, and to any employee within ten days of telling you she is pregnant. Posting the Commission on Human Rights and Opportunities notice where employees can see it satisfies the general obligation.
3+ employees
Connecticut Commission on Human Rights and Opportunities
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Connecticut on top
Small businessFederal + industry, with Connecticut on topConstruction contractorsFederal + industry, with Connecticut on topHealthcare practicesFederal + industry, with Connecticut on topFood and beverage businessesFederal + industry, with Connecticut on topTax and accounting firmsFederal + industry, with Connecticut on topRegistered investment advisersFederal + industry, with Connecticut on topInsurance agenciesFederal + industry, with Connecticut on topRetail and e-commerceFederal + industry, with Connecticut on topTrucking and logistics carriersFederal + industry, with Connecticut on topNonprofitsFederal + industry, with Connecticut on topFederal contractorsFederal + industry, with Connecticut on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Connecticut Attorney General - The Connecticut Data Privacy ActConnecticut Attorney General - Privacy SectionConnecticut General Assembly - Public Act 22-15Connecticut Attorney General - Reporting a Data BreachConnecticut General Assembly - Public Act 21-59Connecticut General Assembly - Public Act 21-119 (cybersecurity standards incentive)Connecticut Commission on Human Rights and OpportunitiesConnecticut Department of Labor - Sexual Harassment in the WorkplaceConnecticut Department of Labor - Labor Regulation PostersConnecticut Insurance DepartmentConnecticut Insurance Department - Data Security Law Annual Certification FormConnecticut Insurance Department - Bulletin IC-42 Insurance Data Security LawConnecticut Department of Labor - Wage and Workplace StandardsConnecticut General Assembly - Public Act 21-30 An Act Concerning the Disclosure of Salary RangeConnecticut Department of Labor - EmployersConnecticut Department of Labor - Paid Sick LeaveConnecticut General Assembly - Public Act 24-8Connecticut Department of Labor - Paid Sick Leave notice poster effective 2026Connecticut Paid Leave AuthorityConnecticut Business One StopConnecticut Business One Stop - Start a BusinessConnecticut Department of Consumer Protection - Home ImprovementConnecticut DCP - Home Improvement ApplicationsConnecticut DCP - Information for Home Improvement ContractorsConnecticut Department of Public Health - Food Protection ProgramConnecticut DPH - Food Service LicensingConnecticut DPH - Qualified Food Operator informationConnecticut Department of Public HealthConnecticut General Assembly - Public Act 11-175 workplace violence prevention in hospitalsConnecticut Department of Public Health - Facility Licensing and InvestigationsConnecticut Department of Labor - Manuals and PublicationsMyCTSavingsConnecticut Office of the State ComptrollerConnecticut General Assembly - Public Act 17-118 pregnancy discriminationConnecticut Attorney General - Privacy section