Under Connectitut data privacy law (CTDPA), data protection assessments known as Privacy Impact Assessments are required when sensitive data is being processed or when the primary use of the data is for sale or marketing. PIA’s assess the need for processing in the first place, security measures to protect the data, data retentions, data processing agreeements and other areas.