{"data":{"id":"us-ct/conn.-gen.-stat.-42-529c","jurisdiction":"us-ct","citation":"Conn. Gen. Stat. § 42-529c","heading":"*(See end of section for amended version of subsection (a) and effective date.) Processors' duties. Contracts between controllers and processors.","body":"*(a) A processor shall adhere to the instructions of a controller, and shall: (1) Assist the controller in meeting the controller's obligations under sections 42-529 to 42-529e, inclusive, taking into account (A) the nature of the processing, (B) the information available to the processor by appropriate technical and organizational measures, and (C) whether such assistance is reasonably practicable and necessary to assist the controller in meeting such obligations; and (2) provide any information that is necessary to enable the controller to conduct and document data protection assessments.\n(b) A contract between a controller and a processor shall satisfy the requirements established in subsection (b) of section 42-521.\n(c) Nothing in this section shall be construed to relieve a controller or processor from the liabilities imposed on the controller or processor by virtue of such controller's or processor's role in the processing relationship, as described in sections 42-529 to 42-529e, inclusive.\n(d) Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data is to be processed. A person who is not limited in such person's processing of personal data pursuant to a controller's instructions, or who fails to adhere to such instructions, is a controller and not a processor with respect to a specific processing of data. A processor that continues to adhere to a controller's instructions with respect to a specific processing of personal data remains a processor. If a processor begins, alone or jointly with others, determining the purposes and means of the processing of personal data, the processor is a controller with respect to such processing and may be subject to an enforcement action under section 42-529e.\n*Note: On and after July 1, 2026, subsection (a) of this section, as amended by section 17 of public act 25-113, is to read as follows:\n“(a) A processor shall adhere to the instructions of a controller, and shall: (1) Assist the controller in meeting the controller's obligations under sections 42-529 to 42-529e, inclusive, taking into account (A) the nature of the processing, (B) the information available to the processor by appropriate technical and organizational measures, and (C) whether such assistance is reasonably practicable and necessary to assist the controller in meeting such obligations; and (2) provide any information that is necessary to enable the controller to conduct and document data protection assessments and impact assessments pursuant to section 42-529b.”","path":["TITLE 42. BUSINESS, SELLING, TRADING AND COLLECTION PRACTICES","CHAPTER 743jj. DATA PRIVACY AND SECURITY","(B). ONLINE SERVICES, PRODUCTS OR FEATURES AND MINORS"],"source_url":"https://www.cga.ct.gov/2026/sup/chap_743jj.htm#sec_42-529c","current_through":"Revised to January 1, 2026 (2026 Supplement to the General Statutes of Connecticut, applied over the base revision of January 1, 2025)","vintage":"","retrieved_at":"2026-09-06T19:07:27Z","sha256":"0aba9dfb3a16fbed4248ba232c97ecde423f71ec6ccaeaf2c4bdf32723c1a1f3","source_id":"us-ct","stale":false,"prev":"us-ct/conn.-gen.-stat.-42-529b","next":"us-ct/conn.-gen.-stat.-42-529d"},"notice":"GroundRules: Original legal text. Not legal advice."}